{ "Event": { "published": true, "date": "2025-11-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-22", "timestamp": 1763856182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "43c2d9d0-136e-4a83-93f0-f0b55f3338ff", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d787a35a-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855350, "uuid": "5c0f0bcf-bf13-45f6-8604-50267ac849e9", "comment": "Malware payload", "value": "2e241110e120dc781fdaf7e93d1f585b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855350, "uuid": "27757967-8787-48fe-9955-ba237641eb4f", "comment": "Malware payload", "value": "0063d8e23b2227122f876f5c5ffe9df7134714dbcb6b18751417388cd4e1a88c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855350, "uuid": "9230ba3d-6084-4f8e-857e-d68370bc237c", "comment": "Malware payload", "value": "39b8214850bab3278b054f0f10ab2e2b3e0dea6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855350, "uuid": "57457e43-1c61-4a86-be5d-f166c3103fc4", "comment": "Malware payload", "value": "8fc54dfd8e8812a7af1a7898647723fc290fc4fc441128758bd13e1e258180647d4c486eb3b48e4e5fb672d98a28567d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855350, "uuid": "cdced838-a17d-4ebc-aca6-18eb4879ee99", "value": "T147E549143BF85E23E1BBE27395B0041267F0FC6AF3A3EB0B6591667E1C53B4059426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855350, "uuid": "d6820fd1-cf9c-4c7a-a080-d1da4a666e2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855350, "uuid": "23839d63-f5af-4503-8bdc-f860dc6a6c01", "value": "49152:SvTe821/aQWl8P0lSk3aKA3Z+nAIHjhJpoGd5THHB72eh2NT:Svy821/aQWl8P0lSk3DA3Z+nAIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855350, "uuid": "ac768786-16c1-4002-b2c4-99a31537c8a1", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855350, "uuid": "37eb882d-fdda-4b91-8204-443a7ffae66b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855350, "uuid": "8e443d41-48d4-4009-88bc-3cf7f460fce2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d855d065-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855351, "uuid": "51c588d0-f0db-4602-87b3-ff4bb8e1d3d5", "comment": "Malware payload", "value": "af6e122557cac4e7a4ff49a7c79ddddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855351, "uuid": "252c55d8-0a75-4fd9-91e8-394c12822cf9", "comment": "Malware payload", "value": "00eab7240a38d4e75a746fe43c76093bdd3d5851d258eb60dce8222405d8de54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855351, "uuid": "a7c2401a-f3af-419a-9123-dd373e669921", "comment": "Malware payload", "value": "aacf3a5fbf1a26b24f636ec59cbc5329418c00d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855351, "uuid": "0aaf5f86-9779-41d4-a199-ee974bf2706d", "comment": "Malware payload", "value": "b03b7654e1c73184771753d57558f48465cb3b692d6153eb9ddc09def09b6004292e757e309ce0b6eb34e591d0596ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855351, "uuid": "4329b369-3b90-4963-a2e7-d72deb13ad74", "value": "T11CE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855351, "uuid": "4ad87f94-1ac2-4114-bc3d-8a0ec66c29fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855351, "uuid": "bbc6f53e-046f-46e2-9de2-0a771ae81299", "value": "49152:rvzlL26AaNeWgPhlmVqvMQ7XSKTLRJ64bR3LoGd8THHB72eh2NT:rvpL26AaNeWgPhlmVqkQ7XSKTLRJ6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855351, "uuid": "28d01e8a-ab70-4d80-9647-64d28e401c20", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855351, "uuid": "0afc0854-77cd-4d4c-a27b-15915fa5e993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855351, "uuid": "e85f5ec2-f95f-44da-becb-337adb9442b1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab546d17-c7e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763844538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763844538, "uuid": "dd090ca0-6a33-40df-a7a6-c8efbc0165c7", "comment": "Malware payload", "value": "4d3bf05e28d5bb1f8df0dc477b83ad46", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763844538, "uuid": "f2b073b8-8574-4e04-b99f-ed443ca33c43", "comment": "Malware payload", "value": "01351bddd0a92a65bc1182f740a5dd804d7ce484646af0afc493f1102669892c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763844538, "uuid": "b0ccebe3-8aed-4ae4-a40e-3f1f526add12", "comment": "Malware payload", "value": "2d8a961f227f251538f373ed550744fed33624cc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763844538, "uuid": "6a3ab28c-21cc-4844-801f-27593ab3b3ac", "comment": "Malware payload", "value": "f9a67d17c36d96a6011f201ca8187ab8ca29f1257ca4d2aeccdc6008c8a199842b29d99d8b05ec12e6c77e2d3b47df3c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763844538, "uuid": "2ea8d0bd-d328-45a9-8b19-df1d9041aa59", "value": "T1FD652217B2B124F9C4A6867489564203F733B8271BB26FEF97954277AE172D00C3EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763844538, "uuid": "7584cbff-7f92-447e-8870-eb04fb6e669e", "value": "f1a6a29381d34d1d69615d960835021d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763844538, "uuid": "293a667e-4b74-4045-b0c3-849cafb5a57a", "value": "24576:r6ppBKpkjyaLJQrX8/RblByCmERU402xvU4511GeyNGVRdY77wSleaui3rLebQ1e:rgBjy8Q8/NlBqAU402u8zyGRdY7kQNu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763844538, "uuid": "eb18fcf7-bc45-493e-be4e-23d67aab8e29", "value": 1542811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763844538, "uuid": "9756803b-0963-4f92-a7aa-ba5ebca9018f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763844538, "uuid": "9dfd90e2-474b-4aa7-9fc6-595aeb12fcea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9330e79-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855353, "uuid": "c3aa3429-2ddd-4d93-a42f-0fc71a22a017", "comment": "Malware payload", "value": "e3d553e553874734211b50ef8e04db73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855353, "uuid": "8fd7c99c-d362-4b8f-990f-fef0766cd1ae", "comment": "Malware payload", "value": "01b863a3c1d9d44d553e04618715854d557d6b87aea1a590850d137818712f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855353, "uuid": "d2ecbd60-a3cb-4255-93d2-300a5ce46fec", "comment": "Malware payload", "value": "2c61c7b292353e277dfe5c3947dda27a8d469f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855353, "uuid": "c28e12a4-eff9-4914-8ac9-4486df05738b", "comment": "Malware payload", "value": "f202fc44fefda1593df869d6422b3f135ec17c44303070bb11b2e3d2d89fe715d291b25ca4c25f02553e2c709a2b7921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855353, "uuid": "4a16eaf7-93d3-441e-92c3-1281e0f669fc", "value": "T1BCE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855353, "uuid": "12dd7ef9-f06c-4f98-a182-5e7e93bda1a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855353, "uuid": "432358ca-be6e-4818-91d9-af0bd65a0e0c", "value": "49152:MvnI22SsaNYfdPBldt698dBcjHlwRJ60bR3LoGd74THHB72eh2NT:MvI22SsaNYfdPBldt6+dBcjHlwRJ6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855353, "uuid": "a08237b2-b4e5-45d6-a117-f010ace9d514", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855353, "uuid": "315607ba-fdbe-4226-9d6f-05008b66b70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855353, "uuid": "041cf572-9805-435a-b325-89a21fb26b16", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0461fe-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855354, "uuid": "96fb12ff-1d12-4a91-902c-5d333708f7ca", "comment": "Malware payload", "value": "03f42c158aa7d2c75fe9dc1ee44ba869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855354, "uuid": "8edc413f-0aa0-45d9-98de-8bba612a50b8", "comment": "Malware payload", "value": "01c7dbc881ac9b13735e51709410ba44d7b08a99c479e0709417ec45241c4bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855354, "uuid": "6c90e40b-bc28-42fd-8c8c-665631552a22", "comment": "Malware payload", "value": "64f03ec5030fc61cf36095c4ca2d09a52fb07625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855354, "uuid": "328b5bd1-1df7-487c-947c-d3ded677c713", "comment": "Malware payload", "value": "9aa34807ee3ffdc87a5f8aa711e00f1974bed2c8caedbe94748e389086efe9c8079c29daed4bda47e47a5b88f66c4eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855354, "uuid": "37951b87-ddd6-4be0-8c02-e97c3a4f449f", "value": "T1E6E55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855354, "uuid": "f3c4e7db-6350-40cc-b32b-41d641f340d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855354, "uuid": "7151e1aa-8b4f-4c89-bf80-8c0d7f1d738a", "value": "49152:WvvY52fyaSZOrPWluWBuGG5g5hFWaEEakyk/mFHoGdNTHHB72eh2NT:WvA52fyaSZOrPWluWBDG5g5hFWa6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855354, "uuid": "0e295fa6-3a22-4e2b-80fd-0807f452ee24", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855354, "uuid": "e933973e-5a9c-4f3d-bbf9-85edd31ebee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855354, "uuid": "c9a36c21-6afe-4d4e-99ab-66edd5fa2078", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad5e938-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855356, "uuid": "287ec65a-9b2b-410a-9fb1-e65fe005af33", "comment": "Malware payload", "value": "7bf19e8578e8a3eedc697be33ff32ca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855356, "uuid": "fa1c7de7-0015-428c-a46c-d006921e3b93", "comment": "Malware payload", "value": "0240cda2ce83e8eede0f1c18c05d97b3da9f6cfa5c6439bad42414d67dc406d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855356, "uuid": "a38a8638-09e4-43f6-b9be-b12a3bc2b14e", "comment": "Malware payload", "value": "ed0a5bd14509dc75a5a06684530229931067807a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855356, "uuid": "ead13ac4-7b1e-49cc-8219-e0bfd0d114b4", "comment": "Malware payload", "value": "f739397d147c270ebe1cb0fc48c6419d5c2b16602a26f0b9588a4bf5d31a42aaa78b5b146823394118fefa3a0b626d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855356, "uuid": "fff2fdd2-578c-4058-8834-1a746820a852", "value": "T129E56B1437F85E63E1ABE2B6C5B0051663F1F82AB3A3EB0B51D1A77A1C837508D417A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855356, "uuid": "0fc2c0be-dce3-4626-890e-aff20129260b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855356, "uuid": "200b72e1-e387-4e10-a50c-994078a3e5e7", "value": "49152:RB7Um7J2dlamagXPBlUZIrWslcvJQOaUWr1z6N4maCCKaGv2LkmNKt:RBQmV2dlamagXPBlUGrWsG8o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855356, "uuid": "c22ac5f5-3ff5-45ce-be33-5aec0d436eab", "value": 3315712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855356, "uuid": "39e86abe-dcef-40dc-8399-f00f32ef7e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855356, "uuid": "e5a07ef0-5a9a-4a4a-90ee-1289cb80c2d9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbff827-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855357, "uuid": "39ab944d-e340-4902-8d6e-0ece0c62f218", "comment": "Malware payload", "value": "b6f2d6235a2a7d14f93b9d72411c0069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855357, "uuid": "4d539ef1-2073-435d-93a7-37279d5bbc00", "comment": "Malware payload", "value": "028db277c0e33682ec1ef221dc1249085f9b6eec463a0be9b3e85db0d6355d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855357, "uuid": "d9fa0cbe-8103-4636-8e29-011ac7b6a3af", "comment": "Malware payload", "value": "cb8ab24518deade1b63813b244071d6ec8fc3f4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855357, "uuid": "3c590bad-36c5-4c6a-8c4b-bd4777916c09", "comment": "Malware payload", "value": "db581904abd0c74bfaa553ae05613f1fdd5f53aab1576ed148cf9fe38d9b3b6521ab9812047025fec86e86590f58e77b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855357, "uuid": "376b5706-396d-49da-bc0f-dae9453d1131", "value": "T1C2E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855357, "uuid": "ed16829c-f9bc-487b-80c0-069f98a0a5e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855357, "uuid": "9a85fd8a-dd0b-415e-89df-e0695b81fb69", "value": "49152:CvTI22SsaNYfdPBldt698dBcjHpUxNESEOk/iRLoGdjfTHHB72eh2NT:Cvs22SsaNYfdPBldt6+dBcjHmx5hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855357, "uuid": "eead6340-8b9a-40d6-b8b6-d85f4de39460", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855357, "uuid": "e3263ce8-81bb-47d4-ac8b-9b3472003571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855357, "uuid": "b8ab1da8-dd6f-490b-9a05-792842d65c13", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc73bc0a-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855358, "uuid": "aba16fd7-e914-423d-9077-f4bef74efad1", "comment": "Malware payload (QuasarRAT)", "value": "ac5ab980df1429cac5b889e2bc922c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855358, "uuid": "f74d04ba-f79e-47f8-8a8c-17ed2ac010d6", "comment": "Malware payload (QuasarRAT)", "value": "02b713428a79988d28fd2577ac8622f2088b649454ea9bec830abe6a8a4cface", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855358, "uuid": "d0030d32-a89d-408b-818a-c5fcc1de35d0", "comment": "Malware payload (QuasarRAT)", "value": "625209a26baf0629d315fef165ccf5b90cc267db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855358, "uuid": "6e12dee8-7d1e-4ffa-b45d-c51f4d723e7b", "comment": "Malware payload (QuasarRAT)", "value": "367caa771a6dc8c6084c935e2f0a155871a6ca27b5ec8bab7f7b2a6250c63687c3d88abc0b915c1ce434fdfd0816cb41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855358, "uuid": "8f4c2053-8e22-4d36-a6e4-c0f6f51e70f6", "value": "T1EE848C5773A4E53BD1FD173AE43246054BB0D8877A12F38B5A6C52B8AD223868D523B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855358, "uuid": "fdf8f60f-6be2-4fee-b1ef-9def0435babd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855358, "uuid": "b51d53ff-c71c-44ab-be37-53abc4cdab65", "value": "6144:gLNHXf500MbclRhbI+uHDFt7UXRgROIy:qd50y7u/HDFt7UXey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855358, "uuid": "1a452dee-522b-4a24-846b-dc67b1ff23eb", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855358, "uuid": "15f75aa8-9c64-4622-8ae3-0739342f6a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855358, "uuid": "578b496e-84d7-47c6-a287-03dc24355f3a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3f9d44-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855360, "uuid": "a9c4f57d-0239-4860-9706-8229833ca74a", "comment": "Malware payload", "value": "7b72ecdfa400238d802273bc1b589f04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855360, "uuid": "ba81b4bc-3107-4ca0-8224-69983ab45a57", "comment": "Malware payload", "value": "02d47db3ebd7be5a7b84637b07745803cbe5e13f7bca96ad4ce2c61f01da92c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855360, "uuid": "5b757560-bf1a-4857-805e-fb83a4c276d9", "comment": "Malware payload", "value": "c5491658ee93203dfc7c3ae1ce607e4454ff56a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855360, "uuid": "0d47fa24-1fe9-4666-abdc-9e4df2d8b2d6", "comment": "Malware payload", "value": "2e171dd837203ba6c45265b329c81a376316c9cfc49d3f3746c8ef0516beb177e31baf1023c28e89df1daab1e980ad7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855360, "uuid": "f6a89b7a-e086-411f-98a8-c01d40a8de11", "value": "T1A3E55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855360, "uuid": "62947b56-8ad9-4153-b2db-a7327a6a0336", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855360, "uuid": "86114675-8c84-4f70-9706-c6392a5ead98", "value": "49152:/vIAd23law6wGPAllX3SSLNUpyR+DnEDHqk/OrjoGdHTHHB72eh2NT:/vZd23law6wGPAllX3bLNUpyR+DFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855360, "uuid": "134b93ba-833b-4096-bf5e-53f8c14fb6b0", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855360, "uuid": "88380333-d6fc-4036-adc5-34f917eb91df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855360, "uuid": "33c6940b-b4cd-4a90-aae1-f034eb95f7f5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2a6520-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855361, "uuid": "530f6c9b-aa69-4449-9574-a6e5d6e18363", "comment": "Malware payload", "value": "fc9258e7a1d7b090eac34cb800956f85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855361, "uuid": "fcaa262f-4822-49a4-bdfc-d0e469611b87", "comment": "Malware payload", "value": "034054e2fd4658611fef43a88d2939ca1fb515bbbc128a37890072e5299f1195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855361, "uuid": "128675f3-a582-46c2-9125-ac33c73ae8f8", "comment": "Malware payload", "value": "72c7dddf1bf320eaee143b3023ee23a278598bd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855361, "uuid": "f456b78d-0926-4c76-a4e9-e77fe7009634", "comment": "Malware payload", "value": "c9c7450185d95af2de2499b7b8f98ff34bf2a752ac23fb328c6d1ed55098fc206f6e5bc0da93484cb84eb9c6ea3efa0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855361, "uuid": "03d28c4d-351e-4238-810e-f1b2fde2d90a", "value": "T139E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855361, "uuid": "6b9ad1df-a8a3-4688-87f4-220394b684f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855361, "uuid": "09cef1ee-921a-48b4-a36a-d0fb6b3513c3", "value": "49152:HvyI22SsaNYfdPBldt698dBcjHjNRJ6pbR3LoGdwjTHHB72eh2NT:Hvf22SsaNYfdPBldt6+dBcjHjNRJ6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855361, "uuid": "d91d1e2e-b1a9-4548-8861-cb8388502616", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855361, "uuid": "d6b81549-5b1c-4ee7-a619-a5476779e5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855361, "uuid": "ae52d345-cfc3-4a2a-bfdf-81deef2f70cf", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee689cb-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855362, "uuid": "087b299f-c0d9-4e19-9dde-9cad6280858a", "comment": "Malware payload (QuasarRAT)", "value": "4b0527a519b522afc05dd8750ec3477a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855362, "uuid": "b2bc0be3-63ca-449a-91ae-8877521ff43e", "comment": "Malware payload (QuasarRAT)", "value": "03c2807fac44d0d77c966b792057ad72e64388796d89506fcabd12dd49a1ff99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855362, "uuid": "18309360-c73c-45c5-8fb7-f4e5be256313", "comment": "Malware payload (QuasarRAT)", "value": "f6b7d51158e4189f9f380d73b220dc05e90f9d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855362, "uuid": "b931aa34-c6de-47e0-9b9e-d674a13586c0", "comment": "Malware payload (QuasarRAT)", "value": "76e868f20339ec5a7abebd632de1e9db2512093577484ca71d2d9bcd0b7e2e076b2f6f66d0f68a36a385195ef10febee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855362, "uuid": "08a7c376-817a-4192-924b-080f067f71ba", "value": "T1FB847D13B3A8E57BD1FE1B3AE43207155BB0D887B716E38B5A5855B92D233868D403B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855362, "uuid": "45f6f632-8981-445f-9805-501c8500dee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855362, "uuid": "48198efc-9e9c-4db7-9f19-e2b34c967458", "value": "6144:hC6bPXhLApfpPeWm76DIIwbN4wJJCjck3jddrDw3W:cmhAp8sC3CYk3jddrD6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855362, "uuid": "1f92d902-8922-4ff7-bcc2-56b4d7c4d94e", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855362, "uuid": "e675171a-f9a0-4929-8468-cc0781a38fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855362, "uuid": "48d17e54-2bdb-4805-9867-e216d1eee81c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf8806e-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829505, "uuid": "91979455-7b94-46ed-802b-2c6b0f7f9a39", "comment": "Malware payload (Mirai)", "value": "78321c0dec846cca8ece2ca243e900bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829505, "uuid": "1dfd990f-efd6-4804-8e14-a3a77452e83f", "comment": "Malware payload (Mirai)", "value": "0401b37a0052939b48f2844e29ab5c0b7786db95bbbaa279ed28141d86bc0b30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829505, "uuid": "4bae1202-8fa3-4dbf-ba0e-1c3a942bbb51", "comment": "Malware payload (Mirai)", "value": "0a36fab7f4d1fddee58b6d35d7976e45d01e6521", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829505, "uuid": "0e7bc3f0-d0a2-414a-8a96-f25a6c6f239b", "comment": "Malware payload (Mirai)", "value": "91f1cf6ff74d5a44566605b41d6dba13bf9b34c9668bf93e8aace8d7bd3aa83bbad4c150c39c217589c62f14a23f95d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829505, "uuid": "806ca9af-4104-471f-990d-632628b322bc", "value": "T13724D80AABA10EBBE8AFDD3706E90A0124CC556722B47F3A7274C518F54B64F59E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829505, "uuid": "69fbcb81-3684-43ff-874a-a8bedfad3926", "value": "6144:QbbdyA6kkEYtq/Kivd6MFqnkYNvVUzuV:OQBkD0kYcqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829505, "uuid": "d497dc5c-5111-4827-ba82-f42a3774943e", "value": 222664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829505, "uuid": "e760c812-d284-43c3-86f2-e636b15076d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829505, "uuid": "170faf89-b528-42e7-af5e-c439b76cdfdc", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc084f6-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855364, "uuid": "81f17027-611b-40e9-8114-47a65b47740a", "comment": "Malware payload", "value": "e02923c98036d0c7f5a6b97e141db5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855364, "uuid": "db6b954e-3b4f-46db-a410-19954e648989", "comment": "Malware payload", "value": "0436c83f6020db1813ee3bd062420e5e792042c97bc8cf9bd3a8751f579c5c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855364, "uuid": "7194a37b-c705-44eb-9640-c1d7a4cd12ce", "comment": "Malware payload", "value": "f9ad78be45e63bfabd8b22bba8bd30760749a820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855364, "uuid": "d96c7dfe-1705-4399-a111-0efd4f8eee16", "comment": "Malware payload", "value": "f607905fc162304b9049a9dd17ff202a76c6d7b128852e794ba52adc863c25597cd307612c556a7f62997a1f2734b54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855364, "uuid": "fe9888c8-c878-4550-9cd1-fc3f3925b741", "value": "T12C0633C57EAA34DBD0E035B09085FF18255ECFD14DEB411A7B87F618E9BB242D61A08B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855364, "uuid": "3c2a5f0b-669b-4310-89ec-5ff375548694", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855364, "uuid": "46a2dbfd-04fb-41ad-a643-a53edeeaaf4f", "value": "98304:bwF55w4zddPFn0pvNY7YJHpKVi6JCEsegW9PXiMGdjCI:buw4XFGNY7YJH2i6JCEH9PXVHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855364, "uuid": "c43494cc-c7f5-4404-9653-58bcd01ab0b9", "value": 3990528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855364, "uuid": "c36bd341-52de-449d-b401-e9f3f38aa9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855364, "uuid": "7bb548a0-b809-41b1-9837-ed14acaf7b99", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0adf1d2-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855365, "uuid": "0dcfb6a5-294c-468c-ab70-34f162e4f5c9", "comment": "Malware payload", "value": "aded0156a136f9ffd91223a957c4dda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855365, "uuid": "dfdf93e7-623a-4049-8e97-63eb50fa90c2", "comment": "Malware payload", "value": "0447129f35c70f8308390f8ee1b84e5c852447402352e26ec8ae53baacd6a5bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855365, "uuid": "12842c03-41c4-4019-b506-c27792c716f5", "comment": "Malware payload", "value": "aea438bdb86dbcaf87efacafed06423ff3d1b668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855365, "uuid": "b7bc3ce4-a674-427a-a317-5b739fd1e6e4", "comment": "Malware payload", "value": "278d0221f1712511c6f58f117529b05ec8843555c2755277e068564c99f5bf8288e8cf56971066e8575583c9de3c3615", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855365, "uuid": "edd7aea1-7e56-4307-8a85-593567bebfa1", "value": "T17CE54A0577F85E62E16BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855365, "uuid": "c89f1176-365d-49af-af4d-cd55d190d045", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855365, "uuid": "b3276b68-294e-44a2-82da-97181653a21d", "value": "49152:Bvpt62XlaSFNWPjljiFa2RoUYIJMimCmzoOoGdEupwTHHB72eh2NT:Bvj62XlaSFNWPjljiFXRoUYI+imX0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855365, "uuid": "a885dd2e-83e0-4ab4-b1fb-91ca4a18ac8b", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855365, "uuid": "35ffcd1f-3a6a-49b2-8d87-63c39c37f25e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855365, "uuid": "9ae2ad12-91a6-4347-9032-2e89b666691c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e174f7bd-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855367, "uuid": "4cfdedd0-745c-4803-ac05-9f18ccdd6fb9", "comment": "Malware payload", "value": "e7d38998cacdd66088f1fab9ee449916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855367, "uuid": "361dac8e-82a7-450b-9b5b-3863e196b5dd", "comment": "Malware payload", "value": "048a6a3038dcfa51af0124c7c137746aad2c8641aa328577455bc97b091201de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855367, "uuid": "acd929b2-d29b-4f93-b82a-e93e4c5d91f5", "comment": "Malware payload", "value": "4de0d4a2ee5deb369a522b04f4f89dcb4c40b569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855367, "uuid": "a2d8076f-a0cd-489b-a863-d23a0cf997f9", "comment": "Malware payload", "value": "197f4af8cb03c765dac0cb0c0ecb0675c10e62c138fb16dceb6399714bdbbd2d6fb35163ac05ea96de9e23675e24fe3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855367, "uuid": "9255e19b-d850-4103-b885-a55934f631f9", "value": "T172457E2039EA801AF1BBAFB5EBD475DB8A7EF123360A965D159103460E12B41FDC713E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855367, "uuid": "8a4de0a4-a16c-4b5a-bd2b-5cbd34508ab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855367, "uuid": "58a4d9cf-f9cd-4d77-88a9-2acbceb08e01", "value": "24576:GurYhuGB2JVl3AS2HIPbcNE0KKzaOwIRxl2SR82Zl:GQYhuGB2JVl3iEwKKzwipm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855367, "uuid": "dd52a097-337b-4767-9c0e-c6f9513f0195", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855367, "uuid": "4a8752a2-2817-46b8-9613-76a2e248793d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855367, "uuid": "dccca88b-61e1-4da4-a1f2-7de580b57d3c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e258e639-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855368, "uuid": "d42caf6c-2474-409d-aecb-d0fc03c2d4e1", "comment": "Malware payload", "value": "bb537d97c363a5bc7392eefbe85bb4be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855368, "uuid": "36eb2c53-4500-4387-9a63-3a2d02c66bea", "comment": "Malware payload", "value": "04e5a9eeffbeb0a9ed27413fe8194b3eacd2d3d2b4782e79ac3e32987f57b9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855368, "uuid": "a6b87fa1-9ec1-48d8-8869-9d3509b66f53", "comment": "Malware payload", "value": "a9f8b68568fbe467e0d85328f5eacaed2a181ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855368, "uuid": "56e59843-eeac-46fe-aedd-cb78c6cb91de", "comment": "Malware payload", "value": "adb0f5600bf000d292d52d59e7010878c19dcc9e0ef5c9381b3fad77efc6c46e75c4bd26bb465289be7ccba07cb8f9e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855368, "uuid": "f62ea6a6-572e-4d41-9c91-475cb9b74997", "value": "T16BF54A0137F81E2AD36A9AB2F1F0502663F8EC1EEB63DB0A1D5176691C43B445CF16A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855368, "uuid": "689e04ec-52e1-4cef-8f61-ec912569ef80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855368, "uuid": "30c21902-69cd-47f8-86c7-e31e8194045d", "value": "49152:yvBt62XlaSFNWPjljiFa2RoUYIsTxdW57GAk/93oGzuOTHHB72eh2NTV:yvr62XlaSFNWPjljiFXRoUYIsldP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855368, "uuid": "731e65be-d295-4db4-beed-e14fbb9819d1", "value": 3449856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855368, "uuid": "805d2c5f-d835-4c15-9d55-aa2b5aaec0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855368, "uuid": "e390c4c9-a6de-433b-86fa-8a5d5fae5f27", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33cf1b6-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855370, "uuid": "63ed8a7d-3d68-4f7c-bf76-d6ea864b7e70", "comment": "Malware payload (QuasarRAT)", "value": "0e9796b14cb2b6a2f47324b744b87ba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855370, "uuid": "ef4a2bed-c3a0-439f-81a5-d1bb3fea1614", "comment": "Malware payload (QuasarRAT)", "value": "052954dbb68e33c984721525cee75c001fb2dced93a2b493aa62aba69acfd9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855370, "uuid": "b36a44ac-2535-4d79-834b-ef129ea9f72b", "comment": "Malware payload (QuasarRAT)", "value": "0a04d1e1b1b1fad846181f9f720d64c74a639917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855370, "uuid": "345df48b-6dbf-411e-920c-fe84eb07aeeb", "comment": "Malware payload (QuasarRAT)", "value": "91e25a8f72a02689bf0f389bf23aaa46d24656f4b53b2a297460bf3b731cd915ae59444ac154d1cc491e1aab93c20131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855370, "uuid": "0fe379bc-de8e-4659-a7db-6df53e9be747", "value": "T178E55B1537F85F32E1BAE37395B0041667F0F82AB3A3EB1B6191677E1C53B4148426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855370, "uuid": "63e792ef-4f0e-4d19-9559-aeaef50e5a00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855370, "uuid": "a7c2b9a5-46ac-45a0-9208-4ac0176dac7d", "value": "49152:uvOI22SsaNYfdPBldt698dBcjHFG/1puKxk/lLoGd9THHB72eh2NT:uvj22SsaNYfdPBldt6+dBcjHQ/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855370, "uuid": "466db625-ae8f-4b0f-a221-1189a1b0b5be", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855370, "uuid": "611640d3-50fa-48e4-b842-056d596024ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855370, "uuid": "2f9f798d-9aa9-4da2-843a-0f6c802cf046", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41615fa-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855371, "uuid": "b90c9945-27d8-4545-bdf4-e270599b2850", "comment": "Malware payload", "value": "dbf58d3c64366154a68d6998c5b22728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855371, "uuid": "d405dc05-8928-4a7f-860b-9866f05ab1d3", "comment": "Malware payload", "value": "054fa5c323cfff9f77d1e7090d86d4b6c451795f494ff8391503f33335f62c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855371, "uuid": "5b0ba880-0633-46d5-8ea5-4da0b95aa688", "comment": "Malware payload", "value": "4f5324bee39619020fe6b260cc55dee09da138c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855371, "uuid": "9db72b22-919d-4332-8851-9718a73c085b", "comment": "Malware payload", "value": "3aa0bea78d1a93e3a562a176d4550ee8937720beae0e5797d78ab211182de214700d007d0c4d5f897fb63335f67a86b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855371, "uuid": "62585fbc-d2ec-4144-a8d0-99b65c5cbbba", "value": "T100E55A1437F85E33E56BD273D5B05026A3F0E82AF763EB1B129167BE1C53B4488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855371, "uuid": "9a702615-a315-4cbe-8cd0-e86bfc359340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855371, "uuid": "75281b76-fe7b-40a1-aa60-6036c7a32ace", "value": "49152:6vnt62XlaSFNWPjljiFa2RoUYIFLGCABesLoGvzTHHB72eh2NT:6vt62XlaSFNWPjljiFXRoUYI8Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855371, "uuid": "eec3a756-e755-4fe2-9322-4d64485cf13e", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855371, "uuid": "595375f7-5fc5-4edd-987e-b1fe7d06bd9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855371, "uuid": "3154b5e7-072c-4bbe-963c-0ff622fba524", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f452a7-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855373, "uuid": "69a49e00-ae70-4a8f-985e-9769d1bd5081", "comment": "Malware payload", "value": "fdbec1b4f9ec61ef16d99531b22447ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855373, "uuid": "be82c5ca-6ef1-4ed0-bac2-dd94f0f7b2ac", "comment": "Malware payload", "value": "055304cd0dcd203ebc311e5b5d324f7710944ce55bdd115566162e779fd7aa1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855373, "uuid": "4b53d9b2-e45f-40c3-a9de-fdc1e1429dc4", "comment": "Malware payload", "value": "b1845f5088c3d2f08a75d6e9f3c925f9daeba403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855373, "uuid": "458504fb-8b23-48f1-95f7-24e94d05504e", "comment": "Malware payload", "value": "ce5fb50f33536ed69c072809ee418a8d0ef39fad0048b9b6690e601e6455ca10b3b5aaecbb8a2114bbe631c4697f5e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855373, "uuid": "f4a5ac69-5471-464d-b2d4-4ab6709cd319", "value": "T10D95F051B7F9450AE1BF5BB8A8B604450777FA02DA36C38E08DCA49D1FB33909E517A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855373, "uuid": "fa7eb9dd-deb6-4a61-b0f1-b0d4977807a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855373, "uuid": "312d0b29-a7a3-474b-a77f-b24c588500f0", "value": "24576:JNOaqS2eWBRwRR16z/0m8yXP8oc5R2NntxY0KKm77yviUSQaZaOwI55l2S62r9i1:JNOX7wRPirm2NnPTKKm77LrwCB6uans", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855373, "uuid": "30ca4c7f-dd3e-4821-a25f-3960cc553788", "value": 2058752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855373, "uuid": "5e62f38a-9081-4804-b5cd-e679343d99fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855373, "uuid": "1f79a983-9dd2-46eb-814d-f6a23f279c12", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c05ad1-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855374, "uuid": "64a7e2fb-52d0-4233-9bc2-15bacd038414", "comment": "Malware payload (QuasarRAT)", "value": "69d7e4b31e803ae816ae8cb2eb7a5277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855374, "uuid": "168aaab4-ab1b-4d8b-afec-b4b66bfbbee8", "comment": "Malware payload (QuasarRAT)", "value": "0577ff125d4ef222e2302138bbaa724b05316a3a69182817368d0665e59df8eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855374, "uuid": "85cfb0f3-78fa-4415-b03d-b490bce9fcb0", "comment": "Malware payload (QuasarRAT)", "value": "3e4d854ec04cd0f5f8f57258935902cd23cd606a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855374, "uuid": "eb572117-9621-4437-b200-97932f1f0ff1", "comment": "Malware payload (QuasarRAT)", "value": "580fc519703fcd452d2a3d0c7d7db37e3cd74d9d3015b360d40be83390ec0e6d67ed50424c96b311a7b2e6f3e277ef7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855374, "uuid": "89afc9af-c9ca-4da0-b35f-db2c8e4f4e83", "value": "T1F9E54A1437F85E23E1BBE273D5B0041667F1EC2AB3A3FB4B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855374, "uuid": "70d2fe03-4ad7-450e-a5cc-66d7fa99ed13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855374, "uuid": "5dd0112d-0a71-40c9-8cba-d32bb2c76973", "value": "49152:jvalL26AaNeWgPhlmVqvMQ7XSKPFST1J/OoGdKgTHHB72eh2NT:jvCL26AaNeWgPhlmVqkQ7XSKPFSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855374, "uuid": "cc324101-1b1d-4bb5-a761-63ae2d43390d", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855374, "uuid": "06d7e4b9-4667-4c16-95aa-3af2d887ba92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855374, "uuid": "1e931395-5e0e-41fd-b3b4-0b987566109b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68a42ea-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855375, "uuid": "9a89d353-e424-43fd-b425-f4fe5784ebde", "comment": "Malware payload", "value": "1762ea4e27fadae2a10e1d1f75c1ce5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855375, "uuid": "ad9c2c26-9fa0-46ae-aa20-50ef3fc3e58b", "comment": "Malware payload", "value": "058cf38bdbbecdb7349cb471149d57e2570a1d74573cde7356fb84a11f66173b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855375, "uuid": "7d03b145-fecc-4566-88b9-7311d1f661d5", "comment": "Malware payload", "value": "f656ace8fdf0578a834599ffe09742fe16920fc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855375, "uuid": "1295cd44-a594-4e08-8d54-87930d8b018e", "comment": "Malware payload", "value": "b1510b12165b1aeff7a0685eb8c64c72739d6a6c0f87f24c936b2b3e3f16f679789e522b76a6e286e9bc6ea4972e93a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855375, "uuid": "d897a12f-3e10-41fa-a6ca-102850a20053", "value": "T15E950110B7F58246F1BF2BB9A8B304450B77BA039A3AD74F598CA05D1FA37409E513A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855375, "uuid": "cfb14f8d-670a-4bf6-8489-f2d66cc947dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855375, "uuid": "7b992bc6-fc9c-49ac-87bf-1eab7d58d111", "value": "49152:DrZuh7rRFirm+Nn42KK8i7Ltwa+VVaS4EW1q:DrZuFavNnoK8i7LtwbHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855375, "uuid": "bc824ba4-a42e-4867-bcaf-9598ab2b620f", "value": 1951232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855375, "uuid": "943a3a63-b2ba-4b63-a102-49768a68a5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855375, "uuid": "e4a58224-5287-40ea-bdcb-ebb1610915bf", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7609458-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855377, "uuid": "5eb305c4-0bc2-44ad-84d4-2a32da718c33", "comment": "Malware payload", "value": "38158b335ce8e37fa480f448e04285a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855377, "uuid": "9518964c-0e56-4db4-98f7-7ae79b9cb201", "comment": "Malware payload", "value": "05a2329afb0284cdc9711a7b5d1be498c3e7303eb1c3037a7b092b86488d980f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855377, "uuid": "a8d5140b-11b3-4c31-a45c-874228119fdd", "comment": "Malware payload", "value": "d47a7528d8000d02c62d4c1d56d7a35d4fcb98bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855377, "uuid": "de00a7c1-6bc3-42a6-bd12-fb58d1ebb008", "comment": "Malware payload", "value": "36287af842f4b7f7f8bfba3189f0c8754b505d359552d5bd449d3bdae3577c831d618811dc7b9c005c70744d14ba5a45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855377, "uuid": "460ab1ad-c431-42c8-9dc5-428cd3d16fc4", "value": "T1B2E55A0477F85E62E5AAD3B3D5F0541363F0F82EF3A3EB0B5191667A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855377, "uuid": "c2a3687d-15b8-40dd-a24b-0f41468e38c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855377, "uuid": "5b142c15-eabf-4e3d-bc6b-4aec3406dc78", "value": "49152:BvKI22SsaNYfdPBldt698dBcjHNmmzV1oGd8X4THHB72eh2NT:Bvn22SsaNYfdPBldt6+dBcjHN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855377, "uuid": "e9e455a5-ab21-4fe7-b3b0-eb27d6281eba", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855377, "uuid": "6a9dc4bc-864c-4f37-a55d-ea44f2de6d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855377, "uuid": "bf451d5d-2286-4999-89a4-375ed70c4454", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82f4e05-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855378, "uuid": "d331c318-c953-4451-89e6-f0c4dbfbf094", "comment": "Malware payload (QuasarRAT)", "value": "507affff54e9e722e3be17532fe752c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855378, "uuid": "f14d5493-7478-4834-974f-70155ee6c4db", "comment": "Malware payload (QuasarRAT)", "value": "05ab460234cd49afaded0dd3bc1de10561b82d91f14683e9a56017077eae45d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855378, "uuid": "46afdd01-5edc-494c-a297-0e9a6deb1f71", "comment": "Malware payload (QuasarRAT)", "value": "27a2ad5cb96df2092d2deff692d0d4cd7d498444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855378, "uuid": "2509da82-ea21-429f-a201-573dd0986814", "comment": "Malware payload (QuasarRAT)", "value": "70990619ae1ad2cc88a8ccba546dcc1d44cf09d8b910abf92707f27cd89d60737213a00823a2fd8e14e209e95ece857c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855378, "uuid": "f9c18ce5-ca18-4860-8cc7-5df104845097", "value": "T176850110B7E88217E1FF2BB9E8B216454B73F952E83AD74F1958905C1EA7780DE503A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855378, "uuid": "a761c5de-4156-467b-a0f5-b0b07be3a900", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855378, "uuid": "d5d68968-0a31-44c1-9a2e-086f0dadbbed", "value": "24576:Ag0ikfHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfEez8cbUFb2:Ag0DSGOGqnXpyWTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855378, "uuid": "c55fb67d-5060-4e49-8915-b1099f62c5e2", "value": 1868288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855378, "uuid": "f25efbc3-46ca-46c8-ac4c-d6909bac64ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855378, "uuid": "83a16f20-3efc-44b9-916c-555b7c4eb09f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91d1d0f-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855380, "uuid": "4bb47f22-9040-4a4e-abfb-65daaead0d58", "comment": "Malware payload", "value": "09d11d6928250d2536f9c9106670f903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855380, "uuid": "ba82bbd8-0572-48d3-8506-e890709e5ff8", "comment": "Malware payload", "value": "05ae34307fefa22875a6ef1c5fd7f4a19b26c86778b5cfdc0052199d337e358b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855380, "uuid": "88fdffb5-ee71-4211-8511-dd647aa5e61f", "comment": "Malware payload", "value": "ca8019f561b32312fd758b30d86a31f7cd0e6499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855380, "uuid": "bd9ec44d-3521-4f40-8d63-ca786d7ae593", "comment": "Malware payload", "value": "69a8484c78331582406102498412271887e42ed5baa6b6190896269d73c36e64cf2be3710a020eade65eb501a8422013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855380, "uuid": "9fc61aa0-50f2-4aec-ba44-43b677f77f5d", "value": "T138E55B1537F85E23E1BAE376D5B0041663F0F81AB3E3EB1B52D1A67E1C43B5089416AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855380, "uuid": "3cbb822b-955a-4f4b-9110-cc4d02fc48c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855380, "uuid": "c64f822e-5bb7-4579-b444-baf778ff001c", "value": "49152:FB5nmzk2h9a9o4wPxldtXh9K2cUDNqUMRhs3x3S+KtdoGdQJCKaGv2LkmNK:FBVmA2h9a9o4wPxldVh9Kirag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855380, "uuid": "fce2a21f-342a-4e0e-badb-522cf690dbc8", "value": 3256320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855380, "uuid": "2a6025a7-9e3b-4de4-b722-2b657307f4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855380, "uuid": "64bcb333-6a3f-48d2-89f0-376d69bf419c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e6ff23-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855381, "uuid": "18044201-af61-4c6d-8a45-3b2d4510d4ba", "comment": "Malware payload", "value": "3a071ac67faf3eb98a4f8812bb6ae80c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855381, "uuid": "876142a2-6c44-450a-bb00-71de5e9a219b", "comment": "Malware payload", "value": "0621eb60975dcab54febfa94a0f48956d2769a6c937067ba9cf323aaa8adb607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855381, "uuid": "a9c757e3-d9c9-4fa7-9e5b-8e2da992c0be", "comment": "Malware payload", "value": "50114817057982c854c94712189f342ebc6caa32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855381, "uuid": "bc1f9bdc-f6f3-4cbd-9b85-d8cc9f32c775", "comment": "Malware payload", "value": "29407b8f9c638f5f2b69829b2f62dfb82c80abcdc6e51f26d43a74b22fc6326d343175d575772c29c17a2acc3132fb4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855381, "uuid": "7433ca5f-ad2e-41bc-95e3-5dbebc6d83c6", "value": "T1D3E56B0437F85E76E16BE6B7D5B1501263F0F82AF363EB1B2581A77A1C53B4088426B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855381, "uuid": "16996073-cefb-4dca-89cf-77c979f275be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855381, "uuid": "bac51548-60a9-47a6-82c7-4b74535d6f96", "value": "49152:2vxt62XlaSFNWPjljiFa2RoUYIHd6LoGdCmTHHB72eh2NT:2v762XlaSFNWPjljiFXRoUYIHdky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855381, "uuid": "83366c9c-5b50-41fe-8040-35083fdb7382", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855381, "uuid": "63830787-1457-4529-a0b3-6e05222aca52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855381, "uuid": "dea88f4c-d13a-47ee-9c9a-e6113adcafa8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaba1a05-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855382, "uuid": "82d38e85-b83d-4316-9f6e-745f3e1cd1be", "comment": "Malware payload", "value": "bd85f2a17e850d209d4d5fc482222db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855382, "uuid": "10faa76d-9840-4439-a671-89075eb88851", "comment": "Malware payload", "value": "0627076f909d0f2c316377af16cf5d91844b49a8a8b1bc8540bcea63dad047bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855382, "uuid": "5fc52eb0-f05d-42c3-85f4-a87e74f7f233", "comment": "Malware payload", "value": "9567565bf27cf33130ae3d153c0dabfeead6d0b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855382, "uuid": "9f703e1a-be1c-4b78-82d3-164b16b79a93", "comment": "Malware payload", "value": "3107ece62ef09fa97fbf879beded81e24391f5b0e0abf9d927148c75d5b2e05089d86fd56ea0a788e22664abcc956936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855382, "uuid": "19a595d7-be07-4ffe-861a-6e7b7098489e", "value": "T1A9E56B0437F85E32E16BD6B3D9B0501263F1F86AF363EB0B6191667E2C53B5058427AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855382, "uuid": "84344d4d-580d-47c8-9518-af9bbde12064", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855382, "uuid": "5f2f50d5-3f5c-4d57-ba92-a04f01e19d7a", "value": "49152:HvjI22SsaNYfdPBldt698dBcjHhJC5BoGdjrTHHB72eh2NT:Hvc22SsaNYfdPBldt6+dBcjHhJCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855382, "uuid": "e7b64dd3-0385-4cef-867e-c89882a03b69", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855382, "uuid": "6468d7c7-4801-4d8a-8bbf-f820443ea201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855382, "uuid": "70da580b-8f42-462c-93d9-d008525ca6d7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9f5e7b-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855384, "uuid": "2ade77f1-fd14-45c4-9fe5-61d55ab0bfee", "comment": "Malware payload (QuasarRAT)", "value": "aa2fbcf85aee956d66b7aebfcc6a538a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855384, "uuid": "de3f4171-c001-4f37-9ad3-309411f42569", "comment": "Malware payload (QuasarRAT)", "value": "0628c0311c8a43401e57611d1dc330875aa9d5fef40b7c2df2a37c9712c1fc47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855384, "uuid": "1ab9b16e-66c6-44ec-a89c-8ec6077c30bf", "comment": "Malware payload (QuasarRAT)", "value": "1258b2d7a795a6a4b692e3be0ec8ac224c79515a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855384, "uuid": "dbbc4f52-73b8-42de-ac0a-b52dfda22796", "comment": "Malware payload (QuasarRAT)", "value": "38e85e5fac88e120a84c604dda929fb32c181ae83f6b20a7a7d9a84b560fcd40c4b55e53b879f9ddfa2f4de223ee57be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855384, "uuid": "9d39d4fc-524e-4b7f-8a53-893b992f300f", "value": "T12CE55B1437F85E33E1ABE673D5B0442263F1F86AB363EB0B6191677E1C53B5088426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855384, "uuid": "aa16245f-fd8c-4026-bbf0-043fa03a4718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855384, "uuid": "9740402f-56a7-42e5-bd3e-c844a1fb31a7", "value": "98304:SvY22SsaNYfdPBldt6+dBcjHV/2Am624iD:Ut7j1/2o24iD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855384, "uuid": "14e322bb-4043-4ac5-9d60-260fa9c15476", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855384, "uuid": "6018dce5-e8ab-4e4f-9a0a-00dd793a0c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855384, "uuid": "71b7b49f-4aa4-4130-b14d-c390bbf4f0eb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a7a91d-c7f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763849809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849809, "uuid": "fad0f869-8467-4ccc-a713-ae746516c034", "comment": "Malware payload (Mirai)", "value": "b7a2a65aaf1da7a94580c8f71837fbab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849809, "uuid": "d7c73b61-22ba-4694-a398-f8f2e0b85b94", "comment": "Malware payload (Mirai)", "value": "064b944fb5126462d5c3e544dedb304a1b4e711acf92f601392f8eefff950d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849809, "uuid": "f803c7bd-6e7a-482e-a582-33210d7d5e73", "comment": "Malware payload (Mirai)", "value": "1e6e76530b55eba4f6cc14fb0aaeb466734472b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849809, "uuid": "38a968de-2b91-4ca2-bda0-b16b7bed74af", "comment": "Malware payload (Mirai)", "value": "10a149664e72cd74da4a9b413562639fc41e4ebbb0af8b3e6178ebfad0d2cbe2715a6ee745e1faac39dc84c850692af4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849809, "uuid": "467c7c2d-b0c9-40fc-a874-4ca99d85a83b", "value": "T193A3199AF9819B15D9D922BAFE1E018D33531BB8E3EE72029D105F2477CA91F0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849809, "uuid": "ac586169-3d0a-449f-a724-68e89a983b93", "value": "3072:o/qJPP4NvXeZzpOd/qSutFCyLalzrUSMPPNOwcteTtugI:4qJPQNvXQpOd/qntFLalzrUSMPVOEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763849809, "uuid": "b07e9181-5f2d-4639-b617-4b5f084812d5", "value": 102760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763849809, "uuid": "c9700542-3932-4d3d-ac31-372dbbe5e928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849809, "uuid": "fd14db65-02be-465d-b193-ad06b636e2ba", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8ff0c9-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855385, "uuid": "10d5fe03-5592-447e-87e2-467a5b0a4d02", "comment": "Malware payload (QuasarRAT)", "value": "2e59c1ddf0433d82905e62a71b24592d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855385, "uuid": "8eaa0a35-6196-405d-9274-7bb28728e43d", "comment": "Malware payload (QuasarRAT)", "value": "067aae9c03a89a6415197732387227ef0abc5af9f510f0a28bbf1e2300e0955a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855385, "uuid": "a9eb3c58-58f5-42a7-b7f6-297709c014a3", "comment": "Malware payload (QuasarRAT)", "value": "a0f97a049aa5376fa0b683de52bf03f3f106dc17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855385, "uuid": "f360ca48-ea3d-41de-ad87-5a0298ea41a7", "comment": "Malware payload (QuasarRAT)", "value": "03fa3f9bb889226f91845e28461d539b9df9e228cf74e18e4ad9e4c03a8289749375c16b717a85b61b4c13522a47b36e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855385, "uuid": "17cf2242-dbc3-4c28-b00b-f14fff0a4a69", "value": "T1D1E55A1437F85F23E1BBE27396B0041267F0EC1AB3A3F74B658167791C93B505942AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855385, "uuid": "d50e827e-cbeb-4a6b-94a1-57ca5ca1cdcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855385, "uuid": "e5994929-717d-45b9-b3d3-f0fb0c631b78", "value": "49152:GvvI22SsaNYfdPBldt698dBcjHgtbR35oGd+RTHHB72eh2NT:Gvg22SsaNYfdPBldt6+dBcjHg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855385, "uuid": "624d669f-8d75-4f1e-bb8d-ba8916c6757b", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855385, "uuid": "e2dbe679-0a99-4fd1-a789-aa5dcd6ec357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855385, "uuid": "df73c572-a564-44f9-8c78-52f7f8004b1d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7bef42-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855387, "uuid": "0d8d6513-9495-4f2c-b51a-cd51921f40dc", "comment": "Malware payload (QuasarRAT)", "value": "051e3a9fd6c855b366e3d2c2bdc5fc4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855387, "uuid": "58bae787-8c32-4c45-a6a8-359a54a16cd5", "comment": "Malware payload (QuasarRAT)", "value": "068481d2d49f0b459b4a69a68f5836c116605ad0a00458fb2c1f7e5e5ae051fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855387, "uuid": "73107eab-94d3-4daf-bdf3-e1f2665c98df", "comment": "Malware payload (QuasarRAT)", "value": "8254f887eaa4548b15cf6dd3ad1e43f1933a4e7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855387, "uuid": "061115e7-7b37-4c0d-9adc-57e5382d6749", "comment": "Malware payload (QuasarRAT)", "value": "290efef80b48506fc8533ded8dd8f1fdc2cd028fc94056c8488cedbf542f94d98dc3516bfdd7bd764fac4b4aba4a6c7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855387, "uuid": "d87f0408-9b8f-4727-ae08-039f515598ef", "value": "T157E55B143BF85F23E1BBE273D5B0041667F0E82AB3A3EB1B5191677E1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855387, "uuid": "506e34cd-ac6f-4625-9521-5eec6bd3ad28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855387, "uuid": "25e0f0ea-5df4-4f8d-a164-165b78aa38e4", "value": "49152:uvlt62XlaSFNWPjljiFa2RoUYIuzOEEfsgk/HYYoGdFKwTHHB72eh2NT:uvX62XlaSFNWPjljiFXRoUYIuzOm3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855387, "uuid": "c0b7c7b9-0116-40a9-ae20-8bbebded38cf", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855387, "uuid": "e54a376f-8ff9-47dd-9a1a-40047ef2902b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855387, "uuid": "f82857a1-f24f-4c8c-94f5-12ca8d62f6a3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee534fa2-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855388, "uuid": "ff10f075-e401-4595-9b1a-e49bdc556400", "comment": "Malware payload", "value": "31279bed3c3ead082ef0bff667f49f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855388, "uuid": "6c906803-68c8-4c16-a217-2f85dbadb466", "comment": "Malware payload", "value": "068c0431268b3dc15bc688b5f0d46a5d0b5b1e5171d8604c8902405b7cd034ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855388, "uuid": "437535e7-931c-40b7-a123-c72e8a455934", "comment": "Malware payload", "value": "48018440dc0e41de0eb6a11dc4fe767d281a7a36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855388, "uuid": "c282c714-f31f-47d2-9de9-d2090b10ee6a", "comment": "Malware payload", "value": "65ef0994ba8e90f5b4dc9eb6de83053d5b44876d163d2e0d763a130815959180d8a7c8b01ec3f4f1b4b67211ed15cb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855388, "uuid": "3d82423a-4dee-484d-9a94-2fa983683448", "value": "T17FE56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B2581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855388, "uuid": "b95ae52a-5a11-4c13-9409-eb5102d8d0cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855388, "uuid": "56935ebb-f323-426b-a877-09b01246260b", "value": "49152:TvIAd23law6wGPAllX3SSLNUpyH5RJ64bR3LoGdE+THHB72eh2NT:TvZd23law6wGPAllX3bLNUpyH5RJ6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855388, "uuid": "cc34b9e4-d8b7-447a-9534-026376581ead", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855388, "uuid": "f05fa0c0-e551-4a8e-8fff-9c3b6f7e2a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855388, "uuid": "b16f990a-ddd8-4c3d-ae95-6693c2ab1831", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2a1da3-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855390, "uuid": "bbd1397e-e5a7-40ac-899c-69f4e3d6613a", "comment": "Malware payload", "value": "fb32e536f42a988b1480698247544268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855390, "uuid": "3b311a87-4b95-47ea-a1c5-190505416e2e", "comment": "Malware payload", "value": "068c0e38d4c8f2b780dc235e9b9fa0563bfdf3dab5ba7b343f76eccfaf218cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855390, "uuid": "08a6db19-d76b-41af-8f30-8a14b94e064d", "comment": "Malware payload", "value": "dbc7a981e5f4da114cf1ad03e951f040a71e2581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855390, "uuid": "9216e325-0169-4023-9c5e-7127d96024ec", "comment": "Malware payload", "value": "cd31f59f65d296272197fd3c662380219db405c3dc67d3985230af00e3ff0bc2f938bbcfa371239fcd0565d71ce975fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855390, "uuid": "942467b4-4dda-4a59-b093-6fce68a6488a", "value": "T1F8850250B7E88107F1FF2BB9E8B215454B72F952E93AD75F0988906C1EA7780DE503A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855390, "uuid": "523ec9ca-d9b9-4b26-8c0b-692b4e5c6c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855390, "uuid": "d06bc351-3e99-43bd-8dfb-4732712a2ab1", "value": "24576:fgrq8fHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfEez8jOlk/5/R:fgrTSGOGqnXpyWBw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855390, "uuid": "1e55c70c-a9ba-4d97-ba08-579002110dd7", "value": 1867776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855390, "uuid": "caf5266c-a734-4a38-b9f4-99938e181fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855390, "uuid": "832cd385-744a-43ad-ae11-c1cb86f87ba5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efece5df-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855391, "uuid": "9dd48f19-924f-4426-aa20-1cb8bb429c1e", "comment": "Malware payload", "value": "2647000e2208ebc9eee159295e4ae2a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855391, "uuid": "f4d9d50e-67cd-4f08-baf6-f28ff568f1a0", "comment": "Malware payload", "value": "06dd8acdaf7a16c6fa62f054ce13687f71961fe32ee60ceb469bfe401825824e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855391, "uuid": "35d1c48d-4ac5-434a-90d2-6c8cfea0e06f", "comment": "Malware payload", "value": "62a6081d890e26d53e0ecb7b0e857c6bcdebaa1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855391, "uuid": "fd28ad7a-4419-4866-b7e6-0df3dd58e93d", "comment": "Malware payload", "value": "f16a97bc151fdd7ce4c5972d0b45d33423e1281cc3c1506a0ba882464c703bc4b1ad1b952149108e675121319d684e32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855391, "uuid": "91b9772b-2577-4081-b4fa-accf6b2693ca", "value": "T1A6850150B3F98516F2BF2BBDA4B205460B37F903DA3AC79F1948909C1EA73409E517A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855391, "uuid": "38ba664d-cafb-41d6-8470-a81cc64a0385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855391, "uuid": "7af83d10-5574-4d1f-b024-93c5a573e24f", "value": "24576:sRQCuSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkkAd:sRQhTYj77wRGKKm77LrwCB6hqantP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855391, "uuid": "7333d77d-e04a-49ba-976f-d16860636948", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855391, "uuid": "876a8966-54f1-4cf6-9648-40d1ee345cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855391, "uuid": "9a27e216-09c0-448b-91cf-035e469e304a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c434e6-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855392, "uuid": "a159ea3c-6011-43c1-9c28-29a57b1c5662", "comment": "Malware payload", "value": "87d40383e3933bc4047ba8eee47ddbaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855392, "uuid": "67015056-4e84-4d4c-bc97-734e643ef78d", "comment": "Malware payload", "value": "0706a364db25fe597588adcd0dc3d9dcab01ed838f62b5bebfefaa7774d0d51a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855392, "uuid": "9e279f79-d689-4c9e-9933-87dc647e9da4", "comment": "Malware payload", "value": "106d0901fa3deab3c9f5b02bef7f2c4a17bfde8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855392, "uuid": "c64bab3e-4b17-4261-8578-e04257a0554d", "comment": "Malware payload", "value": "2f7b9b2e73fc7eb0e7b1f7228df62e679594914ed4685f4acf5ff117414c3e59277e9830af1e6cb725ea2aaedf5d524c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855392, "uuid": "3d7b312d-ce92-4b61-b9e6-c1ea2cfbf426", "value": "T1C2A45B1027E48F5AF2AE0B3FE07275048AB1FC66B766F78F5A55A0E818733415D41BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855392, "uuid": "dd93def7-a98d-422b-83cf-ea1568a5b437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855392, "uuid": "71493196-dcc6-4b88-80cb-a30d1b0f2671", "value": "6144:nufMwcjzGKYUVPgu3M5bOEDobJ7mTYNoQbG2mP1+1B6RrMflmjgYGy3V8/GV0jin:YUGFUVj3MvsAYa01B66flmjgtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855392, "uuid": "5978de87-1e80-4393-b30c-5a85bc19979d", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855392, "uuid": "e69ba90b-e800-4b9e-9c24-603d5b00e90d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855392, "uuid": "1f37ce9b-21da-4415-9032-dac6f50cddf6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f191951d-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855394, "uuid": "e13fd1c2-79fd-4ef8-b580-e778897ebefa", "comment": "Malware payload", "value": "0663f49fa29e5508fe82367d64ee7ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855394, "uuid": "c2914fa1-de0c-4c06-9916-c6fde15c6259", "comment": "Malware payload", "value": "0713f15ca3e73f400be933d902a6dd68ff3fc128b41dd697a3f852b00904bacb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855394, "uuid": "e2f7c645-a748-425e-9919-73c05b72a5b0", "comment": "Malware payload", "value": "c1900b479b60f45d3b81260b2c6d2a5d52bc5f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855394, "uuid": "1c2343bc-e49f-46b5-a72e-d27dbd7ddbdd", "comment": "Malware payload", "value": "be675ce3f4524cc9096f469691f096c157da711f82a68eeb003d6eb372c2f36dd0871a5701bd577722c87830e85e8ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855394, "uuid": "b29cad5e-7819-4dc7-9b7a-e0e714a12966", "value": "T1C7850110B7E88606E1BF2BB9E4B216454B73F656D93BD74F0948909C1EA7780DE903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855394, "uuid": "1b3a04a9-51f0-472b-9025-b735ebd29d97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855394, "uuid": "4a08a93f-5da9-46b0-b167-8cb87cf8c3cb", "value": "24576:fg0i1fHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfEez8bci1/h:fg0KSGOGqnXpyWPi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855394, "uuid": "646a9a6d-f3f6-41bc-9c17-076707b2ec62", "value": 1869312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855394, "uuid": "d9693246-78fe-4337-8619-1e1f6f3230f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855394, "uuid": "4b9cdf6f-a909-4238-93f1-c67810a54538", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25c6b92-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855395, "uuid": "ca927227-2dd0-403b-b62e-d36c16798b10", "comment": "Malware payload", "value": "7701f851e7817e7aeda32cd4a3e564e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855395, "uuid": "392e54dc-466b-4a15-a185-101d36970827", "comment": "Malware payload", "value": "0731fb0de69764c711d67e29f31ac131780fa8264b3d5fe86a5fb117780188f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855395, "uuid": "820ab262-ab7f-47e5-9f6b-ee9d5f058af9", "comment": "Malware payload", "value": "25497463bfd7cf9b1e91e8a20b7252f4d6db48cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855395, "uuid": "141ec8b4-0c07-4809-b1a7-e7d6264fbdbe", "comment": "Malware payload", "value": "d191f682dcbff706cdd4160f805994bdae27e1914739b88ae6bb1dc041d6986cee1f7ab68184d555f537fd710a5f73a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855395, "uuid": "d42d6ebf-5e71-4602-933c-86ae233c0b88", "value": "T104B47C9027E8852BE2AF577AECB158109BF5F417B267EB8F4544A0EC2C66706CE40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855395, "uuid": "1ae890df-b380-4283-8ee5-b69a2a2e5a6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855395, "uuid": "95298156-d57b-4f21-872c-425a70d7287d", "value": "6144:QTEgdc0YDXAGbgiIN2RSBZMm8KlYaK8WcPdDTjs2rpYoz1fcE3nCb8F9OR2K2scN:QTEgdfYTbglMpKSc5TrYKnlK2KtcdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855395, "uuid": "ca6df18e-6a8b-47a3-b8ef-dba76155c196", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855395, "uuid": "b246e56a-180a-41ab-bcfa-73b0499ded03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855395, "uuid": "9614c015-c5f0-48e5-b508-78a4b74967db", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac92e3b5-c78b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763806315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763806315, "uuid": "ef9f2c74-b031-4999-8345-04195dd28c24", "comment": "Malware payload (Mirai)", "value": "26af64ac20d8d155481028f40362e9d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763806315, "uuid": "b6ee8ac4-474f-4791-b5ca-0b62108aeebe", "comment": "Malware payload (Mirai)", "value": "073e56e39efe1c9c403d8a1a38465e708ea5b4d759ee0988e75b2ccefa2f396f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763806315, "uuid": "a341c600-ffdc-417a-adb3-78dff36bfe8c", "comment": "Malware payload (Mirai)", "value": "4d409f6e05f6cd1e65c266b27b421651d4d91dc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763806315, "uuid": "b0e2119f-db26-4fc2-b726-90d927f5d5d4", "comment": "Malware payload (Mirai)", "value": "6d3cda2cee9395238fa73ff1c397f79164fe494864082351ce8504d0907d82e868554fab6c9403e382bd5dc244b8054d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763806315, "uuid": "fff93167-b723-4f1c-b6b9-bfc8a34c7441", "value": "T18E836CC1E743E8F5FD6602796137B73A4672F53A0225CF06CB64B9369C22A01A31776D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763806315, "uuid": "029598a2-6528-4134-bd61-0cf3e534a8c0", "value": "1536:i1HJLpKmNfDAuYypO1NYxH7jk60W67Uf1Hh/TpmEig:4LzNfDAlyA1NaM6b6shhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763806315, "uuid": "f72c3854-6247-4085-b06c-0aba4d51b6ce", "value": 82932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763806315, "uuid": "ae0dd41d-90fc-48cd-85b1-f5634835e00c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763806315, "uuid": "aea3db2d-a8dc-44b0-91c2-21053fe907fd", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32960d2-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855396, "uuid": "345f7bf8-907d-472f-9b1a-af31444fc200", "comment": "Malware payload", "value": "73a293f4c661061f1abddda799c0051d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855396, "uuid": "6a5afb33-07bb-4ff2-9f97-d8a0bce32928", "comment": "Malware payload", "value": "07405e3578bb14f246542f5f16f43bdcda32104ff03f610b556b53c05449aaeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855396, "uuid": "9d953952-856a-40a2-b9a3-d8a208eeef92", "comment": "Malware payload", "value": "a858c94a83a1f3edcedf099883ca0091ff5a19e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855396, "uuid": "42b8754d-09a5-415e-9fd4-ef08d5383e12", "comment": "Malware payload", "value": "306ea663b33f53f1d4f32c6b9a0c20702472b1d8e1c69d21dc657963f29323aaa9b87b0753c0330f630b14e9f078b046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855396, "uuid": "4de3a294-9e23-4372-989e-5c4249fa500b", "value": "T17AE56B0437F85E73E56BD2B3D5B05422A3F0E82AF363EB1B518167BE1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855396, "uuid": "8b088757-bb1b-4ff1-8263-0ecbb20cb5ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855396, "uuid": "368f3a84-136a-4867-bf6d-77f8cdd23d7f", "value": "49152:0vFuf2NUaNmwzPWlvdaKM7ZxTw5pBxEWoGd0NTHHB72eh2NT:0vQf2NUaNmwzPWlvdaB7ZxTwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855396, "uuid": "30416f98-4b52-4e7d-bcb2-88ee7440b240", "value": 3285504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855396, "uuid": "2e5e9974-a699-425e-badb-91299f8ebf43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855396, "uuid": "ef4e294a-ce3b-430c-95f0-2d20a7d4bfdc", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f86ec1-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855398, "uuid": "d055829e-9b8b-4ecb-b28f-0ac1d280039a", "comment": "Malware payload", "value": "63efa2927a1cb82ca47fbe0ad50efa01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855398, "uuid": "96bccde2-aa11-4830-a66a-acb92a40259b", "comment": "Malware payload", "value": "0762a72835bf188259703fc860af9bd6b530da8e588ab31ef4a5ee555ae59ea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855398, "uuid": "6881acb9-97ca-413d-b402-600ae4531fd5", "comment": "Malware payload", "value": "1a4ebdb8063b34a9d7a846fa6145d3c58de90d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855398, "uuid": "ea83c101-284f-4786-8fe0-1e15f74b2ca2", "comment": "Malware payload", "value": "9a38c678dc11f15acd6c1c247e073f896ce68f42cdcb634ef76700f044907a2b8714582986559f64faeb2658dfb4c6e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855398, "uuid": "3a97cad4-55a1-45f0-a9cc-2a94cde2fefd", "value": "T1F6E56B143BF85F27E1BBE67795B0041267F0FC1AB363EB0B2581A77A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855398, "uuid": "d0587f1e-4f56-434b-8218-034985919928", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855398, "uuid": "6ad5bda9-0e3a-4b00-8f11-c1a70f3a0c52", "value": "98304:iIUdImPtmUO8P27flmCt1+eVRnADYEChR167N:/kPtORnAi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855398, "uuid": "64867934-a5cd-4239-b1f2-b51637ade135", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855398, "uuid": "31fa31fb-e8b2-4a7c-b23f-aed3f8ebc58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855398, "uuid": "2e95e331-38db-402c-88ef-5ec49def1b01", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e354e5-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855399, "uuid": "25494df2-384c-4207-8ab8-47dbb97ea7ff", "comment": "Malware payload", "value": "b722c48166f302b8c21b83da6014ac3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855399, "uuid": "a3a63633-5a93-4854-af2a-494587711c28", "comment": "Malware payload", "value": "0796303fbfd8930ebde66e7dfd8ab79c3d648d6eb6ed7462719f433eb3af4642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855399, "uuid": "17961b8b-2b2f-4546-8f85-4c63ee0f946d", "comment": "Malware payload", "value": "94010ea80544f0f108a960cf218eb9be7ea62f19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855399, "uuid": "670a6ceb-efbc-41d3-b864-b2ae2cf328e1", "comment": "Malware payload", "value": "46ec73037c90e22c793864268e58ccf196fabe8d4e1c2de10ea0ac36c579e6901953c834a57658c0662a22535a0af949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855399, "uuid": "6d7b6c3d-f0cb-44ae-9fbf-7583144285ef", "value": "T122E56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B6581677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855399, "uuid": "9fa1db33-4f4d-4db1-941b-3403c68c0aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855399, "uuid": "b5eabcef-e6be-495d-bad2-59603e16fc4b", "value": "49152:HvxAd23law6wGPAllX3SSLNUpynXRJ6pbR3LoGd/fTHHB72eh2NT:Hv2d23law6wGPAllX3bLNUpynXRJ6rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855399, "uuid": "dc5b8f30-0e6f-4b46-83f2-c143dc06c04c", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855399, "uuid": "d5ce6334-5d9d-446f-aaee-b35f7627ee2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855399, "uuid": "9da9b442-362d-4689-8213-ee67ede5d389", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c3accc-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855401, "uuid": "3f886432-41fc-4d25-b989-b0e292a34d2b", "comment": "Malware payload", "value": "a46b1f88200367752f8052325ee206bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855401, "uuid": "7d708a71-7c6d-42a4-98ea-686c33166f76", "comment": "Malware payload", "value": "0798bff53d521ee79b5ebfb08f5cc612c3636f08b6f3f9afefa927f68f22924a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855401, "uuid": "58f2dff3-d2a9-4afa-8551-5f0b0fd37969", "comment": "Malware payload", "value": "bb7d9a48fd8aac07365226fd9a239efe6b9ea69d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855401, "uuid": "5b610ba5-aa0a-4bbd-a687-ee0c906d403d", "comment": "Malware payload", "value": "1efa06071c996296ff059932cc3176071c8f5b5999ca029eb22c46eeef032c3973806bc99c4ca9c0d596c0266cb25bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855401, "uuid": "f3706f55-a07b-4723-a051-62f0b2eeb595", "value": "T196848D196BE8C62ED7FE177BF531C5248772D49EB51EE38B56AD41B82C223428D802D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855401, "uuid": "574476dc-a53a-443f-afdc-30ed52bb1231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855401, "uuid": "4eb2db5a-8511-4fbc-819e-d30e35a27b67", "value": "6144:FK2J10qdSlEc39HGx5yVmnKKJfotFCuHi/b25s/Wz0J:FKF6y0KKlotF3iKO/Wz0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855401, "uuid": "c9e2aff0-3353-497d-8862-81d2f9510673", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855401, "uuid": "373153ff-212d-4f4f-a7be-e35ea178115b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855401, "uuid": "f5bad528-2ee9-41b5-b65f-ea754bd6de6b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69cac77-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855402, "uuid": "1da63bed-8c0c-4b09-9809-b4801fcf28ce", "comment": "Malware payload", "value": "afd853405f3900508f4d10afafb89b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855402, "uuid": "8bc69548-6d4b-4018-838b-901a2f19711a", "comment": "Malware payload", "value": "07e3f93ba31c8b0546290231ac5cd69392f731ce8bf628d13b74536eb76e2ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855402, "uuid": "002ba40e-b82b-4142-98ce-ef33412f9c5a", "comment": "Malware payload", "value": "7be90ab96d6228413acaadd4d632bf9bc57e6b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855402, "uuid": "b4c1d56f-e3a2-412e-85a1-af905435ff7c", "comment": "Malware payload", "value": "605b2e5e33b62f545c4f5bc050e1892f79edac8e6b787ddbcf749f16e7e83ef4f535423174930aea8d766175aa12d706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855402, "uuid": "caac83cb-e6b6-4580-bba4-c2d975413776", "value": "T153F5071437E85E22E1ABF27295B004126FB1EC1AA37FB74A51B1776918F3B50DC03A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855402, "uuid": "7be52bdc-630d-4bcf-9838-3c5425188ced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855402, "uuid": "0187bc3f-7270-46bf-8549-713b4da75c76", "value": "49152:mv4I22SsaNYfdPBldt698dBcjHiCc1JVLoGdl/bTHHB72eh2NT:mvl22SsaNYfdPBldt6+dBcjHiCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855402, "uuid": "a0c20bfa-9544-4182-b35b-9d65bacc1d47", "value": 3418112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855402, "uuid": "1d601e44-aa76-413d-b1d6-7beaa0c68e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855402, "uuid": "9ba0317a-5de5-4664-9ed2-e195138aa7d2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78495c6-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855404, "uuid": "98cec60e-710c-470e-91dc-557cdb93c18c", "comment": "Malware payload (QuasarRAT)", "value": "48da5613dbe9c162dc70db0be8355376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855404, "uuid": "63d0a9ff-869d-4730-adc6-6fdf76a8bb46", "comment": "Malware payload (QuasarRAT)", "value": "07e50f1e738d13f1f1e5c00ecf89bd5ce2e3bcaa0cd76802c5252765d4b97bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855404, "uuid": "f4d92516-ad3e-4df9-bb3f-7e6b5c0bd014", "comment": "Malware payload (QuasarRAT)", "value": "739faf48020fa8700ef7ee30f572fcdbb4a16942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855404, "uuid": "ca8d56b6-6327-465c-ac6e-4a63f7365c23", "comment": "Malware payload (QuasarRAT)", "value": "2017006ea0bc37c0d03d1068abcbbe081611895e61b10806d6e793fe5fdc124fe7fc6dc6b0803363f24a73682356abb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855404, "uuid": "09daaf2b-5f2d-4c10-8669-a13726054545", "value": "T114B4010179E1D471D4B3143698F1EA799B3EF9240B159EEF63882B7D4E203D08A359EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855404, "uuid": "cd0a20b2-ed73-4950-a066-d295d62596cb", "value": "2b94e23e7baa034d7decb21d46cbf770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855404, "uuid": "8e297974-2730-4d84-b222-4d07ed1200d0", "value": "6144:j1NYcygEBwZYI0V84nyDxoEX3ZM7wzdCbJH6+QsaMqCsxRtdq5MsyvxMwj/NEikw:j00EoYI6/nyDhChtHKPxR+5M5M4Sio2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855404, "uuid": "748948e1-e098-450d-bf82-da9d4d8b415b", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855404, "uuid": "77c0c9a5-9cfd-427c-8e4b-fb0de448a124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855404, "uuid": "5fd75e1c-768d-4a9e-b3f6-9cb91ec2ed9c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b131e9-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855406, "uuid": "c7d3d35c-b844-4daf-ac87-54d6850828f4", "comment": "Malware payload", "value": "aade3223dd79bbef53838e57f20928ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855406, "uuid": "2cdb1f8a-4858-4c39-81f4-a554ed82d55a", "comment": "Malware payload", "value": "07e64b18429687c974fe83552995851a0a327e0d8da5d32c1f22ba89cc3d93b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855406, "uuid": "3a909a8f-7377-46c3-a912-8fb4130d8a20", "comment": "Malware payload", "value": "c6fd091f5a45779d64850c01857411190d9c6946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855406, "uuid": "60ee446d-e0b0-4512-8fb8-56285944f451", "comment": "Malware payload", "value": "574bc4cf980eeecdb5308aec3f6d36809dc99e0f51054eb0e3f6b95d0f5acfd4e5e04af13ce3a77ffe6913fbb0cc797a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855406, "uuid": "88ac1c1f-63e7-460b-9f2a-e3cf22c7fb80", "value": "T146E55B1437F86E33E16AD6B3D5B0501267F0F82AF3A3EB1BA181677E1C53B4458426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855406, "uuid": "dc40ff7f-7640-4e48-b4e9-8e46478fc693", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855406, "uuid": "ab8f0775-fe9a-4138-b746-21d6a7bb99f7", "value": "49152:nvHI22SsaNYfdPBldt698dBcjHqthahoGT5nTHHB72eh2NT:nvo22SsaNYfdPBldt6+dBcjHqthA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855406, "uuid": "d52a68c8-d989-4ff2-b325-fb4ea698580c", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855406, "uuid": "7a18780f-f7be-4cd7-9535-a730880c51b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855406, "uuid": "ed5c94d1-cbe2-406d-8f54-f624f5887082", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ce3126-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855408, "uuid": "c5eb2e35-d77a-4abc-96ff-815b12965d1e", "comment": "Malware payload", "value": "0995245ea397156d2d9bf7fe0fcc1da3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855408, "uuid": "8a7b1a67-b685-4cf6-8059-626ed3d25b74", "comment": "Malware payload", "value": "080b03b2d1eab48be07d4c36a1b4cdd4e13da653627db3fc7bd87a8e77b853a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855408, "uuid": "8eb95dde-d997-45fc-b8bb-4d16155d3891", "comment": "Malware payload", "value": "fe19caf907383c0deeacf4e236ef47139ae70330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855408, "uuid": "1deaefe7-03d4-4a3b-b3ad-971bb433cefd", "comment": "Malware payload", "value": "b34e7d2f65e4148c420b81efcc70fa5d18b722a6039a4a0b3e3f80175374041a29fc29ee0f01587dae944b6137e50761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855408, "uuid": "8c633565-1656-493c-b191-e8eac48853da", "value": "T15CE55A143BF85E32E16BD6B3D5B0501267F0F82AF363EB0B6181777A1D53B4069426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855408, "uuid": "a60d6892-3f99-48f9-b55a-ba6412598f43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855408, "uuid": "e808ef95-5920-48e8-81a3-7ec921e74f60", "value": "49152:qvUt62XlaSFNWPjljiFa2RoUYIq2RUooGdvxEBTHHB72eh2NT:qvI62XlaSFNWPjljiFXRoUYIq2Rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855408, "uuid": "bf729ee0-cd51-4c29-89ca-0a463a2879df", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855408, "uuid": "509c8b55-30cb-4baa-ab24-615ecfec495a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855408, "uuid": "e7429f56-06c6-4186-89f1-0a259aa815ed", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa50579-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855409, "uuid": "e1aafe39-6fa1-48dd-a30b-b8d9653fc84f", "comment": "Malware payload", "value": "f40e3f7a7b4678af5de39dc053e8252c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855409, "uuid": "2f29c365-daf4-47a1-a752-32a3c397fa4e", "comment": "Malware payload", "value": "08635996ea2649972bb2fdf85205b5709e2fb674f48ae6a7c6ec94ad1814103d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855409, "uuid": "a7c2aab4-7a35-4107-960d-a73ec5bd245d", "comment": "Malware payload", "value": "c9f44ff24c10d615e3f347834adaffcf72c0ddfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855409, "uuid": "9fa53f96-67c6-4a36-9353-2de7b1af6555", "comment": "Malware payload", "value": "494b07c85fc6199eb0754e8ee8871add584709f9f6b8da944c7c275362acdd14282439fec001db28b7eeb7f4cda3f103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855409, "uuid": "bfae0124-12ee-4faa-acfc-f1c188dab84f", "value": "T14DE56C0437F85E33E16BD6B3D9B0501263F1F86AF363EB0B6191667E2C53B9058426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855409, "uuid": "03767ab5-72ed-4892-827f-bb6c22d68a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855409, "uuid": "5ca376d9-412d-4f6f-bdec-4b15b6590631", "value": "49152:WvvI22SsaNYfdPBldt698dBcjH74GacoGdWTHHB72eh2NT:Wvg22SsaNYfdPBldt6+dBcjH74GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855409, "uuid": "a1e8e904-95ee-4a34-969a-857b9d47a948", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855409, "uuid": "150a6778-e019-435d-8efe-356fbdb68dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855409, "uuid": "9489e5ea-b9d3-4c16-863f-4179f060e353", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb94b77f-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855410, "uuid": "da900c35-9fb3-4145-8e32-2b4b9bee7663", "comment": "Malware payload (QuasarRAT)", "value": "ff2dca36ddac88d210fb7a037ac10dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855410, "uuid": "8a76e44d-3ffb-4d6c-a30b-1c45fa6619d8", "comment": "Malware payload (QuasarRAT)", "value": "088610faf729f2dc9ad76194f71eaa6a8d03339a5c2800ea84d37c34a9064cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855410, "uuid": "90b756ab-86ce-4d3b-8699-8f9736d791de", "comment": "Malware payload (QuasarRAT)", "value": "b5c0fbe68710b9cd83e19cdc393e9f8570d3681a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855410, "uuid": "12065e5f-0bb1-4910-8a16-a59c00759472", "comment": "Malware payload (QuasarRAT)", "value": "12996bae76776998a0651b6a5b7b379ff4bf6714d644166969acdbced51dada060ccd70f8c21f3e120ba808f44ad6ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855410, "uuid": "49c39252-33bc-4555-ae9e-8ac8191e2d21", "value": "T1B126332F57BBC5FBC1275E7317BB69C1A02D90B8320B839E58F966136C46DB3424A12D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855410, "uuid": "f094827c-348e-4697-b446-c44cf72f2fbb", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855410, "uuid": "ab1262de-0d0b-459a-9eb4-b7be3b07a29b", "value": "98304:qd97NzAifnnPbf0A072254NQUg1pPtnfCSLdRn:qd913byX49g1pPdK2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855410, "uuid": "813128c2-ac67-48b9-b50c-ea60b21db543", "value": 4476928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855410, "uuid": "b9525aad-6b20-4381-a52a-fc592af4b954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855410, "uuid": "b449085d-cb57-412f-83ed-eb770857761c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec85001-c769-11f0-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1763791636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791636, "uuid": "0f852f15-38c0-4e1e-8a56-49e71f6d877c", "comment": "Malware payload (Hajime)", "value": "c5589ff4b41a5904417563341c4c9baa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791636, "uuid": "0c75fcca-d580-4b83-944f-02f5a8b7a501", "comment": "Malware payload (Hajime)", "value": "08c494f2ab7534c7ac79fd4ee6fa77eab4ea18de787895b49eb1cad91664d260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791636, "uuid": "ff2712ee-c460-40c5-9f98-a7417d9cda5e", "comment": "Malware payload (Hajime)", "value": "cb30a4e7db71c48c94a5df97900aa7ebd2141dc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791636, "uuid": "a3608c81-f5ca-4f4a-859a-8c04ca563863", "comment": "Malware payload (Hajime)", "value": "7a2088da19e38ae67fa12632a96b77c45a855c0207802e641afd7d9ad6e522c78633f70710af787b2c0913a93e42a21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791636, "uuid": "268e3e08-eec8-4a76-a9d5-6745c31bee15", "value": "T17373121623AD296152314AF1E7FD6F8CF10E7A688FF16C247C217C68B93236E5CD8519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791636, "uuid": "378d10b5-66c3-41ff-b1cb-495b65fae0b7", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K36:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763791636, "uuid": "9f1f53a4-7808-4c28-9a68-b9148f0f748f", "value": 74456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763791636, "uuid": "75369fb2-5856-45a7-b2ae-d8fdf0956d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791636, "uuid": "8c691532-2bba-43c7-9a34-9317056f2b93", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5fda47-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855412, "uuid": "3326b43c-6c11-4b0d-b966-209a42dd3fc8", "comment": "Malware payload", "value": "9b8ad66a7bab771e98cdee5666c0b656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855412, "uuid": "0d998f8f-f130-4e86-a4f5-a1ddeb1091b9", "comment": "Malware payload", "value": "08e3c7cf6dee60ff28fee863689ccd0414bec6a1e38047b2e9e6f3e5c53c53b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855412, "uuid": "496844dd-ad8d-427c-a56b-536cf912dcd5", "comment": "Malware payload", "value": "7d488ff3a9425336b05075a173cfaf0e077dbe48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855412, "uuid": "f4549101-e053-4724-81a8-6375cba8ce14", "comment": "Malware payload", "value": "24a32fe29ec08c19cd391b913d2c6df56a90bcd8df33882051b5e0db8accefc691c9655cbbb0d329c1e0c5309d925f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855412, "uuid": "bc8a0ba4-cdf5-4b74-a58d-8f1fe5dc9d8f", "value": "T1FB848D196BE8C62ED7FE177BF531C5248772D49EB51EE38B56AD41B82C223428D802D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855412, "uuid": "bd6d4675-a189-4705-a674-cc2513d00478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855412, "uuid": "bdd144f0-4f05-43cf-8cae-e9ffd3759f3f", "value": "6144:UK2J10qdSlEc39HGx5yVmnKKJfotFCuHi/b25s/Wz0J:UKF6y0KKlotF3iKO/Wz0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855412, "uuid": "72a3906e-c58a-4a37-9d8a-3974859f4565", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855412, "uuid": "07dd6e54-e854-40e4-b9bf-a27681499daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855412, "uuid": "559c3aea-c8f1-4c40-a2b7-17612d5ba011", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd31f6b3-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855413, "uuid": "ffb7d4d9-330e-4ff3-9bdf-9f8c8247452a", "comment": "Malware payload", "value": "4d90ff4b730ede78adc6df7c98cf61a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855413, "uuid": "8d72fc59-a7ff-4cef-acc5-ab24bb43706f", "comment": "Malware payload", "value": "0900fa6bfb202abace8dc5375246844b7b5ab248653a372c8ae70ebc625437dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855413, "uuid": "a0a1334a-5b55-4f5e-8c87-957470344591", "comment": "Malware payload", "value": "54255ab03eaa42e763b4af020c0e54e6e6317cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855413, "uuid": "1a97b262-6b89-45b6-b54c-a6320c5295e1", "comment": "Malware payload", "value": "fa7258c89f5ec56948938b296a72b5f0dfcb72a1896db00f684c2b6643365964d731a0a51b20b211abfa71e3e39c6733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855413, "uuid": "e489f8d2-3514-49db-8144-05fd6eaed31f", "value": "T155E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855413, "uuid": "6d1b7b7e-8b62-4c96-85be-5d83e5b769a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855413, "uuid": "6380d517-8947-49c7-86bf-aa99b2226c19", "value": "49152:KvfI22SsaNYfdPBldt698dBcjHHjRJ6ibR3LoGdf/THHB72eh2NT:Kvw22SsaNYfdPBldt6+dBcjHHjRJ6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855413, "uuid": "988506b9-95a5-48be-a43b-fe7753b5785a", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855413, "uuid": "70e1081e-5fed-43df-91c1-c90c3fc2416e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855413, "uuid": "3939b1a6-9318-4863-b69b-3eeb06163661", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe00eb00-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855415, "uuid": "7cd29726-a9d3-4502-a5d2-fb293802a673", "comment": "Malware payload", "value": "66fe1f2e99180bc184e58771c2fc373c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855415, "uuid": "b512a0f5-e26f-4959-9557-ee0431577319", "comment": "Malware payload", "value": "0a4d1dce566530df5e87832af533eea3f63667aeb75f7ff940a3ae7611bbf01d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855415, "uuid": "985b84e2-056b-45aa-bd3c-a9c5caf2a846", "comment": "Malware payload", "value": "59dd7dec071a7d961c8279547c1d00811be091f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855415, "uuid": "208b2de0-945b-4e8e-a042-467b0f163fe4", "comment": "Malware payload", "value": "827a02308d7069ad52db0caa887d2077f29dc00e83cf8e5197d92201853712fab5649148cea36084c40cb072b26498b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855415, "uuid": "16f19675-1602-4df7-8452-c345581b2c69", "value": "T1D2E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855415, "uuid": "e09e56c9-538f-4749-8aac-6d0316fb34d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855415, "uuid": "199a9b57-c74e-432c-8076-f85f3b03b896", "value": "49152:SvyI22SsaNYfdPBldt698dBcjHg9RJ6bbR3LoGd3VTHHB72eh2NT:Svf22SsaNYfdPBldt6+dBcjHg9RJ6tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855415, "uuid": "aba3d201-afba-4f9f-9f1c-323c47559bb8", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855415, "uuid": "886974b3-4bbd-41cc-804f-bd29c99a66b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855415, "uuid": "62beae83-11c1-45d8-8aec-f8158b53d2e1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec30216-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855416, "uuid": "14307f03-4968-41cf-876d-7609b2ae4bf3", "comment": "Malware payload", "value": "f97fdacf16bf55444387179ef436f868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855416, "uuid": "2f572552-11e9-48bb-bfd3-518eb944159d", "comment": "Malware payload", "value": "0a536968c96dd437d078d01a02fa7c770036814507baa980d2ebf18c226d257d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855416, "uuid": "d159bace-7f98-4c19-b23f-74d9b0aaa8cd", "comment": "Malware payload", "value": "ca31968fbe43e13111b0551b65d45738a95ff46c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855416, "uuid": "282dc26d-c1b6-436c-9bf5-8201999dd270", "comment": "Malware payload", "value": "220019722ff64d5e4930815562044340e767919e1a2bb1ea9e4f6d912055cf321d460899aecb2fa96a5d45d8bfce13d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855416, "uuid": "b56e3a41-e304-4f2e-9a29-a73e1f9f78c3", "value": "T175748D2377A4E93BD6FE173AF432061507B0D642BA17E38B5A5C56B82D133868E417B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855416, "uuid": "ad9bf043-61fd-465b-a967-358acfae6f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855416, "uuid": "3793bdac-cd8f-40c9-bd17-c68f3a69e148", "value": "6144:SucOAH95gFbN8IRfWY2XSbt8fRUBcR/pcjPhkd6wW:RIkHq3ZUc/pOhkdNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855416, "uuid": "aec15818-9ceb-4b22-b3de-90805ae3b2aa", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855416, "uuid": "e203c141-f15b-45f0-a3cf-d054eba9ee7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855416, "uuid": "f6c227a1-6f9b-4709-b1ee-db9421abffc5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21778582-c7ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763820685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820685, "uuid": "1ffdf548-c25f-4f0c-8b22-9d343597744a", "comment": "Malware payload (Vidar)", "value": "168a36d931b21cff7f959f40f166efb7", "object_relation": "md5", "Tag": [ { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820685, "uuid": "3cc8ef76-b5c4-42ac-8a96-a46a019562f2", "comment": "Malware payload (Vidar)", "value": "0a71e42be2321894bd77b44a816ce8213833b2cb0e39a9d651ffe7d5a301919e", "object_relation": "sha256", "Tag": [ { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820685, "uuid": "32624187-e5a2-4cde-9fd9-580ff7824e7e", "comment": "Malware payload (Vidar)", "value": "415b7dd5e306beedae8ea7a35859811ebca69051", "object_relation": "sha1", "Tag": [ { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820685, "uuid": "7117cfe1-3534-4c6e-8944-b5e94fae5afe", "comment": "Malware payload (Vidar)", "value": "00e20dad4bdd400ab6f1137557c87c981c4401efd8ffaa982ee10b8f8918df6f8f7c7de97a8840c55871b4701df03f8d", "object_relation": "sha3-384", "Tag": [ { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820685, "uuid": "fc790158-7a1b-4cb5-9586-32f9c8c6e512", "value": "T153D73359BB8D3A12DB86DE74F04B835EA565C54FEB43B81F256835003CA66FB070AF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820685, "uuid": "ca948403-360b-4bc5-a2b6-5c1da5cbe85d", "value": "786432:1a47SjJAj2T94dsIqUiKpIVBoyR5jdhHSiQrA7XVpLfRyMJhzJc7AVF0f8wN2Vw/:1a47S1QGpxRKsFXHSqV9pZJh20z0jiKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763820685, "uuid": "6b601a49-4081-430f-84cf-795a55942fc9", "value": 60127024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763820685, "uuid": "7915e96d-ddab-47f5-ba1e-0895dd1f58cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820685, "uuid": "9f575a7e-f308-414e-afe4-de6b6d1ca92b", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff943d1f-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855417, "uuid": "dd28321a-4d70-47a2-9d1c-0fb635796b85", "comment": "Malware payload (QuasarRAT)", "value": "4f593f3334f7bfa36255fd59981ffb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855417, "uuid": "622d09bf-58fe-4013-9c53-4c7a0510cfa7", "comment": "Malware payload (QuasarRAT)", "value": "0a73817c73ceee1e2988f429b0ab4150e4f9a49d27ab1b43432d87421cf37769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855417, "uuid": "46fec9e7-9ad3-47dc-bd5a-eda721ca38e4", "comment": "Malware payload (QuasarRAT)", "value": "1161d563be90785bd725fe0b8c0e901dd3f90c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855417, "uuid": "0a5ab86f-e04a-44f4-be76-232a7f202f28", "comment": "Malware payload (QuasarRAT)", "value": "d9b71ba69d22aac902fe1f3d2441b6650749ab04149fe12df88aab91e0d0ec8bf9059b4f924208316a33a48270d4e00a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855417, "uuid": "819622a3-490a-479e-852d-19fc7645dde4", "value": "T16FE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855417, "uuid": "aafd557d-d439-4d57-87a7-47c904bdb141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855417, "uuid": "38b43a94-493d-4b36-98bd-63b3e9f9a9bf", "value": "49152:kvTlL26AaNeWgPhlmVqvMQ7XSKVcRJ65bR3LoGd9THHB72eh2NT:kvJL26AaNeWgPhlmVqkQ7XSKVcRJ67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855417, "uuid": "05daad96-0deb-4311-a423-4576fcde1b3b", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855417, "uuid": "5ba48fec-c49c-44ba-90c2-18728e92d010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855417, "uuid": "0da4c1a4-68c6-4785-9bb4-7662aa4ea050", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008e87c3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855419, "uuid": "e28ec066-3680-4645-a853-998bb1b9f21d", "comment": "Malware payload", "value": "14b1e0485aaaba652da33e8693ea022f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855419, "uuid": "4f57c2dd-eb48-4442-9537-d89b91e7b906", "comment": "Malware payload", "value": "0a7f16dea062bfcaa5456024ee32936811c5b859f8b505edabf6b1c6ceea8c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855419, "uuid": "df790305-802e-46dc-a308-f98b61378978", "comment": "Malware payload", "value": "5a4162b1c2c681822a502ef3085bf2db6d5c4078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855419, "uuid": "77c86578-9c5d-479c-9074-3612e419e214", "comment": "Malware payload", "value": "0c5903b00de798d518fcf438e830d60eddf2fffdce5895b0387c4872adc989593ac79caa13aae73416dcff223e9be42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855419, "uuid": "a827281c-8d1c-491b-8a50-6deef0c90b7d", "value": "T1E1E56B047BF85E33E06BE673D5B0501267F0F86AF3A3EB0B6181667E1C53B5158426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855419, "uuid": "6ffe786e-b75c-447d-bbc4-2d320aecabfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855419, "uuid": "85cc141a-fa5f-4b35-a9d6-5c2c47f88a5f", "value": "49152:DvTe821/aQWl8P0lSk3aKA3Z+nt3LcLoGdaTHHB72eh2NT:Dvy821/aQWl8P0lSk3DA3Z+nt3Li", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855419, "uuid": "32abe856-e046-4afc-adb2-63fe5e64b918", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855419, "uuid": "1d702aa7-ddcd-4b0c-af29-ec68551c212b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855419, "uuid": "905e1b5c-3a58-41dc-9092-707459645023", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014589fe-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855420, "uuid": "97fb3fe1-5213-4563-9a5e-3f98cda3102e", "comment": "Malware payload (QuasarRAT)", "value": "0034a320fe20dfb830431c41c68abd79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855420, "uuid": "ec1bb875-c20d-4813-a787-ccaac93cf2b3", "comment": "Malware payload (QuasarRAT)", "value": "0b18fe650e6d1aa3b3f975f7841582360a3c9e64bafa9c8e139471263ea94b0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855420, "uuid": "c07d9f04-0b29-4e2d-9d89-77f59bcb004c", "comment": "Malware payload (QuasarRAT)", "value": "75ea8e330f581ddc1c6e5bff2d17d18ec99eae1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855420, "uuid": "043dadd2-3019-4892-9fc2-da9c12ff87d5", "comment": "Malware payload (QuasarRAT)", "value": "b5307e21bf1206c1ba30c32abd16ae611ecbac46c182dd6c16455210130acd5d7f8af80fe4cfb9d2c95368d7647058b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855420, "uuid": "9dd69ba6-3eca-4e14-bc95-f7643c8ee531", "value": "T17C748D13B3E4DA3BD1FD1B3AE43206152BB0D487B616E38B5A5855F92D233868D493B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855420, "uuid": "cfb24294-3e26-423f-965a-569dc359ccbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855420, "uuid": "0a25fd54-92e8-443e-85b8-c7ea2cbf4328", "value": "6144:wyUhIvTCqL05nRuf/7JtAbLnKZLeCI+uerrOo/qoIFXO:TNTCnw777VueryoyouXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855420, "uuid": "27a7004e-3028-4ae2-8dae-6fd9f2cce481", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855420, "uuid": "0a7d3e05-8b9b-4906-b307-93e063285cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855420, "uuid": "ef1764ae-36f3-465c-855b-70881710da2f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c6de9e-c75a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763785155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785155, "uuid": "633a865f-3946-4670-830a-f7526ec36243", "comment": "Malware payload (Mirai)", "value": "9ac9e85810948efd92d8a4592fb041b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785155, "uuid": "165c4346-54f9-4abd-9d26-d46bf3570aba", "comment": "Malware payload (Mirai)", "value": "0b52352c32334927fb7f040d63055d1dabba48ec55b7fe490fd5a94fe01a527e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785155, "uuid": "2cbbf77e-22a6-4cb6-8b35-db80dba28e70", "comment": "Malware payload (Mirai)", "value": "0ca29dba39825f9a71089d03163041994575ea13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785155, "uuid": "6caf5c67-6925-4d27-aaaa-8137a3fcccfc", "comment": "Malware payload (Mirai)", "value": "65bec9c13fea84b6612f670af930470466c7fb381ef76fdb6ef55e9529597af267de9cbfba1fb7359e7116c6823ba339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785155, "uuid": "67db2d4e-ab29-4986-8c58-049c57ff6fc9", "value": "T140B3E194BA11FF4AC12213FCB5850980E7E16DB64F66550B8063BA78397CCD87E0BED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785155, "uuid": "9d6649e5-b340-4567-9533-4a06788dc4d0", "value": "3072:818GwLQvWvGsGK7xVGrh75WB0DPgZVGwud:8NwLQMfGKurB5doXGwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763785155, "uuid": "1c37ed8f-67f4-4f90-ad66-f5969bb5e2c3", "value": 107768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763785155, "uuid": "a6ed5a27-4956-4252-9aaf-909d6883dae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785155, "uuid": "3780384e-5f37-4e04-87cd-b53bc6780e1a", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e79d3f7-c7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763816814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816814, "uuid": "c7c084ec-1ddc-4410-9fc7-ddf3b46a38b5", "comment": "Malware payload (ACRStealer)", "value": "2fa904d2fd97fdf95323cc510b207933", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-0250", "colour": "#19CDDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816814, "uuid": "fd9e231f-8f54-4396-8883-b4afcade217e", "comment": "Malware payload (ACRStealer)", "value": "0b978b73041b408a88feeee0eda3f9c3f3fe0f331d52f384fd3c113f0ab10227", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-0250", "colour": "#19CDDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816814, "uuid": "7b6af499-f5c6-4cdc-8900-482c40ffd69b", "comment": "Malware payload (ACRStealer)", "value": "6b28cb03266c700878d315e5071be1639ada7fb7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-0250", "colour": "#19CDDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816814, "uuid": "ebe9517c-557c-432e-bb01-8cf7e84bfe0a", "comment": "Malware payload (ACRStealer)", "value": "5943c24858b5652a2e8a5365e3ecb478a815a1ba5ac3dc51c088679d2c6bea35c3a187c9c856651665b3698089b4b4e7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-0250", "colour": "#19CDDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816814, "uuid": "80c7128e-e7c9-409d-a2a9-5382421b3d6f", "value": "T1D1F633AF0277D84325A6C0C07DCD86290AEB79D0D8D6B8FBD008B6450A7F569EF7125E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816814, "uuid": "73b0f4f8-871c-43b1-ba1a-fc75687c5eb1", "value": "393216:6tGCtGulA2yfJL7s3TbXaLz5SR2wbhY8oRT5EdJi:vR2yBs3Xyz5SR2wKiTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763816814, "uuid": "77a79da4-364e-4bf6-af9a-07639ed6c5d8", "value": 15286932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763816814, "uuid": "ea7b5186-8986-4d8a-ada1-182e4aebcf74", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816814, "uuid": "6ea3f16d-3cc2-49f4-aa79-a62f33e560a3", "value": "\u232c \ud835\ude73\u2c9e\ud835\udd4e\ud835\ude47\ud835\ude4a\ud835\ude3c\ud835\ude3f\u232c \ud835\ude4b\ud835\ude4d\ud835\ude40\ud835\ude48\ud835\ude44\ud835\ude50\ud835\ude48 \u232c \ud835\udd4a\ud835\udd3c\ud835\udd4b\ud835\udd4c\u2119 \u232c 0250.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02229141-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855421, "uuid": "129482de-f3d2-4400-9fbb-64d890d68e7d", "comment": "Malware payload", "value": "1d6cb66b2ad55829bc8aed90c10b1747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855421, "uuid": "422da273-8863-41ea-8164-768ae34b575c", "comment": "Malware payload", "value": "0bb567cfd7b8fa607b3fd2733c80d45483e324760aeff92622a756940b9ab818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855421, "uuid": "563843b5-7f9d-4276-9ebe-de2826037634", "comment": "Malware payload", "value": "bc630a2947ab275be66b7bac53454c3b5c24ecb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855421, "uuid": "039b99b8-7982-480d-9dd8-6619bbc98ae7", "comment": "Malware payload", "value": "c34d8579ca35d6cc9059455184383cc282cc4d4d1ff4996445a4ddf14bc85466e453e85c622c855a7eb812901c596a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855421, "uuid": "4511016a-0513-4f23-884f-5885e24dc88a", "value": "T1F116AD14FFE89F2BD2A68B71A9F240213930F9DAF323D71A1145569E3E43B405D533AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855421, "uuid": "6ad813fd-1b2b-4c4d-8375-0d622ed91fcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855421, "uuid": "8911ecd1-2aba-4def-af37-f09ae3b45814", "value": "49152:wlYBsduUIuEv3DkZMHb4wwKELhtEXtHB/zw+LUo80AsbcaBYcwV2MTHHB72eh2N9:bRr5vQM2kZBbw+AsbcaTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855421, "uuid": "400dcf11-5716-4f76-b634-d9cc05571ee8", "value": 4332544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855421, "uuid": "83e78215-617a-4f0f-ac66-ade2c7bd0e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855421, "uuid": "511cc672-f5bc-44d0-b1ff-166e0210f7cf", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0319e7c3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855423, "uuid": "4f74a457-64c3-4671-a227-71b9709df365", "comment": "Malware payload", "value": "fa412806285f916135634632ac83dd17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855423, "uuid": "66563fdf-4b7a-45f1-8f82-52ea268705c0", "comment": "Malware payload", "value": "0bf4a80f359bd8f37b1b8a06fc8aa5f56f9c0891641d2ffcfd53bc24d8a5fb4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855423, "uuid": "92fb745d-a566-42da-b9f9-256b112b4da3", "comment": "Malware payload", "value": "ed1d27fb637d20312a6987303e29c5f1f03eb10a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855423, "uuid": "97e9ebb3-0b96-443b-b548-6b34d5f9d7a9", "comment": "Malware payload", "value": "aff87af70a3b010c9b82d110af7f67ae0fe6fd2246a6e0ea1e7a80046419bb8631bba6b5f50c59619d559c7747be5226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855423, "uuid": "343dfd5b-7593-4687-8246-0b05bb16729a", "value": "T1CD848D196BE8C62ED3FE177BF531C5248772D49EB51EE38B56AD41B82C223428D802D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855423, "uuid": "c16afcf8-4dce-4a12-b856-b04837376991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855423, "uuid": "667e18f6-e552-465b-8c59-e8a2fa2ef5ba", "value": "6144:KK2J10qdSlEc39HGx5yVmnKKJfotFCuHi/b25s/Wz0J:KKF6y0KKlotF3iKO/Wz0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855423, "uuid": "a52d3b17-98f2-42b9-9947-d0c8a4d3d5fb", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855423, "uuid": "bd63b464-4ed2-45fb-a4a4-2dd3511bdf35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855423, "uuid": "4fbb4a55-121f-44db-a842-41532228b264", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051207d8-c774-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763796156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763796156, "uuid": "69714677-afc2-48cc-8c25-405ec28d7767", "comment": "Malware payload (Joker)", "value": "8d70e6c5fa5f3ef2d55a6bba2bf8ea41", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763796156, "uuid": "d922b4a5-b5c1-447b-b24b-83a035d80e8e", "comment": "Malware payload (Joker)", "value": "0bf917d7abface25e1635e85c63b606091777f3f6bca53a7e10edd4d942b8631", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763796156, "uuid": "5c20bb7b-5df7-4285-ac2c-177d070ffa40", "comment": "Malware payload (Joker)", "value": "7e646955c5297cf5485bbf512deff68c0443c146", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763796156, "uuid": "cb0bb118-aa77-415e-b83e-96a3d110a5db", "comment": "Malware payload (Joker)", "value": "20cf7d2d0ff61223a2bbc79166418ac604600323c6beab9e544e06fb20d6bd3d358788039a0694f3409adc418e8be8ce", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763796156, "uuid": "606da38d-31b4-4e3e-b0d1-01d69a8bca27", "value": "T1FF87220AF70E6A2FDDD6F1788D6503523526BC98720293DF5D01B13CAAF76D48E46BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763796156, "uuid": "70f28ae3-6f56-43bd-b602-5570cb709284", "value": "786432:SWNvORI7m/BqQaYYfKwg8WZx4137fKlwm6B5jA+YJNvbl3ZgrlgrJ:SWpWI7EqQaZ08oxg7fbpAjJRbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763796156, "uuid": "a8f220d5-6e1f-4784-876a-6106761e499d", "value": 36569821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763796156, "uuid": "4be91cfe-5e44-4527-8bd9-4ad29d64e840", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763796156, "uuid": "42b7fe56-60cb-488a-b0a3-4d6195d34571", "value": "File+Easy+Clean_3.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041a8416-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855425, "uuid": "09f44bff-4629-4c30-bcaf-9d5324786a7c", "comment": "Malware payload", "value": "39411829a594cc8c0875302dded5cbae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855425, "uuid": "e4fbb9c3-68d8-426e-b408-3ed6207231da", "comment": "Malware payload", "value": "0c1617ab3bfa1d6a10101bf0dec5fc205de5dd9bc716887a63e31536f75f37c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855425, "uuid": "7ef588ac-9325-43d2-a5c4-2717bbb6d9de", "comment": "Malware payload", "value": "de4dc91bdf9a38f9a69400c3849292ec7c404be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855425, "uuid": "1617879b-2928-424e-bf95-caf3f5fcf14f", "comment": "Malware payload", "value": "c23369b1935062f161f2de9b4fbefb691dfba2fe0a839af499479313ea56a6b663ca32291e8e56521d43db59275465e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855425, "uuid": "49fd46d2-99c7-4c62-aca3-fbf8d2a6be5e", "value": "T100E56C0437F85E33E16BD6B3D9B0501263F1F86AF363E70B6191667E2C53B9058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855425, "uuid": "a468ed30-91ca-42b6-bd98-bfac76a12235", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855425, "uuid": "e0c1fc3e-7e02-4714-af90-a0fc67d602cf", "value": "49152:uv4t62XlaSFNWPjljiFa2RoUYI6JMPGoGdDTHHB72eh2NT:uvU62XlaSFNWPjljiFXRoUYI6JM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855425, "uuid": "62215745-ee22-4cf4-9ebc-f70cf9f15239", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855425, "uuid": "da175ef9-a2ff-4b6c-9b2c-3abd13e422c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855425, "uuid": "5c6fa489-3a09-4620-88bd-bca0ad183128", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fa7160-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855426, "uuid": "18dbaedc-a82d-4b0d-884d-ab824732aafa", "comment": "Malware payload", "value": "69a85e424bdf0432d37a8c69bcf307a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855426, "uuid": "c71362d3-2662-46ef-b3a9-af99bbb7a3a2", "comment": "Malware payload", "value": "0c1aeb3d162ce08f3bf05994eabe3b7d86657e98bcc0ff3f8f02ed481c063186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855426, "uuid": "6f45ed28-4066-4552-9bdf-0fe0bc658842", "comment": "Malware payload", "value": "fb605eedc11fab948768fa9fda3dd9e21882e2e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855426, "uuid": "47522df0-df20-4fb9-b3cc-d780daa498e5", "comment": "Malware payload", "value": "d1c44ee64e587bf59d952590a812cb0e811864d4d29a7c0ee07d02bd4180cdfe7250224196aebbf0ba373a361be8d01d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855426, "uuid": "533275f5-7b8e-474b-a9db-ad7e85a30c15", "value": "T1FFE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855426, "uuid": "78176f9c-1179-4636-a217-1e4dd74e9fa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855426, "uuid": "d93da080-da97-4cc5-b08b-d30a36e5157c", "value": "49152:rvKI22SsaNYfdPBldt698dBcjHe7RJ6UbR37oGdepTHHB72eh2NT:rvn22SsaNYfdPBldt6+dBcjHe7RJ6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855426, "uuid": "7ea9f739-cf1f-45d7-9c45-b1519b35052f", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855426, "uuid": "78a99527-d78b-4ea6-9784-d7db26f8c910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855426, "uuid": "ec43dbf4-e8a9-48a3-9180-45c44ce14000", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cee04b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855428, "uuid": "205a8385-e28d-4fd6-a944-b3a7349e43f2", "comment": "Malware payload", "value": "427eaea436df8f96bd7980f7ddeadc89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855428, "uuid": "3215a328-805a-40f1-8f84-194881ad318c", "comment": "Malware payload", "value": "0c50648ebb8741e7a1a340954bac61efd008dcf34b6a2c74d59b68fc336bf785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855428, "uuid": "d0c88285-ea65-4805-9d66-3de603e9d761", "comment": "Malware payload", "value": "9d796c90a1abd5d1172678860856cd318c02e309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855428, "uuid": "7226a32b-d6bb-4a54-9b5b-01354107e406", "comment": "Malware payload", "value": "9088421c4076b7344274999192289874d8e5f893b30ccd564528d70c848c1d22718d98cdf856f57558b4dee1df80a915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855428, "uuid": "77e5691f-f867-4789-a04a-3ec6e7721700", "value": "T15CE56C143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B658167B91C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855428, "uuid": "b54135d9-f2de-4769-84f1-d24a20a1cd00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855428, "uuid": "dab57a11-b685-45dd-bc1d-602b056fbde9", "value": "49152:KvaY52fyaSZOrPWluWBuGG5g5h6IRJ6QbR3LoGdbTHHB72eh2NT:Kvv52fyaSZOrPWluWBDG5g5h6IRJ6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855428, "uuid": "e4e1cab9-c4b8-461b-95f8-b468b6b4739c", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855428, "uuid": "7478c410-3e2c-4241-a8ca-92d73b03d80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855428, "uuid": "259f3f38-5a06-46ce-84f7-71b76f8695a2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b09426-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855429, "uuid": "df4cf45e-a640-4333-8d77-fb3d2e978bc7", "comment": "Malware payload", "value": "fd8451492d115a69d6193b4991557920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855429, "uuid": "5de5bfd8-2dfe-4502-9a55-82ae7c98bfb7", "comment": "Malware payload", "value": "0cad67af187d98b0112fe5985e520dce207ea1cf577a6ed029f9fcac98056529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855429, "uuid": "1bd11fb8-2906-4b5e-9b91-61353f845183", "comment": "Malware payload", "value": "01f80aba11a9a7dc18f843f247882efea842a76d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855429, "uuid": "3435e23c-d814-42f8-a0e8-48afd558a35b", "comment": "Malware payload", "value": "e1d23922cebd3273e9fef2c327349a043fdf93fd93d60bde0dbd6b7b750922dda51bf3c960fa563d986e04302f63005d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855429, "uuid": "f2e8ec99-62cc-4d8f-8f99-a720b9538420", "value": "T151E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855429, "uuid": "bdec957f-fcc9-4cca-90cd-89b033a1a43d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855429, "uuid": "e85b94c8-00be-425e-b43b-4c8ae522fab8", "value": "49152:QvPlW2p9agXI2PrlTnr4BZmFzeR+RJ6jbR3LoGdBzTHHB72eh2NT:QvNW2p9agXI2PrlTnrmZmFzeR+RJ6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855429, "uuid": "0fd83b0b-32f2-40ef-abf1-4aa152657f84", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855429, "uuid": "d0499cb8-2bf0-48c7-886d-aa13389caca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855429, "uuid": "62edef6e-c9b3-464d-b055-16075b1a079f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f674b7a7-c768-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763791407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791407, "uuid": "6e3073ac-f3f5-4ea3-9b85-eccac4215fb9", "comment": "Malware payload (Mirai)", "value": "59d5f7087f4644acea1e02b12aadd027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791407, "uuid": "126d1d93-8339-41a2-8e41-561f56fcb710", "comment": "Malware payload (Mirai)", "value": "0cb5c8c3bd63c4dff15c6c6002f0faef15170fd1d47eb6b285f7b40eefdff81b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791407, "uuid": "6845d849-0d77-43b9-9a6b-d49620c17f26", "comment": "Malware payload (Mirai)", "value": "bdd978b6d369f13b2661a5876a7077f1ad285b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791407, "uuid": "c4e28fa2-f475-4ec6-81f8-d46d2588473e", "comment": "Malware payload (Mirai)", "value": "1698e280d5f0976637ead877a27f6188b492a00bb98bf74f81bec9cbc3ae248642ab2eab6efd227ac61e194c7f4dcbc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791407, "uuid": "de9440a3-d914-4d50-8272-1ba684984e50", "value": "T126343A33FB0C2422C8929FB05D3B27F69375D5E251B6A00964186F2D6A33BB46D8776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791407, "uuid": "98b661ee-bf63-48c4-a622-4d1aea6c8091", "value": "6144:jwfPoSnQQf2wNKimhF9L4J//H0gcpo7i+fiUK7fo:UfgSlwMhi+hK7fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763791407, "uuid": "a8f407c6-2bee-48d8-9b73-d21b82c961dd", "value": 245280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763791407, "uuid": "2b75d08a-cd12-44c2-9fc3-a1ffda45a9c4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791407, "uuid": "f9cbf402-d925-4bfd-aa09-d27f0b03849d", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26eb0ac-c7f0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763849758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849758, "uuid": "6493f7d6-0294-4ff9-80e1-43846353ed93", "comment": "Malware payload", "value": "87da7ff8009ce34bfb3af09c966366d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849758, "uuid": "0bd89b9e-82b3-4f95-a443-fbdb3f4336cc", "comment": "Malware payload", "value": "0cf56f52467b3426d63eb770c1b0f2a3d3b932a3ee46c24d078895301fdf3094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849758, "uuid": "faf59548-1675-4e81-850c-28964ec662e1", "comment": "Malware payload", "value": "2090e639bb9ed9c115bdfdf31fb52d4f6f5547d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849758, "uuid": "7d869ff1-243b-4e88-88a4-779a4cc9a7f8", "comment": "Malware payload", "value": "e3c82195bd66df389104e0420a1206ed5599a8e58fb22f314ea3d0ba85cfee4a19ec5c6139d2442cd24097e19a3f147a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849758, "uuid": "682bd217-7502-4f65-9e06-baec9d33ade0", "value": "T1D504E0DEB6A00462D8E8843519F21E1417F2AF4B4D8C778D3428B3C4AF56FE71A6671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849758, "uuid": "364424ae-f283-4ca9-a2f4-5a1b7cbf2084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849758, "uuid": "a03f721b-de05-44d9-aca8-70940e5c9d39", "value": "3072:5rS24ox4oQXaOTIntt44N17DSi7wVPjnamiMF+qe2Mpkfvjub74um8Yb9C3G:ONXnTInnNZSiqPjnamiM75M6fvjXR8qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763849758, "uuid": "339fca29-002d-4883-8bdd-f2a910518f64", "value": 190312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763849758, "uuid": "e6cd1f22-e476-40b8-b62a-4f9a10b20730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849758, "uuid": "613234af-40f2-433a-b4e3-9e390710ea47", "value": "Easy2Convert.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077d2677-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855430, "uuid": "7d598a2c-ad8b-47cf-ad3a-29749a454d4b", "comment": "Malware payload", "value": "ba6382787781dda23fdca6484e5e4304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855430, "uuid": "9ba7618f-4bc2-4cf6-9b58-43509539456f", "comment": "Malware payload", "value": "0d46dcd5852693a9d4f4b922fb6c27e75686338cd88e1545c6e01bdd5d4a88f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855430, "uuid": "b16a3908-cd0c-4f17-9fe7-7432813b33b7", "comment": "Malware payload", "value": "46c9c77354c4e0163d744e1f58f4990101f3ffc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855430, "uuid": "7c5d47bc-4494-47b3-87c8-c97f83c459d4", "comment": "Malware payload", "value": "a37bdd446e282741bf6728f09f6a07fff0b1352a0debc439078995303a0a1e431979c4d7dd457534fee351f97569c92e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855430, "uuid": "f4e2dd05-5768-49b5-83fa-f6a8e02fe5fd", "value": "T194B47D4027F8952BE1AF57B9E87114209BF5F807B267EB4F4540B2FA2C66B069D80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855430, "uuid": "467f0a2e-e0b8-4fce-8fb8-5d8dbab558b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855430, "uuid": "0c6e152d-1f6c-4afd-8ecb-bc595a36104b", "value": "6144:pTEgdc0YNX7IxUpGREWve13+7LOUs6f6YMZlfdwcEysb8F92tw+gcTR3O:pTEgdfYWxUkQ61yeC3gtLgcdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855430, "uuid": "ca4e9376-ec7d-4172-835e-e472f036a37a", "value": 532492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855430, "uuid": "abb0eac9-f7bb-42dc-b6f6-5a13bf32535d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855430, "uuid": "d9ef806f-423d-4ca5-b444-7ec3c35c2452", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce945f0-c787-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763804625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763804625, "uuid": "d109cc63-ea90-4916-8330-8c29860ff3b7", "comment": "Malware payload (Mirai)", "value": "e2064e79e19182c8c2e595598127b124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763804625, "uuid": "426ef2bc-54d1-4430-b0da-e0876200b7d3", "comment": "Malware payload (Mirai)", "value": "0d598107957c7a97844b6b9504134340804801e606782023e862aee402add3b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763804625, "uuid": "c88c2a77-b690-4f5e-b425-af2e0bc7f653", "comment": "Malware payload (Mirai)", "value": "04456df622512ae2ba39d5202f2534b7614b71cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763804625, "uuid": "919241e2-ce4a-4905-9303-ae95073b5ff0", "comment": "Malware payload (Mirai)", "value": "febccd28ce46be6e692e009735fd6f26602c9510c7ff2653d4be62756b302fb76fbf78facb5a8cb2da0dcb8fa7fdb8c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763804625, "uuid": "484387e7-1377-4266-9207-cd276ddc5b26", "value": "T150936D02B31C0E43D1A36D707E3F37C5D3AAAAD011F4A689255FBA49D176E325286ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763804625, "uuid": "73b4e552-e9dc-4432-86d5-6e9e7d0789c6", "value": "1536:bQQy94J3r4WIiLAwXkIcBmSUskU2Sj2hP/yXP0EwvOT49emmdC:8udkIMAV+2hXytfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763804625, "uuid": "b281b4a7-41a5-4da0-b9da-e72ec0d6c923", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763804625, "uuid": "fdee2385-4572-4794-b345-cc2db283b5ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763804625, "uuid": "1e641339-361f-4594-8158-8fa5888d03b1", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08792dc4-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855432, "uuid": "6ef6c71b-08bb-4d38-9ea5-d2a8a9f4a57c", "comment": "Malware payload (QuasarRAT)", "value": "5087f12b8deb64fc3a63ae3813ca38d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855432, "uuid": "5faef311-570b-47f2-b65e-7c38795dc2ab", "comment": "Malware payload (QuasarRAT)", "value": "0d8314427f10eafe398d3c86aac633cf0aa4227339a2982981e888c73867e013", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855432, "uuid": "9af4568d-a8a2-4cf9-ace5-273c8991bbeb", "comment": "Malware payload (QuasarRAT)", "value": "2b4fdf38440383407d1c4a86ad9b3b5c174544a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855432, "uuid": "1dbe2c3e-d9ed-4561-8b6e-807f927ae6a1", "comment": "Malware payload (QuasarRAT)", "value": "f9b1c52fa49eae9536a257c337c2562f5302772d58132003b7920d8ed958975944a787464e8702e060fe13e8d5ca045c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855432, "uuid": "24908599-6a58-43a4-94a3-f724691f0ee8", "value": "T1AFE55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855432, "uuid": "569524ee-a030-49e4-98dc-3caa56e0982e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855432, "uuid": "4c4aa33e-99a9-43d7-bde7-5af8dcda5e82", "value": "49152:yvyI22SsaNYfdPBldt698dBcjH6HxNESE1k/inLoGdITHHB72eh2NT:yvf22SsaNYfdPBldt6+dBcjHOxsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855432, "uuid": "889d530a-65e5-4ac1-9d03-d45783af70da", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855432, "uuid": "7c0738a8-dc90-4aa1-ac18-923726c8c8d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855432, "uuid": "313c2ea2-055e-472f-9a81-e621bdab579f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09390ba7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855433, "uuid": "970c931e-1cf4-4763-b2e8-db5810a3d6e5", "comment": "Malware payload", "value": "71f7f5ef57f73a3c96213926ccc70d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855433, "uuid": "d908ad2d-7af1-476f-a7e3-b69f3821880d", "comment": "Malware payload", "value": "0d92617e4e3abf4c42e3143a9606b96cd235720ce869a2e46bf9d882420fe90f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855433, "uuid": "b0874694-a6e5-414a-b8c1-7e903d932016", "comment": "Malware payload", "value": "e565633272a657b0ec03c1d6f5e5ca0c0f13e2a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855433, "uuid": "e87f0b50-dc9f-4e54-8a18-98f370f77700", "comment": "Malware payload", "value": "cf01f2a2178286a226f6d8d6ebf344617fb24ec8fe80bc338874cf94755d7166341ce4a815dcf83588fafffc6fadee0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855433, "uuid": "76790a7f-a850-4398-a9b6-dcec256bfec9", "value": "T12EB46B8123FC851BE1AE57BDE8B10821ABF5F407A667EB4F4940A1E93C567429E407F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855433, "uuid": "6c201b54-a20f-42cd-b442-bc6baf1ec289", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855433, "uuid": "92615b97-f04b-4939-96cd-18ef2cb8f1d2", "value": "12288:VTEgdfYKbgfOzs64oywYbplLbPtu6cd2:2UwJlIywYbpJk6cd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855433, "uuid": "70cb956b-5ae3-4a95-ac99-39f506de347a", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855433, "uuid": "2f4608bc-89cb-4c87-9ea1-4a5eb06488bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855433, "uuid": "7a09cd05-91e5-4fec-a075-54f551520970", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0bc843-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855435, "uuid": "cffcfb9e-a5d4-4e85-8571-b81495423faf", "comment": "Malware payload", "value": "7b302cba1fc0e2cbb10b7f8db06a81d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855435, "uuid": "63472572-0bd0-4486-93a7-53b3ca39ecc7", "comment": "Malware payload", "value": "0e248f9caadb4e9e7737a9281eb0a8f04cad6ad25affc31ab3001c54b36266c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855435, "uuid": "e43d1325-2d7a-4bf9-9144-f99c1fde19de", "comment": "Malware payload", "value": "66be714ba7e249194d273b1f8fa096ffe30ab0a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855435, "uuid": "5a02bb20-d9a3-495e-99ed-97b53a476720", "comment": "Malware payload", "value": "9e04f1fc26dd93b2125ea240716eb32a2af290d5c29bc30c3609262d4439f2b2d5a457b5d05c663b9f41829ce76aae6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855435, "uuid": "032c2ceb-549d-4575-9184-c0df7c5b1ad0", "value": "T195E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855435, "uuid": "9124ff83-abda-4a18-b800-1107682cea11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855435, "uuid": "5a8d465e-ab3a-442c-95e4-8282328251e2", "value": "49152:6vMt62XlaSFNWPjljiFa2RoUYIhtxNESE9k/ieLoGdkTHHB72eh2NT:6vw62XlaSFNWPjljiFXRoUYI3xAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855435, "uuid": "e8251a22-2a7c-4da0-ae59-875232a4f1c5", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855435, "uuid": "4e169489-373f-4117-982c-55f3d83a8d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855435, "uuid": "40948273-c09d-457e-887e-c766c6a9dcfa", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad635e2-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855436, "uuid": "afdcb1ac-878e-40d2-98dc-f8dad59ef5f5", "comment": "Malware payload", "value": "bce5490d27cb3b231c643df23e2bf2ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855436, "uuid": "342ba341-76bc-4dad-94ae-b9f91764ee62", "comment": "Malware payload", "value": "0e3ad5041c088890e814f718f8d5d992664d971b81b0738612add3c2f2865c61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855436, "uuid": "2b9c5bd0-157b-4a37-9524-a8c4da881cfe", "comment": "Malware payload", "value": "2f456b5fb6c8d1e626b4f57e1ddc4018cc4a47d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855436, "uuid": "4a362431-3a8c-4887-ab63-dc1a2672d53d", "comment": "Malware payload", "value": "ffae34e7f93a1d0a94844771de18307ccba70c842ad8b53499bc7e03f168bcca4ecad9759397df088dbe9f7377f8d2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855436, "uuid": "17fda676-0fe2-4875-a067-90c160625e55", "value": "T1E2850150B7F58116E2FF6BB9A8B604064B37F9438A76C79E0D5C906D1EA3340DEA1363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855436, "uuid": "bd1360a3-e8bc-4283-a3fc-01b40045c1d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855436, "uuid": "6ec62fae-5610-4491-af39-3a2c892c7784", "value": "24576:qXcrQOSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkkT:qXcrQsTYj77wRGKKm77LrwCB6hqany", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855436, "uuid": "e0c328de-b9b2-4b55-ad45-20aea631de49", "value": 1833984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855436, "uuid": "ac07ed13-edde-4917-abe3-01eb6bf56216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855436, "uuid": "783e9dc5-70f3-40db-af51-ae30017cd286", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8c60eb-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853109, "uuid": "375e4b53-c522-4d34-9ef6-0505e179a7ad", "comment": "Malware payload", "value": "8af38c01f2ad49f7927f80940755bb4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853109, "uuid": "2418c71e-2c0e-477b-b8a5-37630f177f6e", "comment": "Malware payload", "value": "0edd3de73a63f65b68cff15ae32ea224c023d1339de9fb95046b0fbf17c8d1a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853109, "uuid": "610f1571-5e90-4ec6-b5c9-cb52f078ad86", "comment": "Malware payload", "value": "95839cbecd47f3975eb654bda6ff4ac1d16a3a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853109, "uuid": "bb740614-d0c8-44bc-8511-bfad40216be2", "comment": "Malware payload", "value": "e6b7189f10f11babb882f80181c84f11db7a0844e9ac550de1b6024167c408bf363ca506fd14afcf82f687c1d77dc586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853109, "uuid": "fe43b955-4061-472a-8cff-70c499c84f1f", "value": "T197F26C17BB1C5633CC168E7BF5F31B116B30F30268D2E79B75445246AE827C01F6A2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853109, "uuid": "c4e59ed6-a322-4a06-87ee-03844e0da42d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853109, "uuid": "8ded9526-975f-4114-8d11-50b705902a35", "value": "768:o2GZms4fab4wwT+caFOYn5Qm5r2RBY142Ezj:o2QbxwTgTumlgBY14J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853109, "uuid": "5f5f97a1-ffa0-4d72-a799-2663b1873a8f", "value": 37160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853109, "uuid": "2de85971-0874-490b-b10e-fa8b316c2d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853109, "uuid": "8bcfeb4b-523a-4277-a142-5b41b8c90646", "value": "UpdateRetriever.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9e9804-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855437, "uuid": "4471e762-d813-43e6-afdb-7c90f4034566", "comment": "Malware payload", "value": "a32c1de1894b09df2eae7be6affc247d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855437, "uuid": "0482e662-e1f0-4d30-8136-228d08f9f545", "comment": "Malware payload", "value": "0ede8db6c144b08851fd01b26779be0eb63ac816e27267260408cef15861a31b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855437, "uuid": "43494be6-d5f5-43e1-b460-de8808745f8d", "comment": "Malware payload", "value": "0c58d8955e41dfad8f55092c394f738b3439a4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855437, "uuid": "145cca37-25c6-4ef5-9a41-60137290ce26", "comment": "Malware payload", "value": "9aaec4385ad66157fbd7f7cf8f0a9eca05c493ba886b9df7dc49fff07b9bd3e85a6180d92a652ffd64e99c7abf349d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855437, "uuid": "4bedd6bc-cfaf-4ca6-ae60-cc90553674fd", "value": "T104850250B7F58117F1BF2BB9A4B6080A4B73FA53DA36CB9E0948905C2EA7340DE51763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855437, "uuid": "a4372716-5ac1-407d-9cf3-aaef788c5cc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855437, "uuid": "de31e3fe-6984-4447-af0e-7b10ccdc2c4e", "value": "24576:lXcrQoSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkkD:lXcrQmTYj77wRGKKm77LrwCB6hqany", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855437, "uuid": "c28d63f4-283f-43ba-9067-8f9f963ebf17", "value": 1834496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855437, "uuid": "f9c61cd2-3a2b-45d3-9187-e33cb3f9377e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855437, "uuid": "560fef0e-6252-400a-9413-a9a9aeea0724", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c825b57-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855439, "uuid": "8b2fe909-64ca-4e35-aa2b-e064a06357d0", "comment": "Malware payload", "value": "219bb7622c1de8e5fc5c1767d77e9138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855439, "uuid": "e27f8bd9-b6ab-49d0-ae5b-ec623ade8bc5", "comment": "Malware payload", "value": "0f7e43fc5e8b4ef850f5937842355eee9433373913514a9dd2796bbad755c94c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855439, "uuid": "6c2742ab-bc4d-4a7f-afa6-258ad1e8a9d4", "comment": "Malware payload", "value": "6aa97e3945348d5091deab0539a6a5929b745db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855439, "uuid": "92340bf4-0e2e-4732-9774-1bcf51d73b13", "comment": "Malware payload", "value": "3883732d99b073896c9e7fe3066112286c917c07215c86d7e7d9599745ed21a60d7f6f89a669ae087bb7195e54f440dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855439, "uuid": "52ba0fee-7737-4c9e-8f2a-64d06b093fd3", "value": "T197850250B7F98116F2BF6BB9A4B208454B33F943D93EC75E1D48909C2EA73409E92367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855439, "uuid": "005e06cb-89a4-4bff-a098-16e3ea9e200c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855439, "uuid": "2da2675d-dab6-4e38-bb07-bf28f22f578b", "value": "24576:/XcrQHSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkkV:/XcrQ5TYj77wRGKKm77LrwCB6hqanyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855439, "uuid": "8ad60ee5-de33-4233-a88e-95d4821a7a06", "value": 1836544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855439, "uuid": "76d8b094-b522-4213-adee-c38d77b76f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855439, "uuid": "5feefd2c-7aa3-4044-9115-a2bca18c40ae", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d50ad59-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855440, "uuid": "e08d4ed2-6319-4eff-885a-21e9905a8a42", "comment": "Malware payload", "value": "4b66152ebfed9be49282e6d5b29e28f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855440, "uuid": "4691e25e-7769-4870-9228-7426439bc2d3", "comment": "Malware payload", "value": "0f7eb5c88b9c787a83ff96108fc2d5718eb2b2b64911d9ce2acf0378b7787145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855440, "uuid": "84ee36bb-389e-41a3-b348-9fd312d7c3aa", "comment": "Malware payload", "value": "c9356f66072da83fc4f5fd8fbea2fde81d1dc0df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855440, "uuid": "a22ac294-2466-4aa8-9434-23d327edf55e", "comment": "Malware payload", "value": "60e51cd14c77aa27ce21383cd04d6cbf0c7183ff9d4bde1b1924836059f39cb4a1d2bc37e44c0d173daf2ce809443bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855440, "uuid": "9d1c111e-2c79-4ea0-94e0-f32f3f99da33", "value": "T148E55B143BF85F27E1BBE27795B0041267F0FC1AB3A3EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855440, "uuid": "6f9a846e-6736-4ad3-b35b-cc478cfe8ee4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855440, "uuid": "ea61b95e-421f-4728-88a3-8de0e61ae991", "value": "49152:Gvwt62XlaSFNWPjljiFa2RoUYI94bR7yoGdMZB3THHB72eh2NT:Gv862XlaSFNWPjljiFXRoUYI9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855440, "uuid": "d002a567-b3a3-43f6-9ed3-e9399d36300b", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855440, "uuid": "4f499563-468e-4301-9c7d-0aba641e5fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855440, "uuid": "92907a5a-39d5-4ea2-ab82-f7b1af781508", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee59acd-c7cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763834505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834505, "uuid": "388f7dbd-81b7-4c01-b9a4-da85164db9be", "comment": "Malware payload (Mirai)", "value": "964ebae41ad1a70cc911df49d13b1397", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834505, "uuid": "214bddf0-2c56-42e1-be7a-10bd40168109", "comment": "Malware payload (Mirai)", "value": "0fd23e8912ddaa876252685ac1c4c25fc46eb5293f020695a9a39bc559d670bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834505, "uuid": "f05ccef8-cc4b-45eb-847e-a9c191e50cf6", "comment": "Malware payload (Mirai)", "value": "dd625543dcc18da8b62654f698003d1c04a1ac84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834505, "uuid": "49973f82-80b5-45b3-8fb4-83290eb643a3", "comment": "Malware payload (Mirai)", "value": "47116e9763fc1b6543e863e464df2870fe82d6a1ef751dfbd856b2a1512d1c576b14f8c78678b11c3ca814e333f79e4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834505, "uuid": "d19a74d0-af7e-4aa7-9abe-2230d8504033", "value": "T1B183028361811755D4E3B33B329D9F9EBD01453BA29EE479BF7DA68000BF80055B8B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834505, "uuid": "e5a41957-a0d0-48f3-b49f-3a8dec05e164", "value": "1536:fLc6azoIQghR/pTx1TllgZKQPGKeT0I9Ctr6Qf01d1Gb4Igj3C4dbh6dRpQNXjok:fLhgRJHTkEQPGhwhtm+0wbe9dbhYRuyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763834505, "uuid": "77c4dd42-fa62-4be8-bcf3-11f15ba3e67b", "value": 82828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763834505, "uuid": "6cccad94-5f0d-4cc4-9e91-0bdb1ab15c3b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834505, "uuid": "4a3141df-c6de-4c58-862e-4a402b1ba6b1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2b8b7a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855442, "uuid": "dece997b-218a-4bc8-876c-2df75ff63594", "comment": "Malware payload", "value": "8e2d43e0d392e02efa35b07835e8fc4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855442, "uuid": "035e9643-2ec9-4c34-a4e3-0558f4066ca4", "comment": "Malware payload", "value": "0fe9f4ed37c00282b40ccc096d728129fe1f0837bacee618a3c07447be47d18d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855442, "uuid": "accdc25f-dcab-4d4c-8e46-4064225f21b7", "comment": "Malware payload", "value": "04136b357f3941489786b0be12c48bf4dff2b990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855442, "uuid": "21e40135-231d-4465-8f00-6b90c5466440", "comment": "Malware payload", "value": "19fa6a9334336ea2f72154068c428c86f704c63ba5a7d7eeb0897a7108c5a960fed66db0840e22257f4f534bf771b139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855442, "uuid": "996b8c53-3502-4ba0-9813-275858bdd45c", "value": "T1EEE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855442, "uuid": "e1e5df5b-d9ef-4fde-aee5-77de2ff4981e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855442, "uuid": "b1b1af8c-31db-48c7-8b61-970e36e47027", "value": "49152:1v3hBYjCO4Dt2d5aKCuVPzlEmVQL0wvwka0yRJ6KbR3LoGdfTHHB72eh2NT:1vnt2d5aKCuVPzlEmVQ0wvwf0yRJ6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855442, "uuid": "75656e9e-60a9-4d59-bb88-0e62d039a189", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855442, "uuid": "bc696587-2c46-4550-9446-e97d40728bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855442, "uuid": "a07e1997-90af-48c7-b996-4aa7666e359a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f099be4-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855443, "uuid": "1c88c8a5-5708-45f9-9a98-cededee04bfb", "comment": "Malware payload", "value": "4619c7f0d6c1ba066f369677e8b54179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855443, "uuid": "b94ad9b0-f721-4808-9247-1ca45bfde4cc", "comment": "Malware payload", "value": "1056491eadd2ab0caaba06eb61ef86ca0c40f1b7a34392951352d89a16fc9452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855443, "uuid": "def97260-1bdf-49cd-93a2-18332a29d2ae", "comment": "Malware payload", "value": "7ef6c159dfa895c7da68f9a3dce840a097fd8cf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855443, "uuid": "698837cc-7b82-4064-9ae8-28b35b278230", "comment": "Malware payload", "value": "8ac8252e42256439de77c980bde712cb79609cbc8900e7e0f8b61ecdc0935c3eeac8535d25f910ec7d76e4f92c510c7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855443, "uuid": "5a0694f4-3245-437c-b990-2109e88ca358", "value": "T11CE56B043BF85E32E56BD273D5B05026A3F0F82AF763EB1B518167BE1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855443, "uuid": "9fe34db0-b057-4672-8b0f-c980cc5e880d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855443, "uuid": "ef2dac68-3def-4106-a50b-755f414895ad", "value": "49152:hvfI22SsaNYfdPBldt698dBcjHKs/3Bx1LoGdZSPTHHB72eh2NT:hvw22SsaNYfdPBldt6+dBcjHx/hI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855443, "uuid": "3b13a832-d7dd-4639-86d5-172d8498fbdd", "value": 3298816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855443, "uuid": "9d9a0381-dda3-4aee-9487-0978156fb523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855443, "uuid": "15a52261-8727-42fd-ae54-fa2db4dd5736", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd87041-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855444, "uuid": "3071d7f4-ae4f-49c8-bdb0-fcb4060014c2", "comment": "Malware payload", "value": "4d4743987ea9ddae95bfb07e4b49e96d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855444, "uuid": "81ce6d89-831a-4323-8a43-2d93ec6d60b6", "comment": "Malware payload", "value": "10952dad4ddf649302b3ead19d7c39a4ef63f3a7d4c086ba3d088d9c1cdddda4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855444, "uuid": "3935339f-7b2b-49d3-a48c-0a82f1311b5c", "comment": "Malware payload", "value": "bafb3c40e72c0550a04493c09e137bcfa9e66944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855444, "uuid": "6203ee3b-d675-47df-89da-5ffadc400e4b", "comment": "Malware payload", "value": "8962e7d01c456c5681597f166999c3a309a299d33fadad35184cee790b00f4924eba95cbd2aa40cfcf07728daad93b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855444, "uuid": "91315ddc-afbe-4804-a39c-621948358c52", "value": "T1C3850210B7E49106E1BF2BBAE4B346454B73F546D93AD75F0948A0AC0EA7780DE903B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855444, "uuid": "cc567ef4-6e25-4132-b94f-b2b3359d7c54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855444, "uuid": "f71c1d7f-cb21-4ba6-bb76-762657ffe819", "value": "24576:GZ4sUfHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfEez8DhSBb:GZ4VSGOGqnXpyWUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855444, "uuid": "680e758d-fd45-4115-82ac-757c19d810d3", "value": 1868800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855444, "uuid": "4c6bf30e-ba89-4af9-a467-692abbce639a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855444, "uuid": "fc81431b-3657-4a1a-b723-a461b3ee629d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c01647-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855446, "uuid": "22e77dde-0b39-4a47-881f-91e6dea55c82", "comment": "Malware payload", "value": "956a02fb118f83b6148461638c8e2b77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855446, "uuid": "90dd3db1-de56-4ebd-a70d-808f996afe67", "comment": "Malware payload", "value": "10b30719eba0c40e386724075a2a6980067cb80106d5fb928a694ff04768178e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855446, "uuid": "44205423-5d6f-4eff-80e5-2bce90725f75", "comment": "Malware payload", "value": "f2a81ebc38596d0229d08319f79ef2302d03fcbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855446, "uuid": "40b3d596-1969-4c29-a2eb-698145b67df3", "comment": "Malware payload", "value": "9af0911380a1d0381bcbdafa4a9116f2dba51fce0cca191bfa755449b953f5fdef28aa030af2d1b7e9c2a783df5179c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855446, "uuid": "41b0bd7f-5dca-4102-bfda-99777a32ac3a", "value": "T1BDE54A043BF85E22E17BD6B3D5B0501263F1F86AF363EB1B618167BA1C53B505842BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855446, "uuid": "c1b244e8-fc61-4641-b2ec-5dcca9d5481f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855446, "uuid": "fa0764b6-d72f-4b77-947a-b75fd69a5549", "value": "49152:/vCe821/aQWl8P0lSk3aKA3Z+nS5+PJHbLoGd6THHB72eh2NT:/vZ821/aQWl8P0lSk3DA3Z+nS5+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855446, "uuid": "47b98f91-093f-42e2-958b-1b3b6742d342", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855446, "uuid": "c78663f4-20e4-4343-b39e-7dd0130fab19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855446, "uuid": "71ff6e1c-8b7b-4fb8-9172-d6700fff9c71", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb980ca-c794-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810186, "uuid": "0cf15e6d-4e23-445b-8de1-3ea2931eb0dc", "comment": "Malware payload", "value": "1cda0d1576b89889e32511afc78c055e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810186, "uuid": "54c07796-9c56-47dd-9747-647f794da38c", "comment": "Malware payload", "value": "10dc47912ddac13fa32f72fd215bf6acc4da32dc57405e3f69d9c7dbdd616bce", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810186, "uuid": "ae5521bf-aa8b-4249-8dbf-76e9cc86186c", "comment": "Malware payload", "value": "b48502439e3f752325a7db9335f11bd98fa72b10", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810186, "uuid": "2c829d64-5244-435a-89c1-72edf298b8a2", "comment": "Malware payload", "value": "dad16ce50c93f780d76fbb6013527720e5f7b032c7c682375a160d26fe76d2221533a245d1235a0af56c24328457cf36", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810186, "uuid": "4bb3b2df-6029-4b38-98ea-dc94dacedd9d", "value": "T17195F146F3E9BC2FCD7740314FBA0B7A01868E568646D3174569B12C9DBBAC49E82FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810186, "uuid": "c4288d50-cea9-4514-8b7e-3e78033100ca", "value": "49152:rzLSJPfFFDY48g2ABec+aeb2dFyK7xlvJ0vxxbhuadYmBBK:rzLiPHhkaebsPHNkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810186, "uuid": "0fd84914-912c-4715-9ed0-e47b803bbc67", "value": 1907326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810186, "uuid": "09df219b-8e99-40fc-be38-65ca75b71c92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810186, "uuid": "9e8b40b9-a783-4125-af71-ceb16b336dd0", "value": "pstoto99.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119a817a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855447, "uuid": "231d46ff-0589-4701-b42b-1fb4553b729f", "comment": "Malware payload", "value": "5db616f5558f51458cd73b76559e3137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855447, "uuid": "d0470914-c20a-4ac0-b35b-553061d38968", "comment": "Malware payload", "value": "11256937ccb7a761895ff40c3def0883b43f13a749979491646c110aae30967a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855447, "uuid": "cf13602c-2ef6-4951-bfaa-b3c8189da623", "comment": "Malware payload", "value": "a0fcab16bb7f40916951ffbc1aba345d1cd4b7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855447, "uuid": "587a6127-dd71-4fc0-8ec0-9a2f54e1e20d", "comment": "Malware payload", "value": "03948972f9ce7cd723cb7b4de3a04c38d973bc11b97b87ac19bc84eec2ef4992fc1ea4e1bdef4bdeb86a74396fc40243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855447, "uuid": "dacd9356-4495-4349-9aae-affb8f45361f", "value": "T1FCE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855447, "uuid": "e4aae337-e259-47b9-8266-4d50953752d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855447, "uuid": "8d32acef-b4a3-4b3c-836d-2eeba9ca714d", "value": "49152:rvIAd23law6wGPAllX3SSLNUpylJRJ6tbR3LoGde2THHB72eh2NT:rvZd23law6wGPAllX3bLNUpylJRJ6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855447, "uuid": "4f751ac2-b93f-47bf-be18-f277b0c9caea", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855447, "uuid": "4d926895-764d-452b-8273-0964455250c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855447, "uuid": "a97b64f7-5523-44aa-8d0f-d6372c093e7b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1253a21b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855449, "uuid": "62d95e88-0d34-4c61-a329-6b8066d51745", "comment": "Malware payload", "value": "e7147cdb6d659019ec2e453bb3a0ca72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855449, "uuid": "921c41ee-b0c5-40b6-bab2-0e520bfdaab4", "comment": "Malware payload", "value": "118d7d4802a5999c8b317fd7fdf1808449611607cdd211a1d7a7ca9217173a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855449, "uuid": "4371d156-e8cf-4628-a58a-9a99f5851936", "comment": "Malware payload", "value": "db8dded9222b2729364107416eae5d6a84d7c6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855449, "uuid": "ccf8b767-e18e-4009-a143-0329bdee1d79", "comment": "Malware payload", "value": "62cb7a15be035e61f754381813afd3f93cbe6e232886f9bf7b67d1bfb8b804349ef69c08907abf219b5a9044b8753770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855449, "uuid": "35d0887b-431a-484c-b798-9f262ca45f7b", "value": "T1D6B45B8123FC852BE1AE57BDE4B14421ABF4F407A6A7EB4F4940A1F92C567429E407F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855449, "uuid": "8438a6a6-2ae4-4121-a43e-25e5fe223457", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855449, "uuid": "d354e08d-6168-4d03-bda1-6927003b2800", "value": "12288:kTEgdfYCRaYIbZ3I4bywAPp1Vulqeucdy:pUwaQ31ywAPp3cdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855449, "uuid": "9924a5ea-a41b-4c39-a1a3-f583903c233a", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855449, "uuid": "a4d915d8-4079-412f-8f64-391af4eae255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855449, "uuid": "34eb1813-0e04-4180-9d31-c079a5b46b8a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132295e7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855450, "uuid": "bac9b7ea-a07c-44df-ba61-4c20dad35982", "comment": "Malware payload", "value": "f886ff7e516e976be7e3f1b6345f7f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855450, "uuid": "c865f596-e871-4736-be1a-f76ca93d0f82", "comment": "Malware payload", "value": "1288056ba7814606a31d67d117f32faccc79b2036afe8b38b52046546a9ecf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855450, "uuid": "57091297-bd31-474b-92f6-b265377e6eca", "comment": "Malware payload", "value": "781c5c1783d4d3a721f221b5cdbfbcf25197c12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855450, "uuid": "0a956f84-3f9e-4062-8956-cb0bdae2d4c7", "comment": "Malware payload", "value": "e29c906799e14c37caaf2ddc81f1d30b995850ac54070cab6e7f06ab7698194ca2211af29aa69859261297ebca3e8bad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855450, "uuid": "41d933f6-97ae-458b-b9b3-d9a77110b15b", "value": "T14AE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855450, "uuid": "824d05f0-2440-46b4-9fe5-e6522b6f6556", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855450, "uuid": "ae6fdc4d-5bbc-4b7a-9ac8-009cb36742f9", "value": "49152:fvzlL26AaNeWgPhlmVqvMQ7XSKnyRJ6dbR3LoGd+THHB72eh2NT:fvpL26AaNeWgPhlmVqkQ7XSKnyRJ6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855450, "uuid": "3dda7175-4c5a-44a5-9163-df3d79544494", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855450, "uuid": "0523b723-fba3-4889-a828-0f1967b62ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855450, "uuid": "7c7cab97-34a2-49fe-9337-2627e9c9256b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067d183d-c7c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763830947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763830947, "uuid": "a077f753-109e-4038-bfbe-e9a366529ea2", "comment": "Malware payload (Mirai)", "value": "5121944990f0e098201fb5abfd6df636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763830947, "uuid": "891864dd-5fed-4c31-9156-d9307d55e56b", "comment": "Malware payload (Mirai)", "value": "12e812ec7b1983d4be3667107061a43a22250be46e7fb4962f179722e0ee2cde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763830947, "uuid": "fc61038c-d43e-4636-b12f-70a10031ecdc", "comment": "Malware payload (Mirai)", "value": "ad4192d44ac3a0dd342b2c70b7229cb5fb072a64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763830947, "uuid": "edcfc5a7-c4f4-4724-b47f-1e515953bfd6", "comment": "Malware payload (Mirai)", "value": "f6c3ca605795f54aab6cb0e19871781828b7b09ab7880d28079402680e48649b1b4b9872674b1a7c86596af8c875c254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763830947, "uuid": "46ae40bf-02c6-430a-bce5-bcfe4bd9d15b", "value": "T1AF64B5BA77107F5AC368C23805F347E996B3236216A39105E12DCA3C2EA534C5DDFEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763830947, "uuid": "4d449f24-0672-40da-ba65-0b63b5b12eeb", "value": "6144:91n3zl5hj6VbXVc7D18uTBIyIuhqjfGIp/H6ybNo:91QIafGIIybNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763830947, "uuid": "4acce0fd-ac0f-4a69-bcb5-05c264f84255", "value": 310300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763830947, "uuid": "62e96a17-435a-4014-9d9b-4b0fb79f6f50", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763830947, "uuid": "495b2556-7e5e-40b2-a8d3-54dd48aecb89", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f1d3f7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855451, "uuid": "1f75313f-e44d-43d1-ba53-c0ac9960207f", "comment": "Malware payload", "value": "acb9e01bb01ec3e0d572ab2be6010974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855451, "uuid": "4f2772a2-78b0-4e6f-b631-c0e41500a0cf", "comment": "Malware payload", "value": "12f54bd304103c36d5c2a62b8c1ff1d511ed11ce37fe9913b257313d72fa960c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855451, "uuid": "299c7182-e8f6-4e33-970f-c372440a4a31", "comment": "Malware payload", "value": "f826dff662ec9e54bb61ccafbe92783cc2465c9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855451, "uuid": "05d91647-15ba-46ca-80a1-c049d29e748b", "comment": "Malware payload", "value": "e6755a4ccb7853e29375503733b13c35beb750657c2d77cebd483c834048953d47e61565e3a1b197dafa7858b726f1d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855451, "uuid": "8151e6d2-4071-4aef-b054-1c563dce39fe", "value": "T18EE56B0437F85E33E56BD2B3D5B05026A3F0F82AF363EB1B519167BA1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855451, "uuid": "89f92605-45f1-488c-b695-8c943bd7a537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855451, "uuid": "a7e7b8a8-4dd0-4c55-b997-7d88d9681acb", "value": "49152:/vIAd23law6wGPAllX3SSLNUpyO6/dBxULoGdTYMTHHB72eh2NT:/vZd23law6wGPAllX3bLNUpy7/4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855451, "uuid": "745e138a-4888-49e1-8892-f99d77f13bf8", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855451, "uuid": "7040d735-8d6f-4fc9-b7ed-d3ca27046e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855451, "uuid": "b670629a-c1e3-4d7e-8199-650f1fc1e241", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b856c15-c75f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763787147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787147, "uuid": "d85bd60f-d365-4a45-b3cd-defa5a356204", "comment": "Malware payload (Mirai)", "value": "78cf7be6d9bcbee6e0e366872f0da1e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787147, "uuid": "e7661bcb-612a-447f-a92e-da1b5dbb825c", "comment": "Malware payload (Mirai)", "value": "13166d82f2fe6811f48aa209b22f92f5bde1c19afcf8216e280d0b7a5c460b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787147, "uuid": "51642882-af0b-4ebd-b035-7c2724e9ab43", "comment": "Malware payload (Mirai)", "value": "5e200752436dd5881418e2da52f06fa7757287d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787147, "uuid": "c1ee133c-1b73-4aa7-8548-0d9dbbebc59f", "comment": "Malware payload (Mirai)", "value": "86ccaf7198f6311d0ab1a814d2caac299619c4d93555ab3715f04760fbfca29ed640bb5050b26e092449474bb6859cf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787147, "uuid": "fb18e2fe-6066-434d-9301-e00181aab839", "value": "T11864B4BA77107FAAD368C23805F343E996B2235116A39005E13DCA3D2DA534C5DDFEA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787147, "uuid": "1282ad3b-44fb-4edf-bacf-6966d5c8eee2", "value": "6144:TkeznLfjuuvPjwKYK7BTBME5MiVcjl5UTe/ybNH:TkMt8l5VybNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763787147, "uuid": "80f15813-fb14-450f-8040-4b636090378a", "value": 310668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763787147, "uuid": "21622ca2-8727-40fe-8e5f-3adf9df8c26e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787147, "uuid": "9052b63a-3578-4640-a21a-899a0df9abef", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a8eb4c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855453, "uuid": "bb96c6c4-c483-4d19-a589-aebaf19be253", "comment": "Malware payload (QuasarRAT)", "value": "36a1d87cd99435dbb658f5b73f73dd1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855453, "uuid": "75678d1f-8d7c-4727-852b-fe1f264b7978", "comment": "Malware payload (QuasarRAT)", "value": "13be8977bb622526f866c550e27e0c5495afc2bc5dc627968c7e3257f62a5266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855453, "uuid": "6046d6d6-58f6-4f9d-9bf2-43741ac9b32d", "comment": "Malware payload (QuasarRAT)", "value": "f5c4b3fd5364cb85ffb22e2e5677290e7ffd6c83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855453, "uuid": "8967b4bb-f9b7-466c-a485-dd616ef10bc2", "comment": "Malware payload (QuasarRAT)", "value": "1b7a6e44188ea54bebe87aa5938ae112f4b0a81d25348c3db6ff8a3e5cec0110cd656214c07890aa598b632b313e9068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855453, "uuid": "80de5c00-b150-45e3-b965-26e69a7c698c", "value": "T159848B5773A4E63BD1BE173BE43246154BB0D443B616F38B5A6C45B8AD233868E423B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855453, "uuid": "4a46cbd7-0247-4420-a6ca-de5fa9857f28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855453, "uuid": "2c23e604-4e59-4160-8f33-df985a2abc99", "value": "3072:Lsrt+8Hiefcu00MKpyDcsvp6ByEGB4LJYp4nm89OZrX92V+dCw/JMQRkRbFHuqRH:LGNHXf500MBeLvm4XRSb8PagDqAwvVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855453, "uuid": "ddb1a5cd-e6de-43c5-9f57-a17b3896a4d3", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855453, "uuid": "c48229b4-1f5a-48ba-aed8-798aab2360fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855453, "uuid": "ea9b864b-aad5-46e9-9a2c-530b65b09286", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159148e6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855454, "uuid": "51caa1f4-f1e7-482f-b60e-3e1461593660", "comment": "Malware payload", "value": "ba6ab7fffeafa914cb01eb2ac583f740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855454, "uuid": "79f0dff9-40dc-4142-9198-c2b57bcff59d", "comment": "Malware payload", "value": "13f9c0eb43a2ccf0a8b4f3d778bc34c313e112f676c816e6cbdc4ae714bd3e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855454, "uuid": "75acf3b1-cf67-448d-955f-3a185d5acab0", "comment": "Malware payload", "value": "7a4b7a049e364b659e9de615cc89fa440d82dc44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855454, "uuid": "78b86d6f-eb61-4789-bde5-c7d6ee2392b3", "comment": "Malware payload", "value": "874c5d1b862bea66b6b527a41b9c64dd56759b470fa222b00f6bd6cf83d2dc3c19c629b7db37cc94cb6c9d6d4dc83806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855454, "uuid": "9123d1e7-d194-40a0-b6a5-7a0d8b091a52", "value": "T110850250B7F58117F2BF5BB8A8B2054A4B33F943D936CB9E1948909C2EA7340DE91367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855454, "uuid": "47f70258-41a1-4509-971f-80b9b786b2c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855454, "uuid": "63a6d8cf-0825-4d67-9b9c-9ae9d1b7fac7", "value": "24576:fXcrQ1SKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkkP:fXcrQXTYj77wRGKKm77LrwCB6hqanyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855454, "uuid": "c972427f-404d-45c0-be63-2ccc9058c9d4", "value": 1836544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855454, "uuid": "c2aaf2a7-78b8-41ef-80c7-5e9816788efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855454, "uuid": "e066f0dd-561a-42f8-aead-3ec8a2c34284", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166bb3a9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855456, "uuid": "2da16ffc-2bb9-48f0-b7ef-ccf82c822578", "comment": "Malware payload", "value": "46cc4d4e7a655f3521c3e52ceeaf7a33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855456, "uuid": "46b657df-87d5-4ed2-bd27-c3ea06ded319", "comment": "Malware payload", "value": "145e322b08fc4c3864687bb480b6873b16fe0c8fdd87d6a56db2c1d0159a5a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855456, "uuid": "50b684b2-3872-4359-b3cb-bfb81f253838", "comment": "Malware payload", "value": "6d3b51437c807c9994c3eccc245d17a04b80916d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855456, "uuid": "03421841-2a6e-410c-a89f-e8d6b321219a", "comment": "Malware payload", "value": "2b49455ecbd4bacbc1a708da759ad9bf8fe4009c0a47dd41d40382eb6debd47a990af2951ef53bc82895469c2b12fe0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855456, "uuid": "9a3f747a-f3a6-4dba-8bfa-af1457d09b66", "value": "T1F27633417A52C5BACD7F0078ECE58B143A3B3018AB716187F6AF27BA564A5D073391CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855456, "uuid": "c4aa5b09-64ff-4ae4-9a43-45affa3e0101", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855456, "uuid": "63a744cb-cad7-4728-bded-d67ac341e909", "value": "196608:0qkWGRAMF7Vs//RC7kojT4Rqn+zqVObBNrR:ruLxkw4R2+KObfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855456, "uuid": "601d8f83-0044-4c7f-bc79-c6aff7455a22", "value": 7199744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855456, "uuid": "b413309c-7cc7-45e8-9350-fbb0109ae607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855456, "uuid": "6363ba6e-7f86-4ac5-94b8-f998c7eae3cb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a48c202-c7ac-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763820297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820297, "uuid": "776bd882-9655-4f86-8e8d-218c694e8123", "comment": "Malware payload (QuasarRAT)", "value": "b97de85832111edf6187fbbbcbfc2068", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820297, "uuid": "bcc2bb21-63fe-4eb9-836a-036d07d91004", "comment": "Malware payload (QuasarRAT)", "value": "1493609fce8d9db82e0a65aec17e405683f94b1302f63092a5fd9773a0d2d243", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820297, "uuid": "b5275d14-2a38-4217-b829-2e0471abc898", "comment": "Malware payload (QuasarRAT)", "value": "53905d296328d5d9a7f36fe9679569866d35222a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820297, "uuid": "91315589-fdb7-4355-9d73-c813d0e9bf47", "comment": "Malware payload (QuasarRAT)", "value": "58aaa2fa462e6fc6b4442ecb5872fd26aa2a02ab9108c33674d10e6f16d36d254522f2408e9eef6bc6c5a9a6287580b0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820297, "uuid": "beb92661-777b-4a16-8ce2-ca2465a46baa", "value": "T102A502745D4C0C28907D0B98D862DB8B17F62F94A21F9AF27EC918AE0369B16055DFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820297, "uuid": "b689a149-e03a-493a-8f5b-d5517aa1c0c2", "value": "24576:877fRnXgP4lC2qWwjElNA9wrOjKxT9oWIEN3mnPgbNaRxB17ta6W0Uz+EmbArYGS:i5mz4J96gcxfta15RoutoHtiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763820297, "uuid": "1a31d4db-03a4-4f63-992e-23e728ecfe67", "value": 2212744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763820297, "uuid": "9343073a-7ccb-4367-8338-6af63fa0953a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820297, "uuid": "18188865-c1fd-48bf-8e6a-11114e1b09d2", "value": "Tweaker_2.0.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17478f57-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855457, "uuid": "967760f1-b149-42a8-b989-6821163d3645", "comment": "Malware payload", "value": "c4c27fc5360e3562fa887e9ffb4e251a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855457, "uuid": "71129f93-646f-4f4b-aaa0-aa9b54495fac", "comment": "Malware payload", "value": "14b3554337b20fab7370ed5586671672b90a2a013c4f85bd3e7cc9de410d1d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855457, "uuid": "6cdeff90-c076-4711-a98b-537f972e9734", "comment": "Malware payload", "value": "cde43d7ada0034d34172868fb45423dd06ba3b99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855457, "uuid": "8b9e35d5-7ce5-49b6-9624-2d388bf343e3", "comment": "Malware payload", "value": "0ba34de7df4364915a4037a36195a49751fd6fe1b9f60fa2d12705309a3e405050ca78508747862055aa9ccbb8796995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855457, "uuid": "a9ffaebb-48ae-4212-b294-c87d3db252fd", "value": "T143E55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855457, "uuid": "c1964205-4bb2-4281-9a5e-5c37d0cacff3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855457, "uuid": "934d860c-299c-4604-bbc0-d85d456d9b17", "value": "49152:zvrlL26AaNeWgPhlmVqvMQ7XSKcW/aEfpik/YF8oGdOBmTHHB72eh2NT:zvRL26AaNeWgPhlmVqkQ7XSKcW/++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855457, "uuid": "41da487b-63f1-464f-b608-44b2933e0772", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855457, "uuid": "1a1e985b-9176-4a00-a14a-4a27d07ef96a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855457, "uuid": "461ad0a9-8a58-471c-8c1b-4eb38cacf463", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3263e1f1-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850778, "uuid": "42c04402-76ab-4a8b-9983-57c637b831f7", "comment": "Malware payload (Gafgyt)", "value": "b9c9fd260085eda7deffc10c61f1e6a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850778, "uuid": "7f59257f-9a4e-44c1-9fb9-8a2e8e0fac16", "comment": "Malware payload (Gafgyt)", "value": "14c7dd5c8352800492c819872521784e82cb72c6a62ee51c187c1fdb84948ac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850778, "uuid": "e46d1a08-14c9-43fd-ad49-2a14ce45b97f", "comment": "Malware payload (Gafgyt)", "value": "51b021a2568cb4f9efa030ea19e8ea60d8d16cc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850778, "uuid": "f86b42fc-ab53-42d1-863d-fcfc39483ef8", "comment": "Malware payload (Gafgyt)", "value": "64f8a8a6203b1bdf683ee5d0de0d38b1ecd400b9cb023556cd74b731e7ad7b636cee38f54eb479e8c7b5c1c4c87c82f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850778, "uuid": "f8371328-a960-402d-ae07-63196d6d67b7", "value": "T1B0934C23B452C6B7C48787F51BCF9A55AC33B4BA0B72224673E87DA42F128D91D5AF40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850778, "uuid": "9a93f1e1-5668-4d13-af16-6232de359fda", "value": "1536:i7i7hFPT3owiG0KWDHaCdGb3FU47HDh1oXZ3aF3fphTddddd5prZm9HiVrHjDFZ0:k+P8LVKWDNGb3S+Dh1oXpi3fphr/mFiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850778, "uuid": "8dfa4a43-7ed0-4fa6-becc-b34459a2a7c8", "value": 97240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850778, "uuid": "7cc31d6a-a50a-474e-8eee-a72a651b4146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850778, "uuid": "9a35c7c5-cb56-4438-af8b-b4b5ca88b67b", "value": "Ayedz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1808e8a5-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855458, "uuid": "348e7fe1-9843-4f1d-ae73-4c070fa530fb", "comment": "Malware payload", "value": "dd46f65414789d6537f7a1fb2384e895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855458, "uuid": "9d5b285a-1a29-4ae0-b498-ee992cb77905", "comment": "Malware payload", "value": "15157abd66397360e530cf4b063ba5112b40b48f2ffe3dea253742bea05aadcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855458, "uuid": "80addf6d-1011-4700-a38d-df6a87bd9ab0", "comment": "Malware payload", "value": "58ba92a3679696b682f77bf827f963c50e5464cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855458, "uuid": "5cb8356e-bb6f-4355-8e9b-f86ffd581de4", "comment": "Malware payload", "value": "ed44eb7cbf2b60a4f974583e22b90245688384532aefec0d1e74c272883f4de2ee15b85afe8c45e5df6aa8b6af78340c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855458, "uuid": "414790b9-923b-443c-9954-3db574f25db5", "value": "T138747C1377A8ED7BD1FE273AF43206054BB4D44ABA16E38B5A5855F82D233868D503B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855458, "uuid": "16a760fd-dc6c-46e6-af1d-b8385ffa2ac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855458, "uuid": "39c27ee3-fa42-4bdd-b4e9-8087ad9747ce", "value": "6144:dU6bPXhLApfpRL/Tu94pcpb6IaIWEDYd4fi6:SmhApfTw3QI3BDVfi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855458, "uuid": "217ba40d-1e5a-422b-8b1d-fa32b743ec2e", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855458, "uuid": "23ce5e71-2472-434f-9284-fc4a17c89af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855458, "uuid": "097ea448-0d78-4ac0-b7f2-a0d1fddc1ec5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dab75c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855460, "uuid": "f469a4c7-c201-4f1b-a2b5-7c2a5e51ccd8", "comment": "Malware payload (QuasarRAT)", "value": "3cde893acff4a4459051df8fa7aa3be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855460, "uuid": "41fbe9d1-493d-4319-8621-283f7bd4c421", "comment": "Malware payload (QuasarRAT)", "value": "158458a91b8ae9debbd569874ca67b101b3a7576b68c3045623cb1bb4fc985a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855460, "uuid": "0247b36f-9805-4162-b7a6-f07c337a7e30", "comment": "Malware payload (QuasarRAT)", "value": "2982552d1df4873b582d27693e24b54fb1141028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855460, "uuid": "f3184f20-2548-4bf8-b137-2b088848c6e1", "comment": "Malware payload (QuasarRAT)", "value": "cb2d92ad17d1bde09c69cded56ada8eb17a010b9c36c54a1f4955d4304504917311d91b49549a15b4328bd8f1df65547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855460, "uuid": "5e10a7db-3f86-4e94-9ca1-f12a181480fc", "value": "T12EE55B0437F85F33E1BAE67395B0041A67F0F82AB3A3EB1B5191677E1C53B5058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855460, "uuid": "50c59859-d956-4550-9db1-0724c340bf60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855460, "uuid": "3cdc60b6-30fa-4b44-ae59-9c7310356786", "value": "49152:2vlt62XlaSFNWPjljiFa2RoUYIuUbNEZw0k/hrLoGdzPTHHB72eh2NT:2vX62XlaSFNWPjljiFXRoUYI9bJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855460, "uuid": "0d4a6798-931d-4ad5-897b-51ac4c43d410", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855460, "uuid": "d420978a-8e8f-47ca-83e4-e729ac3f62e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855460, "uuid": "f47e6dfb-bf13-4f45-9601-9429a49fbd93", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c92fbc-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855461, "uuid": "30586629-b150-4486-b32b-02a46b27655f", "comment": "Malware payload (QuasarRAT)", "value": "abb24f2e4ce606c00a83bb291cdf22ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855461, "uuid": "3d5bc9b7-557f-4f5f-8ef1-a5dcc0b07bdf", "comment": "Malware payload (QuasarRAT)", "value": "158851140a3cb9a523444717c72c8404906b14e41637330031da43db2c23561b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855461, "uuid": "78ca1161-6d55-49e0-9ee4-74e08f56eabb", "comment": "Malware payload (QuasarRAT)", "value": "4e8df9fe53dda42e1c53b61bda52af4cbcaab047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855461, "uuid": "f1e260ad-3a1f-403f-ae84-a420d7e734a4", "comment": "Malware payload (QuasarRAT)", "value": "4e19a22b03022934aaac9f10d49aeae921a4fef86ef763854456062863f82334b718ecce431507d7e5d3bfcc8bb2b881", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855461, "uuid": "359eda4c-72db-498a-ad5c-8b38038a1046", "value": "T15AE56B143BF85E27E1BBE27795B0041267F0FC1AF363EB0B658167BA1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855461, "uuid": "9243b0f5-8426-41fb-a8ab-502e66e798e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855461, "uuid": "0dd265a5-045b-436e-a0f2-202dc915fa31", "value": "49152:DvyI22SsaNYfdPBldt698dBcjH5rRJ63bR3LoGd6GTHHB72eh2NT:Dvf22SsaNYfdPBldt6+dBcjH5rRJ6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855461, "uuid": "772129ab-9704-40dd-b7e6-86effd8961f7", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855461, "uuid": "6fef51f9-d69c-4f39-a434-2d291c16f677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855461, "uuid": "043d2871-c77d-483b-aac5-6dc88a60ae39", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8f7ed4-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855462, "uuid": "262e2fd2-4a95-453f-9dfd-cd924a123ba0", "comment": "Malware payload", "value": "d81ce1222bf1221f63d0a2593a325324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855462, "uuid": "b95bb944-b881-46f3-814a-874ea588bd06", "comment": "Malware payload", "value": "161f9da163d8e1572992702a3504958c155a80e0c5e585e15f612e49d9f0f361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855462, "uuid": "7755c8b7-18bd-4414-911d-d6ed55db2a97", "comment": "Malware payload", "value": "a0afdafcbf8f2a7ab41ab59a4ad5150a96a519b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855462, "uuid": "11b3d5fc-411d-4f37-b4c9-bf8fed495287", "comment": "Malware payload", "value": "0b85e7379cbd2f4fdffac57b2883d23bcfe32166122baeec973637e16bf7057b7831275f5527731b53738962f272c80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855462, "uuid": "9b35e598-e04e-4456-b4c7-1301adaeff57", "value": "T189848D2373A8E93FD5BD2B3AE43206154BB1D4477B16E38B5A5855B82D133878E903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855462, "uuid": "329854d1-13db-4fdd-b1f7-a143af0fb125", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855462, "uuid": "90e7a93c-21bd-4d33-8703-13e92098788d", "value": "6144:M+NHXf500Mr3rUO84+bBbpMMm7j6SyaGyIbK:7d501roDWF+wG/bK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855462, "uuid": "73ab7039-891a-4a78-9385-fac8c43a02d6", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855462, "uuid": "80cdfde5-e367-4a74-8417-bfce72feddfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855462, "uuid": "6764c70d-f3ee-4c9f-a59e-9569906de657", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b582a62-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855464, "uuid": "7d490919-19a5-49b6-9624-a1f725fd5ce2", "comment": "Malware payload", "value": "47a35fe24e872363fcf661167c9f7819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855464, "uuid": "d585f87b-6395-4ed9-8cea-ff8c5bb98413", "comment": "Malware payload", "value": "1639fab3bf4ca419c83e8caffd4dc147ca05be399a5227ee05f8f809e495c959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855464, "uuid": "b3930b49-3a69-4b6c-8124-02275417373f", "comment": "Malware payload", "value": "e81422b9c5bb6a96a0d0b186d8aa896c3dc6e796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855464, "uuid": "0bee9a56-761a-405a-a9a9-08e6438a3b67", "comment": "Malware payload", "value": "f795903f16b63d0e69174cce1244fb5c597a7c345ea5840870ae7c557524a0537b43b3875af1ebf9461c536f5cc833b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855464, "uuid": "657751c0-5f79-4626-9266-0066f6aec11c", "value": "T1F0E55A1437F85E32E17BD2B3D5B05023A3F1E82AF763EB1B6181677A1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855464, "uuid": "63fd1061-d481-4517-89d8-121f047e3d0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855464, "uuid": "2deae402-0920-4911-a63f-7a15222ac1be", "value": "49152:KvOI22SsaNYfdPBldt698dBcjH9GVPDBxpMoGd6TTHHB72eh2NT:Kvj22SsaNYfdPBldt6+dBcjHyPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855464, "uuid": "f92aeab3-f729-4a14-9bfc-7d311315cab3", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855464, "uuid": "9ffd4c7c-94f6-4bb0-a64f-7fdb65cef7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855464, "uuid": "07dea41d-4d1e-4059-83a0-4f48afc683ff", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90605fed-c794-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763810133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810133, "uuid": "e7f01fec-6c31-4fdf-870a-53620504b6a8", "comment": "Malware payload (ConnectWise)", "value": "c1a32af7a15a8738d740b803f60de9f6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810133, "uuid": "04a9a99a-6b92-4c6a-84d8-7b8891bb25b3", "comment": "Malware payload (ConnectWise)", "value": "163c251236457fd0b767885bc4a59c4fb679057b55f8abc3b8d2f84b3efed2fd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810133, "uuid": "4939b795-d7fc-44aa-8424-3a9f0b480c3d", "comment": "Malware payload (ConnectWise)", "value": "3b7224d3083e77b4f7a4b805a28cbdff5d3ccf3b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810133, "uuid": "1418c8f3-7fc5-4e93-a98c-cdaeb10a63f1", "comment": "Malware payload (ConnectWise)", "value": "d544ddd21502cd143f25ee4985973c4bf73071cb728692aab0373527192d6874f4aec6bbf44c7720ac6ee7d7e1116074", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810133, "uuid": "096d46f4-850c-4514-b98c-809122d12b0f", "value": "T1B41633D8032A2E9FFCDEE54C7E58E1D97CC06BFD8AA5E638D56D91042AA44C105A3CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810133, "uuid": "e5887542-18f0-498e-8e6e-c1959d79c601", "value": "98304:HE6GekBOmkGOp9AYwNFuN1mcvz42ZzfuyWN8:k6dkBOmkGe9uoGcv0WC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810133, "uuid": "7880e1da-69c8-472d-82db-4fd7ba6abfc5", "value": 4022008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810133, "uuid": "793cca13-54b3-45e1-9aff-a48ead6e1502", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810133, "uuid": "7d5f7ab1-b054-4b07-bde8-3b28ea5d8f8e", "value": "adobe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c20b2dd-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855465, "uuid": "83d0c8d1-cff8-4d58-bc6c-f790d97a6069", "comment": "Malware payload", "value": "bfbf88924d91da3a148186593540e2f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855465, "uuid": "fd3c8716-5bdc-424e-ad58-08664bb9f861", "comment": "Malware payload", "value": "16e0d2a100e35f01bbd4f3f227625cbb6fd1b99d87260d50c6e31330add1c8c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855465, "uuid": "e52a2ff0-383e-4f4c-b887-89ea42bcd5c7", "comment": "Malware payload", "value": "8995d0eacba19198ba4f106322ffce816e05c127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855465, "uuid": "5cf0c1b9-7865-4c8a-ab0e-35bcc92835df", "comment": "Malware payload", "value": "4266843db30ac007034ebaeb66e5f4d8d67d71d9357c5fa0cd1f2aed3c065c123444fdeeb5daa4e7511ef556543d4a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855465, "uuid": "549f2371-e8d0-4cdb-8bca-ec53e9326117", "value": "T15CE55A1477F85E23E1ABE273D5B0401267F0FC2AB3A3FB5B6191677A1C53B405842AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855465, "uuid": "da400f9d-89e1-4c16-b217-d88c952042e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855465, "uuid": "f7e1143a-873c-4bb1-a455-e08ba6e00529", "value": "49152:fvyI22SsaNYfdPBldt698dBcjHHGvi1JGLoGdTnjTHHB72eh2NT:fvf22SsaNYfdPBldt6+dBcjHHGvJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855465, "uuid": "1e635e10-59f3-4141-a90e-9ff617f93d62", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855465, "uuid": "4e836d5c-cdcb-4dcb-b988-6b8b3cdfc20f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855465, "uuid": "0b8654e6-59c6-45cd-bea9-48de97240b5e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889b3686-c794-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810120, "uuid": "be335300-bf64-43f6-9861-fc9505d43d87", "comment": "Malware payload", "value": "ef235e7d649a46ebf0dba202d0692c64", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810120, "uuid": "1d919892-2e04-4afd-af45-b6b34a802204", "comment": "Malware payload", "value": "16e94da7377e34cbf9f40500cc593404520f18ddfe9691206fb98d874ba7ed49", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810120, "uuid": "27dd2fc7-610b-448f-8e2c-3963d124c140", "comment": "Malware payload", "value": "246c00d21fda0dacd50d9fe41a12b8f9b12f0a2c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810120, "uuid": "89743232-180a-451e-8164-87667d9d2f56", "comment": "Malware payload", "value": "d103027fd63f2cf404fa1c21b84e7a839a20d73a27369e0cc9b078486d33a7c6e43810857556f0f0eacfb8621ef6b1ac", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810120, "uuid": "d2cfae96-b06d-479c-9eae-75962cc20ee3", "value": "T13D46F1C6F7D8A92FC8775072C9BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810120, "uuid": "9254af7e-792b-421d-b7d5-5f9210ea0244", "value": "98304:GWP9QvvoTwrYZKOfsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpCltw:paIKOfyaIbaciAFvrEZpXqmY9XrF/mph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810120, "uuid": "d6156d9f-1045-4fdc-9ca1-87270c30833a", "value": 5840663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810120, "uuid": "772452e4-e2f6-46cd-a184-b867c1e0ca43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810120, "uuid": "288dc071-57d9-4d6d-8f2a-cf9ab671e2fd", "value": "Racingbet138.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfc2201-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855467, "uuid": "5e0e488c-d0bf-4bf7-911d-676eedd71d96", "comment": "Malware payload", "value": "7c188761e86ebc39fe0e788abbd3ae59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855467, "uuid": "b02529f6-56d2-44a8-8dcf-16945411d9b2", "comment": "Malware payload", "value": "17049c0f015f1f3b05852d7a34dfbac4a3f3573e7d2844d02fde14f0f9aa23c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855467, "uuid": "51c8e1d9-50ab-4a0d-a9f8-6e540948ce1f", "comment": "Malware payload", "value": "cebfda56ea332798bb3d2458875c278ae473691a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855467, "uuid": "154948c7-63b8-41d9-8649-0cf5cfb7b49e", "comment": "Malware payload", "value": "94e8dc69832c9e66a6504e7a5b59d6d7c3a272787b8eb6e375fbf6e835c217c4f0a5b014cac245257ddd855da8e8ea30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855467, "uuid": "c510f3bb-4842-429a-9bf0-8f416ed7192d", "value": "T12BF54B1537F84F26F1EAE67795B0881267F0ED1AB363EB2B2161667A3C53B404803677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855467, "uuid": "e14c7abd-805e-4ac9-b331-9591f94d9625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855467, "uuid": "230a22f7-67ae-446f-a027-2a7a39dfbcc4", "value": "49152:GvyI22SsaNYfdPBldt698dBcjHdNRJ6nbR3LoGdqmTHHB72eh2NT:Gvf22SsaNYfdPBldt6+dBcjHdNRJ65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855467, "uuid": "d5e03898-bcaa-4024-9cd5-1c4b60746f91", "value": 3342348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855467, "uuid": "c0d802ac-a205-4568-bbff-0229683854d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855467, "uuid": "29e14203-d086-4cb2-94cd-75eb4a12b9b4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba80756f-c772-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763795601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763795601, "uuid": "0a60eca7-d53b-4f95-ae6d-bc77087da150", "comment": "Malware payload (Mirai)", "value": "b67a04d2fa8d5b8547d694b05adf13c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763795601, "uuid": "9c7c4db3-5328-46c8-9801-e431f68b89bd", "comment": "Malware payload (Mirai)", "value": "1778f01c4c7591e65e91f9ce9d18485880da8d6ae6640e25c1f7f90f945b2939", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763795601, "uuid": "98e83158-1077-48ce-8721-544f5bd2f532", "comment": "Malware payload (Mirai)", "value": "f112dbae14340c8fc36bc95705087a61efa30e7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763795601, "uuid": "12ca3a21-49cd-4b36-9a7c-b7fae0d2a876", "comment": "Malware payload (Mirai)", "value": "7711a9ecc61b6409e8cd128cbdf2330ac8468d3a7e52fff5ac964f93cbbd15206545ca6a4669bb7b824728cfca865486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763795601, "uuid": "8949b4fd-8fdc-423a-b548-b58b19d302da", "value": "T11E934C56BD81DA12C5C16677FB1E828C3B2753F8D3FA32078D215F61738A56A0E3B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763795601, "uuid": "77916e3d-ecae-4d51-9674-275bf8d0bcd9", "value": "1536:9MfkbC/2r/gkOeIQ6wCqdEv7C2LXBc9c56Zd8emI:9Mfkr/gkOqezC2eco9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763795601, "uuid": "3d32ed54-8704-4471-b549-4699d9464e70", "value": 91896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763795601, "uuid": "2891c459-56f8-4286-a8a2-5bf53db59c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763795601, "uuid": "52ea3130-b8f9-4baa-9913-72d3f35f9bdf", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dc26c6-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855325, "uuid": "c6478746-676f-4860-a375-f1d9df23cc9f", "comment": "Malware payload (Mirai)", "value": "289abbc0db007d1769a584f4680915a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855325, "uuid": "d40ccc08-737e-4738-a224-1d9a0a508254", "comment": "Malware payload (Mirai)", "value": "177bf81579972b2bc5ee92be2821e236f8371b29fbef18211a9a3f6f7de5005c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855325, "uuid": "bcbc41aa-0e35-4d24-b67f-d84bf7480e7a", "comment": "Malware payload (Mirai)", "value": "a25a4ae69e46a4b000aa499d92565e90db04ae13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855325, "uuid": "ebadba57-499a-494f-9f78-fa7b6b8c4674", "comment": "Malware payload (Mirai)", "value": "3b70a8102020d8bdd9000f0d6cde681e4c76907abb77d3793e45b2c6bb14c55759bae89843e9d52ff5bf261e7be90c1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855325, "uuid": "10c78dd0-0fe4-4bc6-b593-8c5a73157550", "value": "T11203F1B5C07FDE05F6A812779CEC7E481499800DBD8BA22453D0F33B97D9F851909B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855325, "uuid": "2790fb5f-ecf3-4976-965c-bfdc663f7757", "value": "768:4k8SXZQoydUhRTMq8atkB7EcbPNOfoy3X/z+yo1U5nbcuyD7UHQRjA:4SPy0Rvk7NbFaoy3Pziwnouy8HyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855325, "uuid": "7ff63b01-8063-4d28-b6de-48e861820837", "value": 40528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855325, "uuid": "2d1a5b8c-ff48-49f6-aa6a-a1bd2a8efe3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855325, "uuid": "4ba7f708-8c20-46ac-beca-b3c301e4ca83", "value": "Labelloperc80.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab0317d-c757-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763783764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783764, "uuid": "6f2ee7bf-e2cb-44e6-91a6-90e2820e4585", "comment": "Malware payload (Mirai)", "value": "d1c47ca07b002ccbe2832927b770cc92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783764, "uuid": "0357576d-60a8-4866-81d4-3b2363570cd3", "comment": "Malware payload (Mirai)", "value": "17f0330f89e0034caf2a3364212e3a4f76578e505e4f46ffdbebe252abcf9076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783764, "uuid": "8caa0ed6-f20a-41d4-b989-67ba040a6766", "comment": "Malware payload (Mirai)", "value": "71595c38696aca547d7c26d02386ec6a2684c23b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783764, "uuid": "272fa3b5-d542-4e55-b088-8c9bd7b8b82a", "comment": "Malware payload (Mirai)", "value": "2751d0862a564b53aeaf9a4d999c52d5678670273e1eb1452c1581033b015f3791e5187a75c3a31cb0a840a9f196f267", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783764, "uuid": "78fc9e28-e690-40b7-ad88-aeb707edf0ef", "value": "T12AD3BF31F02A6CB5CD5103B83876867C5701DEF406E51283EFAEE5AE1877D94BDADA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783764, "uuid": "9ac3a0a5-9494-41f9-bf13-dd6a9e3d464a", "value": "3072:eriKR9nXVbM8EaOkymHetUAQqGpYTy5omKGZz:ervbVbMvaIweto7eu5o5cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763783764, "uuid": "9e197d28-5c23-4629-9579-324b2532eaf9", "value": 131700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763783764, "uuid": "3c4f753d-cce1-477b-a308-435211111ce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783764, "uuid": "fe59ab88-4f45-40c5-b5b9-847fb63834ed", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09772c39-c7b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763825369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825369, "uuid": "a03128ba-b59c-4792-949c-6c6690337cc0", "comment": "Malware payload (Mirai)", "value": "4de5f223d13a55f5a9d3a9a9f50897a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825369, "uuid": "bcc05ee1-5849-4ce7-858b-2100f2d56dc4", "comment": "Malware payload (Mirai)", "value": "17f681b5a89d939e472b541962854ed6850562e21d7ee341e8726243e385b8e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825369, "uuid": "1dedc4d8-ecb6-4a52-b74e-578e96eab236", "comment": "Malware payload (Mirai)", "value": "42706375ee62041f65bac0fd8662042cd7c0439b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825369, "uuid": "7b82bc03-ab8c-413e-ab54-ee120a7a7260", "comment": "Malware payload (Mirai)", "value": "f12d04c39c0a9d3b4e266df1e303a4975a42ac849b2ef33c9a4c0622deb0d55da88f05df090283b49fd595fecace861f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825369, "uuid": "7e3118eb-1959-4915-a8de-f19856159862", "value": "T157145A12FB0C0463CA931CF04E3F0BFAA3621A9104F59111651C7F5E6A36D77A68BBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825369, "uuid": "94dd9b5f-45ef-4d4d-a8a5-e65623724735", "value": "3072:OgjbPSs1m5uUpW8RV8riiDFySo7i6MBz3VUrlqZk6p0cgpdrUaz:OgjbPSpuFiiZtCdMBzw4LWcyqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763825369, "uuid": "58f64cae-f765-417d-824f-e19480e1a786", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763825369, "uuid": "613eae39-68bf-4c60-9c81-d8b25a4d949d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825369, "uuid": "9ec265d6-2b56-4bd7-8d86-42294d2c6312", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4841d3-c7b4-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763823659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823659, "uuid": "36a995a4-1823-45f5-ba2b-d8a8914fafb5", "comment": "Malware payload (CoinMiner)", "value": "68a5e7fbc71cc498f7b998a8f8ae57f3", "object_relation": "md5", "Tag": [ { "name": "95-217-39-238", "colour": "#045555", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823659, "uuid": "726328c4-01a1-4a6a-9a79-16c6472eefe4", "comment": "Malware payload (CoinMiner)", "value": "17ffce435bf3055bdc807b0b062281493e136f02e8b14d85e3fd6b6c3098088e", "object_relation": "sha256", "Tag": [ { "name": "95-217-39-238", "colour": "#045555", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823659, "uuid": "920e5fdc-90a4-410d-b8da-07460982f015", "comment": "Malware payload (CoinMiner)", "value": "32469af4edfcc52ab441af0e74370eceafa3d351", "object_relation": "sha1", "Tag": [ { "name": "95-217-39-238", "colour": "#045555", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823659, "uuid": "2357d282-709a-4ca8-8816-8200c5cac23b", "comment": "Malware payload (CoinMiner)", "value": "1a6b4d0af6de9f8e96465bb26e36d1e2d0aa3e5a72f17e9576a54c06f377db073671d3c605e9a1d42592f512c0df026b", "object_relation": "sha3-384", "Tag": [ { "name": "95-217-39-238", "colour": "#045555", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823659, "uuid": "d58e9474-c2e0-4d85-82ea-26c0124b2084", "value": "T145E1861EA3296267A6C32225E59759822C974037020A5D24B9FCC2C1AF52B78CBDE7D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823659, "uuid": "a66c32b3-10de-4a18-8a1a-3b0f0401c596", "value": "192:2O/Y6oJvCXepyP4C0JuzyiqcavJX5yAuySCyiKwVVL:SvuP+vzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763823659, "uuid": "31ad628f-47fa-4e4c-ae25-53a764697fbd", "value": 6889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763823659, "uuid": "6a15b248-31d9-4866-b66b-9e0ad2c75ac0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823659, "uuid": "7a616816-fe31-458c-a582-319d85cb03c9", "value": "ooewqi.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04cc862-c7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852358, "uuid": "8915eb9e-74f8-4a43-9850-3753c787ac39", "comment": "Malware payload", "value": "bfc168a01a2b0f3cd11bf4bccd5e84a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852358, "uuid": "36e7a7a5-97fa-4d50-aa73-c0648af51d51", "comment": "Malware payload", "value": "186aa2c281ca7bb699ce0b48240b7559a9ac5b0ba260fb78b81ec53249548f62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852358, "uuid": "5d353baf-4e8e-4e6b-922b-a911e6101f5e", "comment": "Malware payload", "value": "d06c969bfadb064768937ba2f0f26c16b792616c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852358, "uuid": "12aedb93-fb85-45a9-ba5b-931fcefc2695", "comment": "Malware payload", "value": "fad5e0bc4e8a44988b870cf825db63c1a3e9f0058035db02e70b77734453aa28279ad86b5fb8509a2c751c094d4595c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852358, "uuid": "506739f9-ca55-47e6-9768-179ae9dcfca3", "value": "T152927C0AAB748813DF5B8FBAF0E68A1286B0F7435DE8C5E7614D825E0E017502FD667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852358, "uuid": "e94c71f9-dde2-47c0-85ee-b29d4c6d0efd", "value": "384:gKql6Ruv9Cu7E740VA+v/uo6ki23mbiqKOGcjSJIVE8E9VF0Nyp/:zOLNALOlr2JJ2ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852358, "uuid": "d388b2f1-fba7-41b0-904e-7c1ed626c78c", "value": 20776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852358, "uuid": "e6f931f8-2347-40d1-aa81-d69982cbac81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852358, "uuid": "0eb46bf3-8cf1-4e75-8128-aa26e2f2b190", "value": "PDFSkills.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcb7ce5-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855468, "uuid": "3e0eb4dc-2079-401d-bfdc-27fceac61494", "comment": "Malware payload", "value": "3cf25224ca5d0823bbe3e099aba6a9c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855468, "uuid": "e868e849-11c1-4289-8686-de86f248b5fb", "comment": "Malware payload", "value": "187d872150e5e0379b9924a02c7af97487c912e23c8ee6327ad2dab6ebd27244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855468, "uuid": "a3118aac-1b44-4f11-b65c-a665b097e4df", "comment": "Malware payload", "value": "6a3de6b3b13282f370f98aa4d008cda32d87d2da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855468, "uuid": "1a1f7b82-f6a1-449d-ad7a-cb9929e0c3da", "comment": "Malware payload", "value": "65b577a68d282d9e39cd1b9ae150d4c4e8a829a6f053ad77f452342da797a8fd35b73b7a44af01dd374e6ad12a6580d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855468, "uuid": "c99bc470-98ac-420c-aca8-3f29d2de2931", "value": "T181E55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855468, "uuid": "6deabfb0-565d-4c16-8f7d-45d82aadba5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855468, "uuid": "66740c08-3af1-4630-b645-f0868249f7d5", "value": "49152:6vht62XlaSFNWPjljiFa2RoUYI2jxNESEqk/iyLoGd9VTHHB72eh2NT:6vL62XlaSFNWPjljiFXRoUYIOxd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855468, "uuid": "810d334b-370a-40db-a55a-47cca3337373", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855468, "uuid": "7452c8ac-e0cd-4a0b-b56f-77990ce70d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855468, "uuid": "81877059-7a88-4902-9c8a-32c0568d5612", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac37b14-c7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763815493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815493, "uuid": "7885ce85-059c-4e76-b435-8adb75ddbffd", "comment": "Malware payload (Mirai)", "value": "e2999a4a6ba73f4f45b6cbe9a6c2b01a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815493, "uuid": "bad0c8bd-6eb6-436f-affe-4e6831784d6a", "comment": "Malware payload (Mirai)", "value": "18bfbebcc34ceb3ed9c3cca7c56d54d387dbed47db471bdc2f0a7f4d41816e70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815493, "uuid": "ff279b6c-88a6-475e-ac00-9104ff95628d", "comment": "Malware payload (Mirai)", "value": "bb4e1aad305e5dd1e1ffb5b7a72f1712256d48c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815493, "uuid": "66b97a32-7e23-4ed5-84c3-052c40e2425f", "comment": "Malware payload (Mirai)", "value": "5b245d3613e410cbb67aa43ffdc5766e2f6d438d156054101ed8eb371f7691c420429b22df8177db762ff43fae370a92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763815493, "uuid": "ed776e1d-aa38-4c9c-9b26-73c1a619f188", "value": "T1B5731781F98780FAE417947099ABB33FC631D9644132EB5AFF559F7EEA13A01161238C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763815493, "uuid": "2c991b48-b849-4cef-b471-dca075110f05", "value": "1536:0y/OUtw48DhCL9FRcYHPcjrAp+kWosSthPW41MWPxAvk0SzVV6:bOm/3XSQKAskWosGk4GWKvlqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763815493, "uuid": "9f4336ab-ba44-4e97-9abd-753b67e979c6", "value": 75008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763815493, "uuid": "46aa96fa-3d8f-4ee4-8c9e-0a54d24e5c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763815493, "uuid": "0f3d50d6-ff01-4dfd-83d8-7187d52c6a87", "value": "ui686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f27b14-c7cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763834549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834549, "uuid": "15ed9d9b-9733-41ef-a2b5-ce2a1050c783", "comment": "Malware payload (Mirai)", "value": "246d12820b8cd9cb5fe24f970fbae207", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834549, "uuid": "00fb328a-33b3-44bb-9f97-ed5765b71ca1", "comment": "Malware payload (Mirai)", "value": "18c0f6aef5b206ff6aae35d302d210dc3cb58ead173861d7847ad4cb884b43dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834549, "uuid": "2bcf8217-5118-47aa-aa68-57ebb597ba17", "comment": "Malware payload (Mirai)", "value": "369d8af4e74719be53d9507e135f857bf187a800", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834549, "uuid": "a655e64a-c8b0-4318-b43e-592ec4f2080a", "comment": "Malware payload (Mirai)", "value": "7b66ca9bf81997d6eee8f2ddb694d8a4c06311ac39967ce0087d03a5e0209a6fd8b28334c56807e2c2ca4ee6c0ffd46c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834549, "uuid": "1358d57e-dced-4234-b15e-d41ec29f5cb6", "value": "T184048C02F642C1F2E18301B26157C7655B30D932032ACE07FB996E75BE722099E5B7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834549, "uuid": "b5fade48-a4b7-4019-9268-8a8e971942cd", "value": "3072:FXo+vQjvQKc6cNiorsaZZJLuwSKopvTM9QlHuPPojxmXx:FXRqIKc9dSwSKf9UOPw1mXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763834549, "uuid": "1861d9c0-7dca-4a21-84d9-441726e8f7ca", "value": 183560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763834549, "uuid": "19ae66a5-3b2b-4fe8-b3dd-04c9efbf8b03", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834549, "uuid": "1db3d3c2-a049-40a6-9bdb-338fd8ce27a9", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a49df6-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855374, "uuid": "3a82f2b0-c5fd-449b-acf6-1998511034d4", "comment": "Malware payload (Mirai)", "value": "d2ae93dce2736d88bb545a8604344d44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855374, "uuid": "8c595435-f62a-419a-af19-2980466489a0", "comment": "Malware payload (Mirai)", "value": "198b149362614523d5459063029ed1121818715c34deeb1c4da7ffeed6acb330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855374, "uuid": "74a200e8-fee2-4a10-8d70-db5e7c4f80dc", "comment": "Malware payload (Mirai)", "value": "9a402bc4c8a9cd727d83e8b11b4bab019b3c62b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855374, "uuid": "1e04728d-3376-4ee0-9d5e-0a04b1dcca4e", "comment": "Malware payload (Mirai)", "value": "5d79794493c293c82551e36230570be121bdd71d7f370fd84dbd2d46d2490500c412644ca8864df860c0be1090060b13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855374, "uuid": "425d8b6e-fbe9-42e7-bd4f-2bb26df2e032", "value": "T15C042B46EB414A13C4D227B6BA9B424533239B64D3EB730699287FF43F87B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855374, "uuid": "356ad343-1c30-455b-a0cf-cddac3909a13", "value": "3072:npoGm6qQbztpa1g5rvJ1/IR0JLEoQ8pnPkXS7SpbWM/93v0OU:poGphpaW5rvJ140JLNpPki7SpqM/9cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855374, "uuid": "7b4af82f-7da4-4612-ab79-21474b825dcf", "value": 177811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855374, "uuid": "b32fa71f-afa7-4659-95c5-51a2c036d6ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855374, "uuid": "96764003-4bbc-47ec-ab1a-5ce745d6b0c1", "value": "Labelloperc80.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efb2198-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855470, "uuid": "42b35217-f56e-4618-ab36-21112a618954", "comment": "Malware payload", "value": "7d9f449ed52c9b4a78189f196c992ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855470, "uuid": "86bd56f6-a183-483f-8686-29a02bd22c4c", "comment": "Malware payload", "value": "19b3c4c8edc617a014e8ea1aae66205a902e216e401db4a42eb1a1602749602c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855470, "uuid": "489d4671-86a7-4218-9a3d-06e585de6288", "comment": "Malware payload", "value": "b6c62a42f12fe4d4a081e9356c0170be425db306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855470, "uuid": "d834f0ed-ac00-4810-87c0-db457f92ed6c", "comment": "Malware payload", "value": "f142249d338023aa49fe1d0d00c8bcf7e5b3b890efc181d26d097fcaca11f8c8c59afc63652b44e38e7434b329a28df1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855470, "uuid": "e672e851-ba6d-4265-b078-8de25a6b9550", "value": "T18CE549043BF85E22E1BBE27395F0041267F0FC6AF3A3EB0B6591667E1C53B5059426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855470, "uuid": "7d28adaf-c73c-4a2a-ad26-e68637fe0043", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855470, "uuid": "74017f4c-0ff8-447f-b8a4-5967d0fd8ceb", "value": "49152:Tv2A62jiaQDKwPFlJn3xFQsZQOznQwjhNYoGd2THHB72eh2NT:Tvn62jiaQDKwPFlJn3TQsZQOznQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855470, "uuid": "d214c4b3-f0d7-43ee-bcf1-e2491b1104aa", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855470, "uuid": "51bb3d3d-cbae-491a-8f89-3dab9666621e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855470, "uuid": "4ac6a000-832b-4b78-84e6-91e4f3ec43d9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdfc50b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855471, "uuid": "8990ec2e-1062-40a8-8fda-6d8c359d7053", "comment": "Malware payload", "value": "b6b6bc68ffa4e3ec4129adabd8bdd236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855471, "uuid": "d5b3923d-ef86-4bc3-8517-3c1c5f7652f8", "comment": "Malware payload", "value": "1a0e5248c81ae88a46aed16a5ffc87f5089070c57de9e3f8c5440cf566a9c36f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855471, "uuid": "eb00e5a9-d452-4664-b900-cda6a961493d", "comment": "Malware payload", "value": "5a03f0ac3878d556b2bc8874d35a0291a3e7ff31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855471, "uuid": "9d3088ae-0c1d-4053-bcdb-1b76111cb3ae", "comment": "Malware payload", "value": "fb1f68574a121f3b615e9baa32e55f3fcccc0f0ac81f4a9cdb484474316fabc49d7999e830c4b39cb7ba9bcb30c26c63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855471, "uuid": "2f56d8e0-0d73-4a56-9fdb-8d0eca1bc80e", "value": "T1E495F150B3F9810AF0FF2FBAA8B615460B37B952DA3AD70F088C509D1EA77419E51763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855471, "uuid": "181d671d-d1fd-4152-ac63-7ca23dfd7f27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855471, "uuid": "9ab19380-488c-42fd-be66-172236865ee9", "value": "49152:LwOiT5dQHMMJaWs01/HJx4chx5sUDr7tJqh0F1:L6T5PWB1/HphoErRJqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855471, "uuid": "2f8d5772-e03b-4e74-acb8-2f3ba1388583", "value": 2016768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855471, "uuid": "f531c16e-52da-43e1-8dde-f5735b82e601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855471, "uuid": "554045b0-302f-4f9e-8f69-7bf4282ed82e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20952310-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855473, "uuid": "1f02144f-d5fa-4b87-bfc6-c75eb26d9ea3", "comment": "Malware payload (QuasarRAT)", "value": "bb66cca187daceec6f2d6e7ca35e6600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855473, "uuid": "e80cffdd-59a7-4482-b90c-8607a450c099", "comment": "Malware payload (QuasarRAT)", "value": "1ac6fa42e15054e4c70bc9c968628c5faf604cd5a524b59b1fbab1408836683d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855473, "uuid": "44010b76-2b2b-49aa-81ab-3c1501f56c8a", "comment": "Malware payload (QuasarRAT)", "value": "6f6814470bde8826890431a7cb80954184ebb295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855473, "uuid": "702fa7c9-6cfa-4710-9995-44f04dfe3b33", "comment": "Malware payload (QuasarRAT)", "value": "7ccb85fb23b201e61bad9b92c97b305a9f4a43ec8344139e557534fecfd0616c831381eae0db117c8f296de33cbc9878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855473, "uuid": "b8a392dd-0495-4e55-b753-9bc45be1f71e", "value": "T19CD34A1533E8CE1BE2FE5FB9E87461110372EA17E672D78D9D8820ED1A62781D1913B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855473, "uuid": "f8c845da-d29a-4e25-8100-14b5e98f5b41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855473, "uuid": "001a7618-d494-416e-b59b-cf64fa5b315a", "value": "3072:0UfPXZsa5dNC7J7M1SQ+HBCiZpbVPmp6GNTsdfhB5m:lxsafIM1SjZpbVXfPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855473, "uuid": "8d3d1f22-fc93-4256-8bb7-f47f8de7205d", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855473, "uuid": "f8577c3b-8776-4283-b475-8b35dc716e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855473, "uuid": "f981ff51-631b-458f-b142-52a738db03cc", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefffcb9-c75e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763787126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787126, "uuid": "8898560f-b866-422f-9481-4d72a8a6a2f5", "comment": "Malware payload (Mirai)", "value": "4b84a9f7a9853befa5431b08c3b4ed5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787126, "uuid": "e3a9fb68-e45f-4562-b8c2-d0790e974540", "comment": "Malware payload (Mirai)", "value": "1ad84d926661ccdf6b79467436011b6008f374afadf272bcc0c8efbea63babe6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787126, "uuid": "21737979-9e60-405e-a0ae-0a2b4c41a3c9", "comment": "Malware payload (Mirai)", "value": "7370195b77632318104d28eee543a6fac06487e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787126, "uuid": "07c93207-33b9-44ff-86e1-3c4d9c4897ec", "comment": "Malware payload (Mirai)", "value": "2fdceae26995d36b66cecd5655fe8e8838f544bdeb00bdc569f5ffce0bd1f15aa485ebc18205514df635df9444fd322c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787126, "uuid": "8f2a4395-446e-4ac7-9f54-7579577ae50f", "value": "T1D7C312F89E5B04B8FEA88D6B00430CBBB8C29526D41C4D695F41DE6BAF1D8396D6B350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787126, "uuid": "e77cbc39-dce2-4e09-945f-0f61da384f58", "value": "3072:Y3t/S6SiD6TzdD+VNzc4aH3f7JgX26OGd4VBHWQ:iBlDEF+s1vym6Ld4VBHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763787126, "uuid": "1dad2363-6034-4688-bb91-20ee62cf7c60", "value": 122480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763787126, "uuid": "dc639c86-03c8-4273-9230-a12d6216fe1c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787126, "uuid": "5964f073-9c3d-46a9-bd31-e65207a54d4b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2161e34c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855474, "uuid": "bb71f77d-0471-43fc-aa10-3f970a2b285c", "comment": "Malware payload", "value": "04efae3fc258dc73f6239482a701dcaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855474, "uuid": "8f22dbfc-3ba5-4982-8eb7-ebd7eededcb5", "comment": "Malware payload", "value": "1bc6f9f67da98cc9f85b7f4104b13c54dea68ce07b9b0b679fafee59f39257c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855474, "uuid": "21737f44-fb9e-40e2-a266-fe5b0cba869a", "comment": "Malware payload", "value": "d7b16d90fb82ef9ee99b79e73cfd66443abdc3e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855474, "uuid": "126441f4-c8f9-409c-a1ae-fae0cf49b378", "comment": "Malware payload", "value": "a7ad0a4868fb5086599c8b340034716a80fa25331c47112138d3a80b2b401fae22b485b3eec737bfb84c0534c24da961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855474, "uuid": "98252a15-3ead-4872-abc5-413bbd62dac1", "value": "T100E56B1437F85E32E16BD6B3E5B0511263F1F82AF363EB0B6181677E1C93B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855474, "uuid": "08e7205b-2ea2-4773-a8da-b4f8ba36df3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855474, "uuid": "6c3b1cce-1efe-4b9c-bcbe-c212b2f5e072", "value": "49152:8vAt62XlaSFNWPjljiFa2RoUYIcnYK8lwoGdW0+rTHHB72eh2NT:8vs62XlaSFNWPjljiFXRoUYIUYK8Wm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855474, "uuid": "d01248fb-ff49-4b1f-8dd3-aaaefb04d6c5", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855474, "uuid": "95bcdb65-b7c7-454d-a775-c619a32c648c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855474, "uuid": "31c0fcb2-470a-483a-a783-ea0e9d0d1ef3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222cd801-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855475, "uuid": "9d515dbc-9064-4fa9-8c4b-dd7484f81e7f", "comment": "Malware payload", "value": "d79c0edba38e80603c5947a94e02c453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855475, "uuid": "2364e1c1-a258-4f7e-ba96-33e601f64c44", "comment": "Malware payload", "value": "1bcbdbb1981bdbcdf6a2871199996c80466c7fc0cc0770733bbdcdf4050bf577", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855475, "uuid": "cae16070-3b94-4a88-9a1d-f668d1a6c46a", "comment": "Malware payload", "value": "14ac1b6af88cc9ee35b20d2cdd2730d043297517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855475, "uuid": "2d88a605-0e42-4241-92c0-0a3db93aa878", "comment": "Malware payload", "value": "f245e2680293ce4ff93134490cb7c01fa311017a132cf6f0bb7e8765be2d9c735b0184d5be5245010ef62c7f6cc7f21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855475, "uuid": "965ca202-bc11-40eb-8911-cba39cd83797", "value": "T1F5B47D4027F8952BE1AF57B9E87114209BF5F807B267EB4F4540B2FA2C66B069D80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855475, "uuid": "e8a2861f-134d-47a5-b7f3-c56f45364e62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855475, "uuid": "33cbdbb3-33bc-49da-8755-dacc14957957", "value": "6144:STEgdc0YNX7IxUpGREWve13+7LOUs6f6YMZlfdwcEysb8F92tw+gcTR3O:STEgdfYWxUkQ61yeC3gtLgcdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855475, "uuid": "95f04b11-9b1e-4111-964b-75d78e0fe040", "value": 532492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855475, "uuid": "8bbfbb52-bc40-4b70-984a-3fb1e58c2a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855475, "uuid": "0fbfad4f-ea6c-42d9-abca-4e8cba713bc7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaf3c51-c77a-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763799014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763799014, "uuid": "d6bb778d-5aa7-4e68-8a9e-959ef474aa21", "comment": "Malware payload (ValleyRAT)", "value": "bb18bc152466a6624a04e5585fba7576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763799014, "uuid": "f5ae620a-8d30-4398-9afe-41d296c11f64", "comment": "Malware payload (ValleyRAT)", "value": "1c13d97c82f855e301559ff69b8d60b27181f7365e3ce6ca984a72a01be34421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763799014, "uuid": "0f152068-818a-47d0-99ba-63c09a45cc20", "comment": "Malware payload (ValleyRAT)", "value": "1929d334872a5c9fe5c0a3507ceb89e6d8f24355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763799014, "uuid": "0d99ba5d-4f66-43d2-8b82-9f1797a528f5", "comment": "Malware payload (ValleyRAT)", "value": "03b3599f55eef90258499468b8690ee6b9c1ff2bf0fe59c4dbd066feab92641bd40cb05e531171a3eb4725cb741d5395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763799014, "uuid": "bbdaea7e-a323-4eab-a13c-b595989c6a73", "value": "T1C06633037A8094B0C513463316B45722673E3E101FE789EF4B64EE6CBE399D197367AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763799014, "uuid": "63eb6b4b-ca5d-4616-b25a-e0c6d457b196", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763799014, "uuid": "b26da52e-f384-4367-9865-de86f0686ec2", "value": "98304:bsS73zIYSFp7PBkCOo8CetzQS/EGwQLVaGghKiGsqPdPobpG+MtGbeToG+OmseiH:7jzIvvPBrA1BsGweWhgs207m4z7MMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763799014, "uuid": "04944f17-9294-4df1-82db-485dbd1b26bd", "value": 6967860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763799014, "uuid": "cb8178b3-d4b5-492a-acfd-4f5b0939ac51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763799014, "uuid": "b723bcec-8a6f-4031-a8d0-f181e9cb82ec", "value": "1c13d97c82f855e301559ff69b8d60b27181f7365e3ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2304d444-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855477, "uuid": "819dc3cd-2213-47fb-924c-2e1b41ed509b", "comment": "Malware payload", "value": "73220aaec650d89ad624c785f6be15b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855477, "uuid": "1ba834f1-0fb1-40db-bc4a-53d9f04ae8fe", "comment": "Malware payload", "value": "1c351beed964de0b168e06b559870bd206ad5e3473d80ed1411b63337eb4eb97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855477, "uuid": "4f729cba-8e39-4738-810f-bf4daf8f94e6", "comment": "Malware payload", "value": "bd47170fa75cd0c5eec86ef44f45e479211f0779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855477, "uuid": "91da3584-89b2-4bc6-b0d1-4b61eb4a16d7", "comment": "Malware payload", "value": "6e5e136b7bd7fa3e5f8299f4fd17ed74d9e80d96ed00c3c7cf3d2d6ee01c1c61eb6df883ca0cbe77dd1f7a48b01c3321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855477, "uuid": "19b9de54-045c-40bb-a6d9-2d2a8abbc5d6", "value": "T183E55B1437F85E33E16AD673D9B05016A7F0F82AF363EB1B518267BA1C53B508C41AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855477, "uuid": "89d8255d-55d7-408b-a4f5-683ae9540f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855477, "uuid": "62bf1e4e-ce40-4cce-a655-4f38cf2fd834", "value": "49152:PvTe821/aQWl8P0lSk3aKA3Z+nSr+STLoG5STHHB72eh2NT:Pvy821/aQWl8P0lSk3DA3Z+nSr+Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855477, "uuid": "16bf51d5-ba62-421d-9b3f-d113bb3d7732", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855477, "uuid": "6edfd825-90bc-4202-ac47-945a5a204058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855477, "uuid": "e1f3f1ec-6b3c-48dc-aeef-2bf8b014f033", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cb32d3-c7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852361, "uuid": "1ef977d5-120b-4ff4-b38c-51c11ed11956", "comment": "Malware payload", "value": "e09de6ac499ebf7cb11c6ed1721dcb04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852361, "uuid": "5dce8f7e-8c84-43bf-a56a-9640d2ff75f5", "comment": "Malware payload", "value": "1c359c389129097bfcf8fe7a4cde1c20686b76f12a9a095667b85c3c02030006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852361, "uuid": "8f27a79b-64d5-4f08-8844-64f84af2fd9c", "comment": "Malware payload", "value": "51e8d1570f43986ad10f4f56ad74a7f8b81a4e18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852361, "uuid": "f8478fdc-a707-4fa7-b696-4426c9e0fed1", "comment": "Malware payload", "value": "7ec0bd38b5020094de3703cdd55993fdbfe01287f8435f6ed964055f7dd928557658199f8054877b2caf7b7086d870ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852361, "uuid": "d76c56a9-d903-49bf-bf51-e5c40d8b554f", "value": "T1CF547DE332664852F2AB4EF9D19BBB31473457831163DA8616B1189D0892F41BFD23BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852361, "uuid": "372211a1-39e7-4c24-ac99-f8213c78a446", "value": "1536:o2G7KH9P5dNJ1yU+VqY9lf2CGID5FBf5UNs1fOR14:0KNmeu5TfpOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852361, "uuid": "f18b1680-6145-4757-a61d-ca9e59e58a16", "value": 282328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852361, "uuid": "909739da-9fe4-4826-b47e-a23b94a3a6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852361, "uuid": "c11a4865-df9b-4648-b548-fc2051c2ba71", "value": "PDFSkills.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c3dfbd-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855478, "uuid": "dbe75b11-b0c7-423c-9851-ca5d461e5cb8", "comment": "Malware payload (QuasarRAT)", "value": "37919c316ce58dac12ac2f2934a22bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855478, "uuid": "bef0f9a8-7b26-432e-a1e0-afc5e2135b49", "comment": "Malware payload (QuasarRAT)", "value": "1c54d9e938071a6c9b00d29704076f70d28a81102b7146a5d087f05e6bbc735f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855478, "uuid": "76cfb4ae-f66b-4707-a63d-3ba6d0c05250", "comment": "Malware payload (QuasarRAT)", "value": "a96837aae0b222d462df875a6111eefc19e1c196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855478, "uuid": "4567b07e-5ea5-4449-8d67-28de4fb5404c", "comment": "Malware payload (QuasarRAT)", "value": "2e20ba5231bfcb44c919662eb7174bd2a5b6b1d3e78cdea4146bd4d53c9504375273e60edeaad2cb811877304f7fbae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855478, "uuid": "e1e4aed7-5b08-4d75-a0ae-059a6bc41a34", "value": "T17D748D2337A4D53BD6FD173AF43206154BB0DA87B626E38B5A5C46B96C133868D903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855478, "uuid": "feab6d38-2805-4743-892a-1f78277c2b23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855478, "uuid": "393b3476-e416-4b4e-9ac1-ab7102586b3d", "value": "6144:+2NHXf500Mc45rwSgJstobsZD8O2f9w0cuE7yO:1d50v5gJ4e3w0cuE2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855478, "uuid": "9f3a692e-ebc4-4dc2-904c-384da97c2433", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855478, "uuid": "70f393b4-e2e5-4767-a9b9-b6ea4cde6554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855478, "uuid": "104b3d6e-491e-485c-88f2-36ef688f0a0c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cafcb7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855480, "uuid": "f3502b62-141e-432e-95df-7390281b3faf", "comment": "Malware payload (QuasarRAT)", "value": "f0ef78c500d20a5e05d4e9ed45d99b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855480, "uuid": "2604b5df-808e-429b-895f-be4ad42bb48d", "comment": "Malware payload (QuasarRAT)", "value": "1c6892eb0fd0c5130787b9634c712249a5ef0843fbf329d8cf4bd5a9b6caf7f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855480, "uuid": "0cd94fe4-bb9c-4e98-8254-e4da96bb47a4", "comment": "Malware payload (QuasarRAT)", "value": "dead7408e9e84f9abaeda6e3486c6f3589f683b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855480, "uuid": "b4b87c98-820d-4bac-b7d5-d85125d703ff", "comment": "Malware payload (QuasarRAT)", "value": "a7508e1a820432a936381b9e0020cc5f153533aeb7def3b6d3bcb53ea52cdf3d8b9b3d7103e3039b267e7f535f145eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855480, "uuid": "0c471cef-1b57-45ba-bdf5-c01199967c2a", "value": "T1F0D6D0A07606E6DFC16B0AB4E4D2CA03D5B897B5C322E703DC15743E5E53F5286C2B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855480, "uuid": "5efa1e06-314c-41af-a13b-7f972b6490f1", "value": "2d36b7f7f6f122ecc6850b4840bc4dbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855480, "uuid": "9b6e5ff7-8bea-42ff-998e-7e1774d5f889", "value": "98304:Ev/22SsaNYfdPBldt6+dBcjHp00KFtyh++/amzJNOWJFpmLtVt+Xw5k8iILd+ffg:Sw7j1KaQtXx5lAnfD59W2qEzIIftto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855480, "uuid": "fc092a4a-e074-44ec-ad46-4fcf7f8282e2", "value": 12818075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855480, "uuid": "cdfce583-2a23-47bc-9f61-f1e725b4c016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855480, "uuid": "5e22894c-ccde-41b4-bb5d-e71cbeb9227a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2596c2c1-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855481, "uuid": "5550d58c-ebda-46df-84ef-727f0da8d36f", "comment": "Malware payload", "value": "fcc0449f00e19aba6e6b267148a62fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855481, "uuid": "a704f996-c617-442a-80a9-5080447a0ce3", "comment": "Malware payload", "value": "1c85cf067837ff28328c84574ba6662ae2a3f90ec9a83a44d1c9e7f960eebeab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855481, "uuid": "b3c21d9d-1e42-462d-a58b-5622d7f6e172", "comment": "Malware payload", "value": "ea2d2545825a9139b9c7f4cbf39d7245150bda9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855481, "uuid": "cf48ac5b-499c-4432-9f5e-23a05048f4b7", "comment": "Malware payload", "value": "d4b0dcdf832de5d09ccd40090563c4915dd8163840433e319d5978cd7578820b67d44614c8470d25d5e0a012fdb46d3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855481, "uuid": "a81afab9-3323-41af-a602-30b167c6604a", "value": "T112F56A143BF85E32E16BE6B3D5B0501663F1F82AF363EB1B6181667E1C53B405C426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855481, "uuid": "cae41650-de85-48ad-80be-e4d6db32053c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855481, "uuid": "880ca51d-f951-4248-9bc2-1879742978b8", "value": "49152:qvXG42pda6D+/PjlLOlg6yQipVoBdYZhmvJrNoGd2THHB72eh2NTcD:qv242pda6D+/PjlLOlZyQipVBhi0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855481, "uuid": "a628c5ba-8ee1-4ed3-975b-bc6fdacabdd7", "value": 3383308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855481, "uuid": "a6b3654b-d8ca-47a4-8e5f-c681f7d05f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855481, "uuid": "b514aea2-0663-4509-bae6-7302aa6fa684", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266de24d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855482, "uuid": "3335077a-aaf6-46a5-aebd-64a380d85637", "comment": "Malware payload", "value": "9b3c68fe75155993b6864d85ac10e54e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855482, "uuid": "e0bbf631-4393-42f6-b4ad-3feb00a84ec4", "comment": "Malware payload", "value": "1c8bc9936392c4c6b132bde3dd88d25c6e499c7d258fdd69ea86b21031e06fdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855482, "uuid": "b1bb36c4-5f59-4d1e-975b-1b137489575e", "comment": "Malware payload", "value": "b7d14fa756d8fd61b461aba41a584d1e31d7aa4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855482, "uuid": "7ac7af1e-7129-43eb-ac34-8e5fa132ec7f", "comment": "Malware payload", "value": "42c6a1a6d4eeac99f2bbd56be43130a9f421f22ac2bd3c21a538279e764f94df12c96f29072753de2eb58dadd61a74d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855482, "uuid": "a0487bad-1763-49bc-86d8-dcd8c5daa700", "value": "T12DE54A1477F85E23E1ABE273D5B0401267F0FC2AB3A3FB5B6191677A1C53B405842AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855482, "uuid": "e4705040-070a-4eae-885d-25595d28d4f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855482, "uuid": "69d4661c-4331-4789-9bd7-3576e90b4ae5", "value": "49152:bv2I22SsaNYfdPBldt698dBcjHijb1JeLoGd1HbTHHB72eh2NT:bvb22SsaNYfdPBldt6+dBcjHijUFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855482, "uuid": "e58b2d2f-2147-41b5-ae12-4a5cc7d65a64", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855482, "uuid": "60634ec3-17e2-4d37-a0b9-9c43a0ccf92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855482, "uuid": "c2c72cd8-7f33-4cdd-989e-82526a589e6c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13de07de-c7af-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763821521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821521, "uuid": "1e06c9e2-d5f1-46d4-97df-574f161fd516", "comment": "Malware payload", "value": "7fafa80f8eddadaea2d066784723cae5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821521, "uuid": "7cf51701-589e-4114-96dd-c2fbfe7e897c", "comment": "Malware payload", "value": "1ca97a5913fa800f011bafd42a89aea49a02a59847ea39d3e15ebd7cd6b57fc4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821521, "uuid": "412ef5ea-2efe-4611-97d1-4660a1e19389", "comment": "Malware payload", "value": "b66a48936e503a8bc28888191f6cbfabf7cad986", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821521, "uuid": "8aed394a-e136-4a24-b787-65d39ec752d6", "comment": "Malware payload", "value": "a7a0052d75ee30ace80f8979b759c7f1b960571887ef4a6d963ffa1c741d43d6e899555b292dfc65800ceb732b862ef2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "trojan.barys/loader", "colour": "#B6E5ED", "exportable": true, "hide_tag": false }, { "name": "Trojan.Loader", "colour": "#F15B9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821521, "uuid": "88cd0de9-ead7-491c-9c59-d0fcd81a36fd", "value": "T1767408113BF089B7D27E4532DEA8ABA4F1F2BD724D30951713603A6C8E35F419958B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821521, "uuid": "8f1cf797-af02-4f5b-a90a-a124bef2cefb", "value": "106a1f03d9d0dc4e4a26ab57ea51abf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821521, "uuid": "8bb70dce-accf-460b-985d-6043d04195c6", "value": "6144:nAzQkA7MV/UcVWr17K7jM7ddf/zJZnXPym9LWFR/n:AzQkAolqmidP/y0+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763821521, "uuid": "f3bb9cba-1584-41ea-abc3-cda4e705260a", "value": 339984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763821521, "uuid": "e496b52f-1075-44b5-be55-1c98f842bbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821521, "uuid": "0c14e3ec-ac61-49d6-87e4-4d6ae9345fe9", "value": "adsiedit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27425f20-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855484, "uuid": "b9e4f5df-3d5a-4a96-9315-d141e8845a36", "comment": "Malware payload", "value": "11d2aacdc974caf3b462388df1ab6760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855484, "uuid": "2aff6001-141a-471e-ad38-7e99e3c0e279", "comment": "Malware payload", "value": "1ceed8bbf49dffb2546089265ccc44b0807de69508d23451cd630aa87a8c9ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855484, "uuid": "f534f59f-890c-4e89-9caa-5076afb50c5d", "comment": "Malware payload", "value": "cd514f3ac2c014c0fc8790697d9a9e7eeb8d50ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855484, "uuid": "ca0f9b94-ac39-4026-bdb6-0ae3f97cd69a", "comment": "Malware payload", "value": "0506fc2a5e95d139ce87d47fb357d3408dc4f586f1c30488fb8d9030272dc24000602e141753d4fce9249eddc61a0c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855484, "uuid": "1218df0b-ef39-4534-bc7a-431de109b0af", "value": "T15EE55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855484, "uuid": "9e716b1a-3a01-4b00-a6e6-0a7d9e948041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855484, "uuid": "45a858ad-3266-4d5d-a1ea-287a292943b7", "value": "49152:4vClL26AaNeWgPhlmVqvMQ7XSKlgaEEmkzk/8FroGdATHHB72eh2NT:4v6L26AaNeWgPhlmVqkQ7XSKlgavB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855484, "uuid": "80fb3e67-79b3-421e-a6b6-38325dc31d21", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855484, "uuid": "00833fdc-10d8-4be2-ad57-452c3a348dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855484, "uuid": "e35f7064-6260-42fd-b0c7-f9ecb44343e1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280fb618-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855485, "uuid": "b32d1dd8-db19-4da0-babf-a93f29e1f5dd", "comment": "Malware payload", "value": "57b942251518e2f9599c601032dbd2e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855485, "uuid": "bdd1ade3-09e3-4253-a898-14aeb3a7a128", "comment": "Malware payload", "value": "1d2e6f11b9db3674289e6e76521353b71438a43ecb15153d850e6683e0c534fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855485, "uuid": "79e35bfb-08d4-487d-9920-51abe8dde9e1", "comment": "Malware payload", "value": "7933026c6df52b74ca7b28762ee772562f8af8af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855485, "uuid": "4afa9b6b-197c-41e8-b644-1398a9257d2f", "comment": "Malware payload", "value": "c67b0d65e458e578cb626292e42f0f8b0514b6d44acd34d8052521e1be31e33812e9a4d64c7f55b36961c469933bbbd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855485, "uuid": "4d94ce7a-8127-4fb3-bebb-9bb55190237a", "value": "T160E55C043BF85E27E1BBE27795B0041267F0FC2AB3A3EB0B558167791C93B505942BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855485, "uuid": "0c0f73b1-05d7-49a2-a2f0-1d32fb156509", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855485, "uuid": "e128e6b3-8d57-4665-8b68-ea7ee0aa9f8f", "value": "49152:DvVt62XlaSFNWPjljiFa2RoUYIwHn7bRZELoGdaKTHHB72eh2NT:Dvn62XlaSFNWPjljiFXRoUYIwHn7KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855485, "uuid": "c59d647e-cfe8-4ae1-b005-c4e05fb18b82", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855485, "uuid": "cb7ee0c7-5041-43a6-a1eb-24a895b97dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855485, "uuid": "af568005-73c6-4f80-9bc8-44dcf214e7e5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5967caf-c754-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1763782681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782681, "uuid": "147a1aba-a6f4-4ab7-889d-a5b7f575cb54", "comment": "Malware payload (BlankGrabber)", "value": "1d37c1ccfe45627558e1aa13dbd2b554", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782681, "uuid": "c8f6e776-bf23-4c6f-8d82-b824794c125b", "comment": "Malware payload (BlankGrabber)", "value": "1dbbc6e01d58e80946a47e2c7567c42e9b32f0ba000e68b176752d143a83ab00", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782681, "uuid": "9b4b822a-feb8-47f9-a8ef-83e9ebd89473", "comment": "Malware payload (BlankGrabber)", "value": "2a6528f66d625bfc8b85301b973af3850f0c5b57", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782681, "uuid": "a333da16-be8c-45b7-b438-d214cabedd84", "comment": "Malware payload (BlankGrabber)", "value": "6797b40619fd40e425e7ab418aaf5a4112b55486397f2da3b425d4ab11b9b0a6240ee615287ebcbc91ae20869e339651", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "corrupt", "colour": "#E3D406", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "peexe", "colour": "#6BCFAD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782681, "uuid": "6abd76f8-2cca-4e3d-92ea-b0e25499dcff", "value": "T117F7332C6B64F93CECBB85A10515E6C68DD6CC4C2410CC1187EF8AD5942682FB7BDBA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782681, "uuid": "ac98a95f-3dcf-4d17-879f-519b1cb0c862", "value": "94e7aea3d2e237d4bb8f35712a6425f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782681, "uuid": "72ecf7ad-ce1f-40c3-950e-31ea5b47a3b0", "value": "1572864:S/gUvSF0NSPcbI3pENeuub1t+PYlwNv7O9GCFxxSKyB+NjjASVdPYuglVh:TUvSUSPaet1+YeNzlCRBe+Njj7QzlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763782681, "uuid": "13b61bb9-fd58-478a-abc1-340131522d1f", "value": 71178752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763782681, "uuid": "7bf1d652-1d48-4b02-97c9-87794fe7b1eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782681, "uuid": "7a232de3-8913-4713-a9ce-58e529342931", "value": "Simao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ea85d9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855487, "uuid": "d8d71a22-be1d-4a5e-83c9-3cecbe26c5e9", "comment": "Malware payload (QuasarRAT)", "value": "bc463755104df151b25fef51b85c7829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855487, "uuid": "ae3c9b43-4c18-4c57-b700-7510641584c8", "comment": "Malware payload (QuasarRAT)", "value": "1e0ab13b1e8f77b823ffa18fd9256634d36a1c5bed8e4dc5ff8db10263753f8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855487, "uuid": "d01de60e-da28-4b0f-9544-1a1a9f62d726", "comment": "Malware payload (QuasarRAT)", "value": "1786d21df4041870e684cc3564f4299bda2683a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855487, "uuid": "e2a24c70-a836-42fb-b554-688cf2862834", "comment": "Malware payload (QuasarRAT)", "value": "c086bf40c6d0b98161d57c7133d2f09741224e2885e4147a4b7e171d88f6e40bddcc591ddf949db5c53e4e34b726950b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855487, "uuid": "9ee543b6-fefe-49d5-8ac2-34b07a64efc8", "value": "T1B5E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B5191677E1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855487, "uuid": "aaafaace-6462-4866-bd2b-a1e8ee56a06f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855487, "uuid": "c339b14f-c7b3-4cfd-962c-a72948cc3093", "value": "49152:yvnI22SsaNYfdPBldt698dBcjHLYOEEqk1k/8F2oGdLQqjTHHB72eh2NT:yvI22SsaNYfdPBldt6+dBcjHLYOlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855487, "uuid": "8a36211e-ef2d-4a61-910f-9d40943d58df", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855487, "uuid": "ffa35df4-772e-4cbf-af3e-fd8b884db996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855487, "uuid": "9ac60429-58cc-42fd-b471-925cdb198eb3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a8a6c2-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855488, "uuid": "4594257f-9a29-4cc6-9013-e7924409b9df", "comment": "Malware payload", "value": "b0951435e996097ed5140003032a364b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855488, "uuid": "b0e334be-0f72-440d-9994-cdbcaf31d65d", "comment": "Malware payload", "value": "1e3baaca12b490dc421a1d7081dbde90cd82be619d47e2c0f6077ef96affc883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855488, "uuid": "ba530d44-bb89-4f68-bab5-517fdef5758a", "comment": "Malware payload", "value": "b2c6ee6f4c1a1694a6c00cf903185dea8322dda9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855488, "uuid": "05116681-35de-4924-8492-0d07046ab19c", "comment": "Malware payload", "value": "99fa4465679d5d44762cf774ae5f49404697674b44f3ffe831897ba818fa1e74d64024e5e79c1ba3db57d964ee1f50b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855488, "uuid": "3de464bc-0633-46b5-b12b-f957f0cda532", "value": "T13EC47C1067E48E6AF2BE1B3EF0354905AB72BC466766F34B1E95609D2C333419C81BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855488, "uuid": "15662da2-6987-473b-b720-84e2be678a67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855488, "uuid": "012a3fa7-7d69-4d5b-86e7-bb55390682e1", "value": "12288:7jxwyMeDMYRXPe/sLmSVf6QFcP+dzwvT:79geDM/ELm9+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855488, "uuid": "41d3b3c3-5832-4668-802a-9e83f6de8e06", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855488, "uuid": "f0a5b048-2045-4de3-95a8-75b4b3e56526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855488, "uuid": "a78b6ecc-6824-429a-b147-b3e5eaa2564c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a66a94c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855489, "uuid": "9a56d478-8718-4685-af7c-dc0cb2caea57", "comment": "Malware payload (QuasarRAT)", "value": "86d9f9b8c5bf10e9a2131429dc74f133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855489, "uuid": "56049dda-2a5c-4771-8d3b-c70ad0544fb3", "comment": "Malware payload (QuasarRAT)", "value": "1f8e4f9a1b4bf217a83b0e100631120a424afe567e7a1fbe84e74f06f3da52c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855489, "uuid": "2d9b6ade-8595-47b6-90f4-a0ffdc09f9ce", "comment": "Malware payload (QuasarRAT)", "value": "e0fbaae6269af164a3399908b275a0e7d2e3b4c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855489, "uuid": "5f2988aa-8ee0-46a8-8a41-e9216d0244fe", "comment": "Malware payload (QuasarRAT)", "value": "bbb21f9bafe2920583a3b5d6b9d9f9843d828dd452435f2ced969332f6dd57a57fd6b48e419977deb6b32613f7ca063c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855489, "uuid": "09f1dfec-d1ac-4134-a815-4b3f0461915f", "value": "T138747B1377A8E63BD1BE177BE03205142BF0D446B716E38B6A6855BCAC123868D917F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855489, "uuid": "5b5cefa5-e361-43da-b911-f22f49ba7fe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855489, "uuid": "3a342791-1b2e-4bfa-834b-c86504c1bade", "value": "6144:9LNHXf500M8B+1gbuTbG5E/Gn4C9HXDBnRCunk4X:Bd50J1gqL/C9T1R/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855489, "uuid": "0fcf2953-7e25-482a-963b-b2cbc37a3758", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855489, "uuid": "f2ef9853-d3b7-4990-b783-0422a22fcff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855489, "uuid": "12e64f13-249c-4e0b-a164-763dcef23d9c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b299656-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855490, "uuid": "a1e6a1db-0a7d-410e-b31c-3d0cbdb15340", "comment": "Malware payload", "value": "b53aa281ea508b38a3cf0769ab3f3a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855490, "uuid": "c32177f2-e2b3-4f37-8396-ba7a2838bf76", "comment": "Malware payload", "value": "1faae5749bf2a88691c8e95d791e71d50923fefa0fa01e50bb86468deaf36de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855490, "uuid": "0ed30f14-b414-4db9-afef-8debf4ea2eb1", "comment": "Malware payload", "value": "bb5f3e3b2e940028a83b0493d8bd7778ba345a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855490, "uuid": "29d7520e-810a-4828-95bf-bfa35397852a", "comment": "Malware payload", "value": "3a03825686440bea20ede716588a0e1cbea9d960e89d84a27cdd966d24559e30be31bc286c04b59cafe8cb049001a094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855490, "uuid": "f8db220c-126f-40d6-b0da-cda62b7407b7", "value": "T1B1850240B7E85616E1FF1BB9E4B206054B73FA22D93AD74F0988906D1EA7780DE503B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855490, "uuid": "a497a5b0-c840-4732-8e9f-591b9e2d216c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855490, "uuid": "ba0e1340-d132-4241-a666-bfd34ab06829", "value": "24576:tgrqmfHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfEez8jOgNQgt:tgr1SGOGqnXpyWUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855490, "uuid": "1f515f8e-d642-4923-84e5-5f4003dabdb7", "value": 1866240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855490, "uuid": "9136b0e7-83a4-43b1-82aa-e9da2bab0fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855490, "uuid": "fc3f2ad6-8e10-4052-819b-282ef5d964b4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c071534-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855492, "uuid": "52c25538-3590-4054-81c7-d46b24c7b9cc", "comment": "Malware payload", "value": "f4890c1c4557bfc4a343c02bd00052e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855492, "uuid": "f97257d6-6df9-4a39-a979-15c7820ddf74", "comment": "Malware payload", "value": "1fc534f707d952ca308035e57a5195637206c6575e7e25178abaaa8326ede5da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855492, "uuid": "77a363ba-d4a0-4cc2-81c9-3e5043619c1b", "comment": "Malware payload", "value": "16f93ad0cf28159a314103203dbdf548f4bd3952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855492, "uuid": "bb142c11-15f5-4c8c-a59b-71c290ae07e3", "comment": "Malware payload", "value": "340b92425364a4b60b1930ac2a0bd00f7fd31f968bb9b6fcca4a4351fd703e76aa5f4d76b771198cd53de1436d0bb76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855492, "uuid": "8fc59358-f912-42b1-8e2a-bd1dc22e6786", "value": "T17DE55A057BF85E27D16FD3B195B0401A87F1F81AB3A3FB4B598267B91C83B508D026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855492, "uuid": "6aae7a90-ec6c-4881-be16-86e74fa002c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855492, "uuid": "3fda6421-4c81-4fdb-93a5-d1f472958462", "value": "98304:WxLQHCIJUtHEDTQSKsVltJ9PpSynJN1Sx:CL0UtWnJGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855492, "uuid": "1f198551-a404-4dc0-8cf7-3ef415c263bb", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855492, "uuid": "a1654893-fae6-4052-bbc3-431a517f94eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855492, "uuid": "42a4ae12-e6b2-4903-a65f-895ee2f87cdb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cce4185-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855493, "uuid": "a62b745b-76d3-4b84-a843-65122922eb7c", "comment": "Malware payload (QuasarRAT)", "value": "8e9d4974335b945ca776c6d71c291be2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855493, "uuid": "9c1199dd-31c1-4424-a9e0-54ded44c5698", "comment": "Malware payload (QuasarRAT)", "value": "20585f6275ad1794ecb51c41cceeb4d0994cc886b02c252e05b9302529e79459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855493, "uuid": "dc1b56b5-2282-47ea-a52a-4057567fae2f", "comment": "Malware payload (QuasarRAT)", "value": "42cad0545f2cfbacd822438eb8585cb116fe8bd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855493, "uuid": "41dac054-8c5f-4e62-bd56-3ebd4da7daa1", "comment": "Malware payload (QuasarRAT)", "value": "03d504718b810eda574a44381855f935ad0657e70d2d450688271bc8199305d29923084ca729ac7bfa29d34f1ad09556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855493, "uuid": "b915eb73-74cd-4cb1-a19e-cc33140dafc7", "value": "T140E54A0477F85E62E1ABD3B2D5F0541363F0F82AF3A3EB0B5191677A1D93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855493, "uuid": "5fe17626-958a-4d4f-ac88-7420b2d4f98c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855493, "uuid": "240e0c64-aebb-43b5-b2bd-60f3fc9ef92e", "value": "49152:nv+lL26AaNeWgPhlmVqvMQ7XSKdfLImzFYoGd7THHB72eh2NT:nvuL26AaNeWgPhlmVqkQ7XSKdfLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855493, "uuid": "43f5270c-ef2c-4c2b-a220-09a1c3ba16cc", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855493, "uuid": "c672b9ff-3b24-48e9-8b5c-1f2ad9c65259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855493, "uuid": "8418c892-b0af-4afa-adb0-9eee0cd44678", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcb38c3-c7b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763823095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823095, "uuid": "c0afb50f-f57e-47a7-9cfa-dbc5717a7a8f", "comment": "Malware payload (Vidar)", "value": "2064eacb607f70cecf6e9b9b87f84ec9", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823095, "uuid": "c19670c4-e194-440c-834b-52af00fcdb47", "comment": "Malware payload (Vidar)", "value": "2083729506001a46f57302bcfa22b60b5299ba6b57eea6b82c587a10b61b759c", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823095, "uuid": "636efeb0-22cb-4f5c-9361-48d4befd7eee", "comment": "Malware payload (Vidar)", "value": "4f26cacc3db1fb00b0e594bbd8a1c89c3354c0a0", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823095, "uuid": "01b250f9-3a7d-4556-8f05-e591757225ac", "comment": "Malware payload (Vidar)", "value": "b07fb0210f90ea0e0c76b9789d7465ecd5be628d7d6ba3f90256642df1e32cd08dfb536cfa5e7931b96c8651919d77e2", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823095, "uuid": "f4e25aa1-009a-4af2-873b-f4c420069c93", "value": "T111A53316A6F8796FF5B1D3F4A5D212935A3078A057A497BF2180D76E4F223C5B030F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823095, "uuid": "d7b339bd-5289-4c6f-9a55-2fdd63428d6f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823095, "uuid": "2fc5c8e3-bf7e-4177-9256-2240e64d9bbc", "value": "49152:AFi/+w3RK2YRj3Qxuo41IAXpKgsFHOourruZBIbGGHPp:cQz3qRjdo4+AX+5burruZB9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763823095, "uuid": "7b9cad5f-6f12-46f6-86f5-ae888f349146", "value": 2096056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763823095, "uuid": "965269e2-0e55-4ef7-9874-6002230322cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823095, "uuid": "c73e391a-6cfa-409b-9129-1f4166b75977", "value": "Aura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9ef5d6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855494, "uuid": "0970733b-191e-450f-934f-1d23a5b10966", "comment": "Malware payload", "value": "ae09dac090b475443361886178c7b5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855494, "uuid": "056500b2-b547-4b12-a2c1-81db1fb2377f", "comment": "Malware payload", "value": "20cea5cfe18f03792a9f3653978a4ab09000871a85de370e998aad8ef157ad50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855494, "uuid": "32e0ce0d-aa66-4195-9ee2-883fab38fa63", "comment": "Malware payload", "value": "06f0a7fada062d1451ecca47032c12a9738d7492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855494, "uuid": "0ca1ec0d-fde7-4e15-9579-8525b71bc349", "comment": "Malware payload", "value": "5947adc29f0c4477cec5852d9746c7dcc118a3b277b9ed42367d267759b421d9dcfe3afd618e4f4d883a35afb71c5591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855494, "uuid": "881ed5d7-1df0-415b-84b6-a898e234e978", "value": "T1EBE56B0437F85E32E16BD6B3D9B0501263F1F86AF363EB0B6191667E2C53B5058427AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855494, "uuid": "ef431f06-9406-4540-9e90-4509951224f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855494, "uuid": "371c4b6a-658e-4a2f-8ea4-48bc7cae68b3", "value": "49152:NvjI22SsaNYfdPBldt698dBcjHhJC5BoGdjrTHHB72eh2NT:Nvc22SsaNYfdPBldt6+dBcjHhJCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855494, "uuid": "f1f82339-3d32-4155-bb2d-5754e2c84f3b", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855494, "uuid": "3b8febfb-5b49-436a-9fa2-c5ac62c30678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855494, "uuid": "d0393898-47aa-4f85-b2d5-8bc0d10b52df", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea7bae9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855496, "uuid": "c149544e-8758-4171-b2c0-91d2273a84ff", "comment": "Malware payload", "value": "7ed70e5c52a4e8d1247708ecfd5d934a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855496, "uuid": "0d2307f9-a9b9-42d7-a6e5-eaa8d14783a3", "comment": "Malware payload", "value": "20d279faa25249794ebd1444f4197a07d0663c7d60ffb5a69b2e2aca5a8a9f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855496, "uuid": "0b7c51e2-ad3e-4b27-8807-ba5e68455dae", "comment": "Malware payload", "value": "c773e4c457615845122efe69c6e99e09fb717480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855496, "uuid": "6b9a004e-240e-4bc8-9e46-29d18b57558c", "comment": "Malware payload", "value": "56ed09d0800126d32fb37828c9eda1ccb36ce9a6b486ec4e1764428e9f95c3f8468386ae5080f5c0f13486b8a6c82b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855496, "uuid": "cdee3012-8b72-4334-8977-2625fa22553f", "value": "T158C633AF03F9AF71C79B8370C6D2194CCF395EE18225CE55A8901D57A892B4AE1B3C4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855496, "uuid": "6d50879b-2bb8-4e1e-90dd-a22a334ef9ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855496, "uuid": "7d217445-9f76-4c29-b1bc-96b0b98557c1", "value": "196608:4RdEIeVeBHfpBjxjG1qfKYCzgtNGicaGF39uqm6CVWmJNDaXa3Jl3vQfOv9:GgVeBBBjEUfKYug7pjVWm7m8w89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855496, "uuid": "ffb28533-a449-4c99-9908-a94ed17fa43c", "value": 12391424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855496, "uuid": "39bb9cca-00c6-453f-8cef-d5afa41a7971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855496, "uuid": "64481abd-3b20-4a8e-8d30-e2c278651bb5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f806174-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855498, "uuid": "83e16915-6919-425a-a1d1-a87ccd002b40", "comment": "Malware payload", "value": "fea904c2f28fc3845c9c88ea55d7ba3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855498, "uuid": "c8320566-07cc-4f3e-a755-b5d5e63b611b", "comment": "Malware payload", "value": "20e66021cf2af64cbcbea918e7edd876ee7fc204ed5f09ad09f16342dd89ee3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855498, "uuid": "364d2fcc-a338-4a09-8c03-539f56a0e6b0", "comment": "Malware payload", "value": "b044c0bd71459c500038ed4bb295eb520f9c80ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855498, "uuid": "8d525d3f-37ed-4364-ba20-3a105be119c8", "comment": "Malware payload", "value": "882f6d8c0312884e0d8fd9168e937ae7d5e99f57f7600364c718e36cb9ba7e79cd8179a98cf05aa4e40577bce0eb2524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855498, "uuid": "bc3e233f-e520-4ee4-83ea-2201a92fb7c6", "value": "T131E56B143BF85E27E1BBE277E5B0041267F0FC1AB363E70B658167BA1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855498, "uuid": "c6ac6c53-bc0e-4054-8d6f-d7d1ff5ce902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855498, "uuid": "910060df-56f3-42e2-a18e-cc74999d584a", "value": "49152:av5t62XlaSFNWPjljiFa2RoUYIEM6nbREzoGdUFTHHB72eh2NT:avT62XlaSFNWPjljiFXRoUYIEM60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855498, "uuid": "5decff24-c1bc-4d09-b294-adc5a9e20733", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855498, "uuid": "8197c91b-d676-4820-bb1e-09ea4ff6867e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855498, "uuid": "668d56e8-4b6d-4225-b448-b14fda3e12eb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8bbbbb-c7de-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763841776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841776, "uuid": "46039952-60ad-4f84-8f0f-9d0a511060de", "comment": "Malware payload", "value": "a3f07ef16d0240299eb9e69848eeec01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841776, "uuid": "f1151106-d5e7-4eef-b33c-d80645e7a8e7", "comment": "Malware payload", "value": "20e959be15a37128a15848f805f1dd984f8f784c9b0b47a8fb76461b754c0505", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841776, "uuid": "499096ea-beb6-4609-96a2-834111f8939f", "comment": "Malware payload", "value": "f6c93df1b884cc9744b35dc8a094e96435fc0fd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841776, "uuid": "606d8a7e-97ec-4c98-9afa-e16f707d6141", "comment": "Malware payload", "value": "183111b2fae5652044bcc83cd1abb4c50e88835ab374a843f3767bba7a6321ec2e96dcda5537090e1e2b0a6b9a4cc616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841776, "uuid": "f8147c10-e6f0-4ab5-9d1b-cbebdf657da0", "value": "T1B2933851FC829A17CAD0137AFA1E42CD331663ECE2DE3217DD219F22378A95B0E7A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841776, "uuid": "557a211a-53c6-43df-9160-c9d16f557759", "value": "1536:nTt+Ch5T2ppT7HuPwgY31IH76p2RP8JiCDjwv4wdxxN8xebdHYVwsgS88:npdDT2//HuPDO1IxfnxNvHTsgS88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763841776, "uuid": "eee54253-86f7-45e0-8af7-78a8d5a76294", "value": 88916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763841776, "uuid": "09ad4752-35ea-4a33-b60e-4885db4acf41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841776, "uuid": "8dc8d54e-70f9-4bda-8f03-7b11e269e207", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30549e88-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855499, "uuid": "28011477-41b1-48e2-96a4-6fa926c9fa52", "comment": "Malware payload", "value": "555d530eba8dd8bf00a7d9afd42dde94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855499, "uuid": "0947682f-3b83-44dd-b8ab-b165a7929527", "comment": "Malware payload", "value": "20ef9c09d2666975de117d3e4d0242ca26098390c3b3d924b8d4c9b623d5aadd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855499, "uuid": "3dc432ed-7e5d-4b05-9ee3-3c56a5c59ec1", "comment": "Malware payload", "value": "e6bfe947341277f1c831654999a0de9e2dbf1994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855499, "uuid": "d5d2d0c7-2e95-4636-8a57-47f8cc632ff2", "comment": "Malware payload", "value": "5a8b6f80c52b460b25368d195b085b79b85f0ad6fed705dfecf065ca6c18b70a446ae665d775e3b170c7bc26fd01c45c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855499, "uuid": "a520eaea-2d8d-4b0c-82b2-5a0709c1524d", "value": "T13885025077F5811AF2BF6BB9A4B304460B37F943DA3ACB9E1958906C1EA7340DE61363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855499, "uuid": "48ed4233-a0e2-4850-a0d1-abe2d798a80d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855499, "uuid": "6a63c06f-7421-417e-9723-c81ec109eade", "value": "24576:rXcrQckSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkk:rXcrQnTYj77wRGKKm77LrwCB6hqanyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855499, "uuid": "08768523-23f5-471c-b0c3-283e0c28cc05", "value": 1836544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855499, "uuid": "26a33fe7-5156-408d-aae0-07594051a76c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855499, "uuid": "3639c7f7-58a2-4b4f-acf3-bbd9ac6de6a8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3123182a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855500, "uuid": "eed7f0f9-43f9-4863-8c0a-1a8cb83a60c9", "comment": "Malware payload", "value": "4e8efdec94fcbf8f4bc6ce3701200b4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855500, "uuid": "b78bfd51-28de-470b-85e3-514de6f6f979", "comment": "Malware payload", "value": "21115cba44d1a5ebc6f1fd9317d9e4726d261e3a7418d8a979c3b9c59cf06e83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855500, "uuid": "2d34804c-9d25-47c3-a8b4-2027eb283c82", "comment": "Malware payload", "value": "e1303c37133f79a3b481c5acd90c50af98f52180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855500, "uuid": "de56e4a7-7aed-41b7-92a7-278eb2a30c75", "comment": "Malware payload", "value": "3a4f8b56e1aa4f82a42de1fd2380528480dc3206b01b756827dd35fce0cc873c5bd2f776f291ca79abc6164c58cf261e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855500, "uuid": "f1ba3870-177b-4db5-84d5-710378e9f778", "value": "T179E56B143BF85E27E1BBE677A5B0041267F0FC1AF363EB0B6581677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855500, "uuid": "18de1a9e-46ae-4709-94ae-7c13b56c2fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855500, "uuid": "79de7cee-f8f8-4572-bf24-61579a953420", "value": "49152:3vjG42pda6D+/PjlLOlg6yQipV9MRJ6FbR3LoGdvTHHB72eh2NT:3v642pda6D+/PjlLOlZyQipV9MRJ6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855500, "uuid": "fe8ee52a-7c79-4f75-a91a-69d6b12bafd7", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855500, "uuid": "65270c66-9d36-4f55-aeae-de67e6e135bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855500, "uuid": "b3c79c29-e507-4092-bc9e-dc353be82400", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fada61-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855502, "uuid": "c5007838-456e-405f-9495-3a34b9361b99", "comment": "Malware payload", "value": "3046ae17d8498bb2b652b00e3f888fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855502, "uuid": "857ffd9d-ace5-486c-939d-d058809e21bb", "comment": "Malware payload", "value": "2143fb39fee16d5f25c667f9409bf6fb61198c4416dd3e0d19efb4c24ff2ae24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855502, "uuid": "fedb878d-1fb8-47fb-9dcb-08e6d04b7181", "comment": "Malware payload", "value": "732f2f805b1583d2baae4a9cc460208208fdca54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855502, "uuid": "4c1821e5-966f-4c8b-8dd5-2862425d6c66", "comment": "Malware payload", "value": "48d8f91c5e133f30742797efe286284b7364a61140cb5049823cdb1b60827c09a64f0c3b2b6267949d958ca277897168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855502, "uuid": "35df97d6-28a3-4c3b-a010-bb6ff7750528", "value": "T14E163348AD819952E2AAC639597BF0EF792C5C49D0BC343BFA8AB3405573296C73F40D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855502, "uuid": "454b4219-55ec-44c5-9722-bad27f335d4b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855502, "uuid": "af05adae-c350-458f-96fc-e9e7a8519c48", "value": "98304:kxRL5Od+92I5E3s70E0hoWu5T17b82PJxBDo:k/gUpd0zqXd9bJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855502, "uuid": "fe050005-9e26-4545-be2a-8a327ece3823", "value": 4072448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855502, "uuid": "5122a390-c166-4c9f-b2f8-34c9f3c1b62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855502, "uuid": "ffafe93c-adde-4f36-9c79-b7b20ed2c9c9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d37f8b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855503, "uuid": "979892c0-88d4-4746-a618-5dbd64ad509a", "comment": "Malware payload", "value": "0493d36b92c5197cf08e71ada2e22679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855503, "uuid": "df7de078-493b-432f-9fd7-7906b416f1da", "comment": "Malware payload", "value": "21b3bea9b8953ca4450aabb59662f24c9d25fe017a120cca2704073e4e706e3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855503, "uuid": "c930e520-5c7f-4dd6-8083-2a5d3ab2cfcd", "comment": "Malware payload", "value": "8c9ce38941f3c89e6ff5b6ceb60fe44678a5b695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855503, "uuid": "84ba1a18-95c4-4d74-8509-f98febb827a6", "comment": "Malware payload", "value": "5aea9a0e86d7d8882dc4f4879198cb3a3fba3aff8ef911e8539c7644f730a55c856a1f6f778918c5a45f4d5817ebaf24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855503, "uuid": "15292ca9-886b-49a3-b57c-c55865ec62f7", "value": "T107E549143BFC5E23E1BBE27395B0041267F0EC6AF3A3EB0B6591667E1C53B5049426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855503, "uuid": "810c979a-b45e-436e-9756-cf713489b557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855503, "uuid": "1853de29-1c63-4862-aef9-355b5a602a2e", "value": "49152:+vXI22SsaNYfdPBldt698dBcjHV/Y0jhtzoGdPTHHB72eh2NT:+vY22SsaNYfdPBldt6+dBcjHV/YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855503, "uuid": "8e75ee5d-53e9-4df7-b13a-e3eec60f0728", "value": 3269632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855503, "uuid": "f1e17261-dd1d-45f6-982e-eb26179501b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855503, "uuid": "3a4c0c54-0e47-4b12-92fb-dcc3b0100ff2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091ab63d-c7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853715, "uuid": "f1aba5f4-f3b0-404c-b4cc-d2462cc86311", "comment": "Malware payload", "value": "d424ab21d61a8362073475edfa2d47ae", "object_relation": "md5", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853715, "uuid": "13ea5663-5480-4a42-aacd-a38734889104", "comment": "Malware payload", "value": "2204d1a9613348ceb9abc693e0d9f319b93266b6aeb4905d7f7498cd41f7e67c", "object_relation": "sha256", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853715, "uuid": "c996ff8d-e04c-4d34-b180-daed0f9cc995", "comment": "Malware payload", "value": "0adc6c67a71ec51004504adf9fb8dfa321dd7611", "object_relation": "sha1", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853715, "uuid": "294053aa-cde5-4dbb-b6b4-9b0503f2e0c5", "comment": "Malware payload", "value": "3452f548514b27c8182fda5ea10205eb8e064fe19914b1803da0461da6a1188ebf2b7b2ca453d541031c71965bc95230", "object_relation": "sha3-384", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853715, "uuid": "2bdc5455-7e13-4392-964f-086cf621d24c", "value": "T12001F1E88317D00841E49B56BD5FF4864D3181FA234A550CB98D8519EA25E25B7BD394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853715, "uuid": "0dde0d79-b1ea-4e1f-9d28-fa6775262bdf", "value": "12:IaRkqQbcNIqkMyKfy1E00/lfNiF+Bbso0KkDui41Ci5SOI1z8idn91AT/1PgzOD5:DTQbhPBKqiNNIF+Nsrjb4ciOpWdWC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853715, "uuid": "6db085ef-6075-4c12-98fa-c33fb565408f", "value": 781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853715, "uuid": "9f677b44-4e9b-403a-91d7-47afaa9f1d22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853715, "uuid": "734c4cdd-a6d0-4b59-a882-31236efb4d0e", "value": "screenshot.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38eb0722-c7b7-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1763825019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825019, "uuid": "01db88e3-ce57-432a-bd72-482122336a41", "comment": "Malware payload (njrat)", "value": "9022181ea230a19a02e1443a55e09c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hakim32-ddns-net", "colour": "#FF30B3", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825019, "uuid": "ab0ac3a7-c57c-437a-83d7-49b4fc4e1778", "comment": "Malware payload (njrat)", "value": "2216dc7a29522eca6b329dc15571eded25e4c033c4142f0732de5a6a85b3812c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hakim32-ddns-net", "colour": "#FF30B3", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825019, "uuid": "5cad0abe-a2a7-4ed8-8b7b-34e1f55b9aa2", "comment": "Malware payload (njrat)", "value": "0fbef5d63e51a070b22c2461dbb30e6138e752c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hakim32-ddns-net", "colour": "#FF30B3", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825019, "uuid": "a3217027-1f86-4399-9604-1f1f198c077c", "comment": "Malware payload (njrat)", "value": "6805b2d60d7078b0cd2fb1a89a909045223fc6d31ec1bbae8bec5e731963cc3085ee7fee94857e1716e68ff0a5e71a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hakim32-ddns-net", "colour": "#FF30B3", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825019, "uuid": "e1769fa6-1530-400e-8c26-766d9b6493f0", "value": "T19A93E74977E56524E1BF56F79871F2004F34B48B1612E39D48F219AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825019, "uuid": "20c12909-eec9-400c-9c9e-f400b81d6f28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825019, "uuid": "b6a02f4d-412c-4e6c-918a-9f592cbf29af", "value": "768:oY3JUfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3bsGdpbgM:ZU5WhIUKcuOJhPhBjEwzGi1dDnDbgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763825019, "uuid": "27c091e4-4dd4-469d-83f7-c113fa38f269", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763825019, "uuid": "b9054e0e-d10b-43fd-970b-aa5f4f20054b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825019, "uuid": "8f5f0c55-a9c3-4f58-b64b-bac50f542b25", "value": "fatality.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a1ef6d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855505, "uuid": "1013275d-93f5-4d1c-a285-6b5cd6f57601", "comment": "Malware payload", "value": "d73a420ff80f18a50428c910c6078d92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855505, "uuid": "69263c10-d04f-4e22-8676-4fa14a9b291f", "comment": "Malware payload", "value": "2257e828bfef04307e86903566779b7b66713b4105e3431b5e8788a1da4f68a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855505, "uuid": "e9ff92c6-2c0c-4d64-9120-00d13825153d", "comment": "Malware payload", "value": "7bc5a9a6de7cf3e371088d9bfbb77a101db84200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855505, "uuid": "ba0a1a20-7f4f-4eb5-9ccb-9852ed5f535b", "comment": "Malware payload", "value": "1f10e844af1e1169e9d5f9ceb0b576dbea57214d64e29850ac59e33aa35ca0afe33742f9558485c5768a718a328514bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855505, "uuid": "03937a50-21d9-435f-84b4-20704f2d8f62", "value": "T111E55B0537FC5E22E2ABE276D5B0011667F1F81AB3A3EF1B51C1A77A1C83B508D416A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855505, "uuid": "4549a99b-248b-4fcb-9703-d8713d72c6c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855505, "uuid": "66ca7b6f-e8d9-4664-8a3d-214ac2a0dabf", "value": "49152:QB7Um7J2dlamagXPBlUZIrWslcvJQOaUWrOiek2t034PQNCKaGv2LkmNKF:QBQmV2dlamagXPBlUGrWsGpQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855505, "uuid": "da2f403b-bfc0-4752-91a7-351df6623bcf", "value": 3315712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855505, "uuid": "6eae1026-d84f-474f-b58a-d5f57cf332f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855505, "uuid": "41381e8d-bbfc-47d7-8710-7c1d31a0083e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34765302-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855506, "uuid": "8ec64e7d-bbf9-45b0-89b8-bd88aefeacc6", "comment": "Malware payload", "value": "006c98b6ef33c53105c47b64a75d899e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855506, "uuid": "39c82c9e-d65b-4275-9f42-890302218de8", "comment": "Malware payload", "value": "22e9d286255197ca45efe782ddb189b13d9095c0d5273ad4fdeb487d89f460ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855506, "uuid": "71000fc0-9a7d-4723-8578-a33d5d7383bf", "comment": "Malware payload", "value": "d6fd523b6c712f70f2c44fab736da79621fbcad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855506, "uuid": "1c0f798f-b287-4575-964d-ec6d5e948a6c", "comment": "Malware payload", "value": "6807221fb93f965a8c8b27b3baeea46cf68bc0d7736f3b9d7f33ef6fac5a280036ddca6b6329f3751db81058df32f72d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855506, "uuid": "dc0ccf64-6193-41ae-837a-0826d2f8b624", "value": "T128E56C5033F89E23E5AFE67295B1841263F1FC2AF3A3EB5B5481A37A1C43B5049417A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855506, "uuid": "166921a1-7fdf-4224-a092-1a678ebe0689", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855506, "uuid": "e56c878c-400b-436d-bc46-f08aa467f80a", "value": "49152:Si4/6vVlWdVWp4S4f9ESpHMj+mHpl+2fbITHHB72eh2NT:Si4C9p4S4f9ESpsjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855506, "uuid": "7e285075-ca3a-4ad6-b8a0-375d6dfafe20", "value": 3265024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855506, "uuid": "b3c12f2b-54b4-4ab5-9371-993dbc521723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855506, "uuid": "1c69e801-ca9e-49e9-bd37-aa66e10a5022", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354f419d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855507, "uuid": "18351666-d51c-4d8c-aec0-c93e8ccc11e4", "comment": "Malware payload", "value": "b422288a15ebaaa7fda78c7a8ef27d18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855507, "uuid": "34d8593f-8435-4634-a192-1f4c528fde77", "comment": "Malware payload", "value": "2305e92c69253728042748a3b58a79618e76191057dda4c469c4f38a6ab76f21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855507, "uuid": "b7b264f8-d12b-4130-b62e-1431acfb93a0", "comment": "Malware payload", "value": "1fa33259ba43998f77425a807af37704b065270d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855507, "uuid": "d2af5609-1493-4088-81d7-204bc11a6ace", "comment": "Malware payload", "value": "b3dcdb0812d1bb83a5da4bd1669539986111b83cc4835411621e4aa7216c8b6a9fb836eb8c479c8160097ab56513288b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855507, "uuid": "85a3cd2f-31e5-4e0a-84b0-ff4796532c6a", "value": "T1CCE55A0477F85E62E56BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855507, "uuid": "130c0698-43a8-4d06-b056-0df3b1128c21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855507, "uuid": "ef55c428-85c3-492a-a2d5-cd4eb2ac8f99", "value": "49152:wvEt62XlaSFNWPjljiFa2RoUYIUm+iGCmzw3oGdLTHHB72eh2NT:wvY62XlaSFNWPjljiFXRoUYIX+iGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855507, "uuid": "6837987b-e764-4ebb-b092-3a93e2dfd540", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855507, "uuid": "cfb97c4a-8e79-40b0-8633-52b2265fbf71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855507, "uuid": "cf789c49-5ddd-45f8-b3ea-1fc47aeffb32", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362e962b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855509, "uuid": "74103596-07d2-4735-aea7-a86658e75c65", "comment": "Malware payload", "value": "11f92ecb85cecad8d7dd1bbac6d26d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855509, "uuid": "af80d4dc-0e36-44a6-b504-b0353c16d8d0", "comment": "Malware payload", "value": "231755a5ebec47a3940d3e035bb90ea3a075acb8cfc1a5babec90e9b6084bcd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855509, "uuid": "5a50f298-1495-4009-a107-844861118737", "comment": "Malware payload", "value": "5ebc4a68990031172ee3891de73799f0e0d99526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855509, "uuid": "9997d12d-93b6-4b11-9761-eeedd765bda6", "comment": "Malware payload", "value": "23fb1e42f790a50e9344e35481427125c21ece9d386bea72207378776d3b9ac7c280162dfeb96455bfbb3f900802f48c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855509, "uuid": "10b065d7-f57b-410a-8f21-040ded29a988", "value": "T1C1E56B0437F85E76E16BE6B7D5B1501263F0F82AF363EB1B2581A77A1C53B4088426B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855509, "uuid": "efd15b4d-951a-4c92-bf29-87edf128f9f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855509, "uuid": "123ad932-6589-4e38-ac36-cd4f966ce1c6", "value": "49152:Kvct62XlaSFNWPjljiFa2RoUYI8w8azoGdMvTHHB72eh2NT:Kvg62XlaSFNWPjljiFXRoUYIf80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855509, "uuid": "0b1ccedd-eb57-413c-8113-3b50da28ada8", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855509, "uuid": "966c64fc-30ed-4a96-a830-3486e6da843b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855509, "uuid": "c24c0497-196a-4b01-81cc-3cccdce7dd8b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3701c15c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855510, "uuid": "d4f8f215-92fa-4ce7-9157-4db6006d03a7", "comment": "Malware payload", "value": "09555bc5c057b852847737f8c2a24c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855510, "uuid": "eda4fe36-bab3-470d-9f24-52590997d3e7", "comment": "Malware payload", "value": "233264ab9af9b9af148faad3a3cb82fa300d9a7f62db8eb19d0ed79a77ef4bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855510, "uuid": "90997eda-082a-42fe-beea-7a81d073596f", "comment": "Malware payload", "value": "e1f7a5fb4a288624cad7c4eb189c7291fa542bf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855510, "uuid": "cb997e6f-d30c-4084-8d64-7080aad928a7", "comment": "Malware payload", "value": "c3b7b14ef74029e0b37c7edaf1eaa2e425a0cdf6fcc63be421886e89cfa648c6ab0476a871f37b72b10472be223fbc3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855510, "uuid": "86d299fe-773e-4eb6-8305-38e5794809e7", "value": "T13FB47D4027F8952BE1AF57B9E87114209BF5F807B267EB4F4540B2FA2C66B069D80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855510, "uuid": "d082fc57-47fc-46e8-bfb8-4608798b6502", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855510, "uuid": "a58d99ee-690e-4e28-9fe9-5ebec450c3a0", "value": "6144:HTEgdc0YNX7IxUpGREWve13+7LOUs6f6YMZlfdwcEysb8F92tw+gcTR3O:HTEgdfYWxUkQ61yeC3gtLgcdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855510, "uuid": "c2ebc666-1124-4e13-8734-868ab02c8a60", "value": 532492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855510, "uuid": "270127e7-78d2-4f4e-9b68-eb48e1e61be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855510, "uuid": "c55f25d8-89ab-48d3-8577-ab73bef08a19", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4828df-c794-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810130, "uuid": "6ad4de8f-397b-4dc2-9aba-7d431eac0fa7", "comment": "Malware payload", "value": "143a0c25c9e91ab99888a00b47d719e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810130, "uuid": "03b430b7-d4b7-4fbc-8459-8d68e8996ccf", "comment": "Malware payload", "value": "24323ca62c06f5d650e8049079351fc5550ced441c00bfe446e47d3a6e424853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810130, "uuid": "bfa73785-3694-4cdb-a28b-8b8b452e4b7b", "comment": "Malware payload", "value": "a4c15938f5433433c123788f0ab9c126055a6385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810130, "uuid": "26359115-c1c0-4b62-8c2e-6d590ec11529", "comment": "Malware payload", "value": "8ce2ecd8159ff5381fcdf6e94812b9bdbd30bb52dd53e474baa022c92895279d941c43b5f66e81f0aa62880e598bcb17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810130, "uuid": "03a2bd85-9297-4971-b41c-baa8c2f8c111", "value": "T1CF06337697828437E092C7746874F3F9CEBE6D3304610C16B65D6D2C0AEAA609E49BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810130, "uuid": "0bd72210-5816-405e-be79-53d818986118", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810130, "uuid": "ef3b8185-7aaa-406d-a655-5f11980f5f6a", "value": "98304:4Atup5k+d8ezhwJSLOtBHlKudY3IxDe4yAWG5r:tMNhwJJlLe/4yA9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810130, "uuid": "79f288d6-810a-4734-acf0-a32b6bb21475", "value": 3696852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810130, "uuid": "29ec7548-3f4e-403a-b644-d3e0e5f0f48f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810130, "uuid": "59f57174-f0b8-4c24-bb4c-d2026435231d", "value": "Setup_Vreugd_Online_Magneetkaart_1290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c82c5dc-c767-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763790612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763790612, "uuid": "21b0b0ae-ad44-4475-b28d-c58e1544d16a", "comment": "Malware payload (Mirai)", "value": "e58fed51feff7bde3efdabb7e1e46854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763790612, "uuid": "85633bfe-cc3a-41ac-a11b-d726bfdd03de", "comment": "Malware payload (Mirai)", "value": "2446b0241649dea2d9f6e002e8f16839c3f22ce33e81bb6c82041bb61fd3a049", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763790612, "uuid": "8059d302-12e7-432f-865f-b3a9c4b4c03b", "comment": "Malware payload (Mirai)", "value": "27677976af97d3aad0758508fb3cd53b8a100dea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763790612, "uuid": "2d73e32d-c987-4448-9cd8-1ec961c56567", "comment": "Malware payload (Mirai)", "value": "14e5e14eddcba92f1257292cec089d28e1ae6246dad04ae585580d1a4dd6c9b81d6e744fe332dd2632af202ded8849f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763790612, "uuid": "245579b7-5186-4682-a64d-75d6edae4938", "value": "T1F6D3CF31E0546DD1EC100AB93C7996BC0750EEB013E655C2EBFDF99EA07BD8839AD621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763790612, "uuid": "f9ddd364-9aad-4e04-a64d-e5045260cb84", "value": "3072:ck2L/TEVIYlbdfarlPNwZIxJKoE0IUQG+aYFj:ck3hlJfarVf60ITGmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763790612, "uuid": "cadd2f65-cd51-4f3d-a295-e7622d115987", "value": 131708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763790612, "uuid": "9b415555-b781-4220-9f7b-59d37546672c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763790612, "uuid": "0611a5c9-d00a-4917-b713-40d3aca9cc73", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d8ac3d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855512, "uuid": "b9ac33b9-af72-4140-aa68-b879d7cb29c1", "comment": "Malware payload", "value": "38cc60ed70305a96a5b3217df25cf273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855512, "uuid": "63c47273-f4ed-4f37-bb6f-212c22c7de89", "comment": "Malware payload", "value": "24974961f3e42dda9aebf74c942fb2b80dd2b86c5aed94f7e963e8f39b000bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855512, "uuid": "bbebd171-d485-41cf-ae70-22d7f0757629", "comment": "Malware payload", "value": "43c9dc50d86e40adfc3c4c785bf470c3ad6ad877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855512, "uuid": "78f9d32f-7677-4eee-82a1-30966068bbfc", "comment": "Malware payload", "value": "1b8e5b875eebb33ae52a47b1897e18c7e313a14eeae4b1a1d0d7edbade9f7d5ade262ae13e35141ec9e95ef14181df37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855512, "uuid": "a5a068d6-b929-4a0c-a25d-cd5e21cab0c5", "value": "T158E54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855512, "uuid": "7eea4802-aa98-40ca-add5-87565f19138c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855512, "uuid": "ea561fa0-21ed-4316-864c-6f7fa3675705", "value": "49152:DvHlL26AaNeWgPhlmVqvMQ7XSKOCK1Jn4oGd7xWTHHB72eh2NT:DvFL26AaNeWgPhlmVqkQ7XSKOCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855512, "uuid": "a864564f-afaf-4f76-ae0b-53e2ab2c9db1", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855512, "uuid": "b12150e4-9dce-4f20-829a-a98ff5eafb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855512, "uuid": "1a936731-b8fa-4a09-a3a3-d160aadc89eb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09b2c41-c79a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763812791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763812791, "uuid": "e313d752-1f26-4b2e-b444-02badfb11fab", "comment": "Malware payload", "value": "41204aa5964a8fad2426987e85106674", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763812791, "uuid": "f4ca2eca-93fb-4ec1-9195-4a879e78cff3", "comment": "Malware payload", "value": "24a204f0443399de0d7656d47765d269891031d5f30ec909266290fa3410d162", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763812791, "uuid": "160ee384-0549-4241-af40-57c5e2916b8f", "comment": "Malware payload", "value": "a5b3e0486ebccc1083797d4ef11b2d513c3ebc37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763812791, "uuid": "8d0990eb-1b41-463d-a9df-bf308e7db310", "comment": "Malware payload", "value": "ca5690ccb15c85e8156e04cdd5d868357275b97dcc291705c38655a3d3ea2486964421f2532ec04cbed4fd2cb6c0da69", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763812791, "uuid": "8d9e7f47-cd11-41c7-bab2-f10b44a9f28d", "value": "T13601A5CE6B577BB10869ED297A628C5D4050538C1E3E17E87C8C09BC4891E927168E1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763812791, "uuid": "2935abd6-20bc-4c54-935b-20d5f8ad2dce", "value": "12:3VjKw3Vdo9oPVnkFUA1VUkQUW1HTCU61CQpzdsPQtEOXIWu:gj2kz4kQRTCfqQrXru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763812791, "uuid": "d7ac3cf2-aacc-49ec-a232-c74f628e1ad6", "value": 780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763812791, "uuid": "a18e3f86-c76f-4e50-896b-945980b74f00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763812791, "uuid": "26311c11-55b7-4390-8842-a40c3ab35dd1", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ac20e7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855513, "uuid": "f6f6cf6e-9b0e-4bb9-9ad7-79cc3468e44e", "comment": "Malware payload", "value": "f59c5b33eb5b9fd9a06ea49bec8113e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855513, "uuid": "fd6b4931-a81a-45cb-90fc-f4ea03175ce3", "comment": "Malware payload", "value": "250a4d66b7a2ded62426b25eff7edaa1a69bdb27729edd0ce8d1926dc9e0bab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855513, "uuid": "49e8a83d-f34c-40aa-b194-4154d69ade7a", "comment": "Malware payload", "value": "9067b443585e53b753b7e955fc2accbee3b60767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855513, "uuid": "5bc10c1c-97c7-4a0c-b080-71479d0315e2", "comment": "Malware payload", "value": "d6a67c740d8a1331d98e71f8f529e6aed2799a87594f0f89b8cff5389e4bed70f57f83d3ff94b70f1047a64e14a43d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855513, "uuid": "1ecfa896-3735-4794-a30d-262a0115bbe1", "value": "T19FE54A183BF85E32E16BD67395B0501663F1F82AF363EB1B618167BE1C53B409C416AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855513, "uuid": "7e866703-565d-4b1a-bf28-23544f8a25b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855513, "uuid": "d8cfb09c-61c7-4ca1-895b-e4a5256dc5b7", "value": "49152:PvulL26AaNeWgPhlmVqvMQ7XSK1cZ3mKevGEOoG9HsTHHB72eh2NT:PveL26AaNeWgPhlmVqkQ7XSK1ZK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855513, "uuid": "9b743763-e306-43d1-a33a-a7f9e69a8e12", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855513, "uuid": "c9962014-06af-4489-a59d-d876670eac56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855513, "uuid": "221a337b-6bb6-477d-a25a-8fa75c706675", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39821ebe-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855514, "uuid": "947e8afe-4991-4ab5-af09-e10c3dd244ec", "comment": "Malware payload", "value": "48472b0420994754020453fb9ddb35a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855514, "uuid": "7c2b09b3-aa65-4206-9ff7-9b9f2d31861b", "comment": "Malware payload", "value": "25685a5024b443d6b2d79f29816ab2ff0a32d5de8de76f71baf092e3fbea6bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855514, "uuid": "fe5cb241-47f4-4022-94a8-ed392a5d8c62", "comment": "Malware payload", "value": "a0e7fa314a7894e31f464da379fbba4e8d54bd72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855514, "uuid": "080e71d1-e46c-4167-a93b-1e3130b9ef1d", "comment": "Malware payload", "value": "bb1a9799211d92cfcb5b5ab06cabc71507ced84ee2fbee4cb4803e28754acd263d406cbf21ea35a318b84da6981213f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855514, "uuid": "59b1421a-17b7-4de8-9763-5cff0a3c6aa0", "value": "T1E2E55B0437F85E32E16BD6B3D9B0501367F1F86AF363EB0B6191A77A2C53B5048426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855514, "uuid": "799b693f-f28d-465d-9049-3067d7fce8c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855514, "uuid": "cf578cc1-86e1-45a7-8fb0-f671eeefa6ea", "value": "49152:hvGlL26AaNeWgPhlmVqvMQ7XSKMwG/oGHEy/THHB72eh2NT:hvGL26AaNeWgPhlmVqkQ7XSKMw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855514, "uuid": "65bb9dbf-e362-455e-9c18-b221883b4b75", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855514, "uuid": "6212a3bd-c5b8-48a1-b08e-1c27a3f5611a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855514, "uuid": "77259508-a246-4b74-a092-86ccbab27a09", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4b1c97-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855516, "uuid": "51fafdbe-a96c-41c1-81b3-8056b9d61358", "comment": "Malware payload", "value": "3dd3a1ba3397fe90bb75869c2991ee40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855516, "uuid": "bab801a7-cf82-4a14-a0c5-23f03e8d3231", "comment": "Malware payload", "value": "257e1cbe9172544643999a04ca0e8e79192761a486e4cab1bd1230b265ed7614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855516, "uuid": "bb382741-71bd-47fe-a078-6403fda4aabe", "comment": "Malware payload", "value": "051f885833dd75e4b4a9673587696d5e878765c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855516, "uuid": "3057588d-90a1-4fb4-8ff2-6a78d0d1d9a2", "comment": "Malware payload", "value": "848b31ef476f3fcf379e0fd536b3e43ce1ca6ac1c4d3bc9f2ed2435767a37e7ed208900945b34c00696acde505db27f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855516, "uuid": "e0614e43-7e9a-40a3-892d-e95a32992325", "value": "T18A85E010B7F94106E2FF5BB8A5B644440777B803DA36D78E0A8CA49D1FA3750EEA1763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855516, "uuid": "3bdcccf8-6518-4b30-9721-e9d775de48a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855516, "uuid": "c23dec10-1c23-4599-abbb-c97d92f09ad8", "value": "24576:RTFQOskDS2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r9uKVp23U:RTqOvx7wR2EgKKm77LrwCB6VE43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855516, "uuid": "1e902f84-8bde-40e5-aeb4-1b75ceabebbd", "value": 1729024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855516, "uuid": "cf5df6ae-c783-4cda-a63e-6ba034610f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855516, "uuid": "159aa309-9cd0-4ce8-bbe1-3b9f28ada47e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2feade-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855517, "uuid": "058349f1-fca3-4731-8db2-82040876d83f", "comment": "Malware payload", "value": "861136de95d7f2e87836997cd08edcd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855517, "uuid": "f7b4a945-a7e1-4047-a930-130fd18faafd", "comment": "Malware payload", "value": "260a786306c094c3cc3cd87132fb105bb2804980f210a59c7b823084db1d83e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855517, "uuid": "e9da3286-5e3f-44d1-9446-2e32fe6da7b4", "comment": "Malware payload", "value": "d65f15f9e0f1961d5e3156ee71cb1cb1d14aead9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855517, "uuid": "6686a1d6-25b4-49ea-8a4a-bbd40ab36f77", "comment": "Malware payload", "value": "e7d6562548897e559486ec392e68746d9d3428833c7eadc94d971c60440e82ad1ba8e9e4a8bacddc135e5c8329278ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855517, "uuid": "77c79c5f-ab7e-424d-a67d-474b0a128e9c", "value": "T176655B12BBA85F26C84F26BEF470781212B1D0165743FB5E169AF27E2ED17818E067D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855517, "uuid": "fc0b6a51-d1ff-4ebd-9a26-c7084c4ee7e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855517, "uuid": "ca04ec83-b28b-4b97-aafe-58b7455c953b", "value": "24576:EUn2Dk/oOgufwFAujOowX1Auk2owUdah:EUn2CohOow+uk2owUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855517, "uuid": "6a169946-7dd7-4df1-b14d-27ac22b38f07", "value": 1466380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855517, "uuid": "5dbf58af-4c8e-4ef2-a828-9070c442dae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855517, "uuid": "5ccc5608-87a2-4e68-837a-88c0dfe54d5a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0a2134-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855519, "uuid": "b80558c9-14b8-4a31-8b9a-aba2a79230b4", "comment": "Malware payload", "value": "a988af02ebe2705b04c208baa2ed4d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855519, "uuid": "273703aa-d856-4540-977c-9b8ee5135240", "comment": "Malware payload", "value": "260abaccb23ba87003dd80a4c9cc7a1c9a2696dbc0b2aa2fc9e264af3d91c814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855519, "uuid": "4a6bebde-b143-4a90-b2fe-3ee391212a1b", "comment": "Malware payload", "value": "a3f4fe7d0b3eb54951fa9a7f3e324ab4edd65011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855519, "uuid": "14274e48-7398-4df7-942f-747906fd26f0", "comment": "Malware payload", "value": "14c28b7bb0832619c22f00b9c2df87fa460cde0a699124ec49160ae1226f88f063ae3a4f1b8e9f4ea458955dd90cdbd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855519, "uuid": "5c9b8e02-ea9a-4d94-846a-c8e1a8e80a1d", "value": "T1F7E55B143BF85F23E1BBE273D5B0041667F0EC2AB3A3EB1B5191667E1C53B5058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855519, "uuid": "19e0ea6c-a77c-4248-b3b0-e16034c325d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855519, "uuid": "418939d9-908c-4554-b0d9-5472c2c30f0d", "value": "49152:9vLI22SsaNYfdPBldt698dBcjHGkgrWk/JK9oGdIcTHHB72eh2NT:9v022SsaNYfdPBldt6+dBcjHcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855519, "uuid": "c07b92fa-6d77-451c-9abf-e0cdd0480586", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855519, "uuid": "129ce3af-72d4-4ce7-8869-e993cc7f2ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855519, "uuid": "f1cc2799-d9d0-4f7a-a693-4ed6356bdc32", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfe6b72-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855520, "uuid": "18dd5921-cf95-4aac-aeed-0f18ae8eaba3", "comment": "Malware payload", "value": "50a9c0fb1398fda4257989b2b8cdaa25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855520, "uuid": "9b83a126-689d-4c8e-b858-1422270fb370", "comment": "Malware payload", "value": "263249d399c163a071ddac69a0793946a3c6e27f4d54011cf3694ff6131e82b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855520, "uuid": "4610548d-f2e2-4b65-87c3-8ea6828c5fd5", "comment": "Malware payload", "value": "95a082931c3f33654016bccd2d1d366082aa99f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855520, "uuid": "7ae121d6-d2a0-4685-8fac-c6cef51fac8c", "comment": "Malware payload", "value": "c503b050c6496a40904b4e84f6d14501094c4e4fcc14c9a5d43e6046073aa50a4d328193dbcc217f41804f4761bcaf8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855520, "uuid": "b7fd4cf4-70d3-4a7a-96fd-474a490feec9", "value": "T1D1E54A543BF85E33E17BD2B395B0501667F1FC2AF363EB0B618266791C53B40A8426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855520, "uuid": "19f308ed-b30b-40a1-a6fd-3df6c8fa3e97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855520, "uuid": "5539e67f-916b-4450-b2fd-477597d476b6", "value": "49152:jv/lL26AaNeWgPhlmVqvMQ7XSKEDFOBoPd1oTHHB72eh2NT:jvNL26AaNeWgPhlmVqkQ7XSKEDFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855520, "uuid": "4a9e83fa-944f-4389-826a-f5e37f98d92f", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855520, "uuid": "73584632-408c-4082-ab7f-bef1532387f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855520, "uuid": "7dd71a45-bfb5-4b9d-a419-4f3b30068f25", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26908d74-c765-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763789770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789770, "uuid": "207278ab-7d05-423a-b419-196c7c8cfd8a", "comment": "Malware payload (Mirai)", "value": "06d3c37dc59b3f74d5828cd73c75d151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789770, "uuid": "704e4850-2e22-4a43-a7b1-26d4a41c2a98", "comment": "Malware payload (Mirai)", "value": "266075bd7c6214675d4ecfe9e80b9c7297ef7c6bc721346b75b91c56e3edb746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789770, "uuid": "dfba17a2-6b5c-4a5b-b658-5d44e80f0016", "comment": "Malware payload (Mirai)", "value": "abc4ac449bb87fd3d42a61c77de570bee7b68cc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789770, "uuid": "8b14b2d2-f585-405d-a617-7d771ccf099f", "comment": "Malware payload (Mirai)", "value": "b9388f134d5fb67af3732e60ac8d2a0ceb8887e79b97eb99e430fecf6ff901202d783accb9c4fc9b19a8ed6e0f3151d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789770, "uuid": "09277acc-473d-4d92-9468-05b0c91ff0e1", "value": "T1D8935D02B34C0E43D1676D747E3F37C5D39AAE9012B4B688255FBA498176E315287ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789770, "uuid": "441803d2-92d7-4165-94d6-ccf988c7078f", "value": "1536:WIoSS3bn7bjM3R5CUsaK0ILpm6RzkJDuQ2hN/yO9yWHnN+okemWdW:NohD8REp0INt4x2hBy0YCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763789770, "uuid": "ac928d1c-5349-42e6-8d6d-260d85ec80bb", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763789770, "uuid": "0e172502-98f8-4928-a870-a1d1746b1781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789770, "uuid": "f2f24193-5374-4e86-b49b-d8c82d944c5c", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de2bc05-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855522, "uuid": "dcdd3321-d058-4f86-a510-b6b8d9f57561", "comment": "Malware payload", "value": "c739764732050b0bb848ef5bcf85c819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855522, "uuid": "05bb039b-b694-40bb-a6e2-3076083d3516", "comment": "Malware payload", "value": "26767d1813804ff8015cfe84f143227a9bb43e01506c5732fc8d4acea572eee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855522, "uuid": "923b48fc-bfac-4e31-bb1d-52c1eeca8f2f", "comment": "Malware payload", "value": "eaff6dfc82b23b4c897c88040324a42e603b1140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855522, "uuid": "cb70dad4-4d9c-417e-a71f-7a19701507a6", "comment": "Malware payload", "value": "98fce8476cb35b866f2a21488786a0b509ccd5cbf22eb57761a3e534ec015742d7b6e3959fda7b5b2d35471bf2fc956a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855522, "uuid": "ea41286b-a713-4f37-8048-a42a172e63ec", "value": "T139E55A1437F85E22E17BE6B3D5B0501263F0F82AF363EB1B658167BA1C53B505842BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855522, "uuid": "fa53e75d-8f5d-4be3-9580-a042e15afab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855522, "uuid": "56ab2595-81d8-4d86-89ac-71a0f0070f64", "value": "49152:lvUI22SsaNYfdPBldt698dBcjHUCqAvJqToG2JTHHB72eh2NT:lvZ22SsaNYfdPBldt6+dBcjHDqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855522, "uuid": "6bf82179-a68c-42cd-9cf4-f3b1b8469601", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855522, "uuid": "7f97c811-e964-43b5-91ae-ef7a94d299ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855522, "uuid": "16eeb4af-e560-4f9e-8a62-932437938943", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0c5d5b-c7b7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763825083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825083, "uuid": "fea50360-28cd-4796-9cfb-5689af6ae8a0", "comment": "Malware payload (SalatStealer)", "value": "1caf9803963662f986b596e7310de9a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825083, "uuid": "41568f89-8a0a-48f6-8e24-290a2329f608", "comment": "Malware payload (SalatStealer)", "value": "268f5a815f5d0d673807a35dc9604a95af40fefbb2fe478b2ee0981b70afcd1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825083, "uuid": "32c459e5-1afb-4607-bfa6-5738412d9f8a", "comment": "Malware payload (SalatStealer)", "value": "4ce868ca240708565a2020d2c7e181266db751fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825083, "uuid": "ca37fb6f-d315-4ce3-bd12-299527caede4", "comment": "Malware payload (SalatStealer)", "value": "cf75c0da28c24bf09eeaa1feab1bb2314398be9f16e1d084b7f07762e796b304cc07df8764bfb6977a87024fd68d2c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825083, "uuid": "27c337cb-16bb-431f-addf-38a1d8598d7e", "value": "T14FC65B51FA8B94F6E9031831405BB23F63305E048B28DBDBFB547B6EFC77681196A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825083, "uuid": "5f5385e0-b359-47b2-b2f9-c1e1ca651cd2", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825083, "uuid": "e998d9df-e895-493b-90de-e16a358cbe4b", "value": "49152:r0mmIKMKxh7WPXLj3yHMk3aEsY2XygWtAnGn/bUIQNKT/RJCx5rzGybrhFTdlzkv:gjILMILOc3DphrzLbjt5cgO9SN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763825083, "uuid": "2c7cd51a-22a5-4376-81bd-8db8d13f89f4", "value": 11657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763825083, "uuid": "67c04912-47d0-4172-b090-42bb67c35ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825083, "uuid": "332f870b-fd3d-4d62-96f7-91aaff2fe63c", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb1fafe-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855523, "uuid": "faf5a1ec-776a-4fc2-9731-f236a1bc0edf", "comment": "Malware payload", "value": "59f8f6632d2a62b4553bce004812114e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855523, "uuid": "89973a86-37ae-42dc-a187-98de2dc5353a", "comment": "Malware payload", "value": "26a50bc4f23fc1dbc973366b973764a6f9e081f2c5ab77d84fa3e483e4c41809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855523, "uuid": "d917ee2e-71b7-4983-a21f-1fa3cbd81ffe", "comment": "Malware payload", "value": "1d7a253bf63e6d64b0eeddf595b3293a6a864b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855523, "uuid": "aefb9a5b-0a42-4311-81db-4e60e05707cd", "comment": "Malware payload", "value": "e8285c97f94a5f6c203afa55cf834334c767dca2dd5e06d0fe9ac2110f8a88eac086345e9739168e078e7fabee52d29c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855523, "uuid": "60cc1df2-ccc5-4d39-b240-5cb9924e4aad", "value": "T195E56B0437F85E72E16BD677D5B1501263F0F82AF363EB2B2581A77A1C93B5098026B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855523, "uuid": "967a9c18-5034-402d-8752-5f9a45a932b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855523, "uuid": "8aa1e6a8-4e97-4d8e-837d-ce8f1f932db7", "value": "49152:CvyI22SsaNYfdPBldt698dBcjHx36AcvJVBoGdjBcTHHB72eh2NT:Cvf22SsaNYfdPBldt6+dBcjHcAqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855523, "uuid": "bc347a07-31af-4845-a28d-83d4ad576783", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855523, "uuid": "eb416af0-ade0-4e1f-ae0a-5667f345d72f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855523, "uuid": "40b996d0-41d2-4da6-baa7-c986ab6977a1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d35c77-c75b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763785762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785762, "uuid": "dfd729df-7700-4336-99fa-7fcee11f11db", "comment": "Malware payload (Mirai)", "value": "c54864c689907849143cb433e973c163", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785762, "uuid": "6b60d382-7d46-4280-957d-3aea915f3309", "comment": "Malware payload (Mirai)", "value": "26adbbf6c1d2d92241a8707e1ea2227c2b9c2cc59da584121c03c760e606b205", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785762, "uuid": "d7562085-9325-4385-aaf6-9d343e43a67e", "comment": "Malware payload (Mirai)", "value": "506bd2ae02f3220307dddfb07c186e6684e0eefd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785762, "uuid": "22ebbc36-8d06-4e25-bbce-a448e4c79457", "comment": "Malware payload (Mirai)", "value": "50a29b3c70bced5602102671586c6af0cb184f0312e9faeffeb2712d7a2c1e0ee00c62719705e4e323db22357a873f37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785762, "uuid": "7c1d9027-1dc7-4888-9e73-5b2d93eba688", "value": "T1DD23F163C655D528E03A9AF3A150A8CCEF363D27715A13BF34CA766F1CAE9181712F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785762, "uuid": "07286716-765c-4a24-9086-68ebdfdacbbc", "value": "768:ttB548w628WWpbLcWgmvRA65MOTrrPSPEDWxPn5fu4syazOGytVYKXlx05b:PBw62YcWJDSOTrFihxsyazOG4NVAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763785762, "uuid": "7432a93a-9e32-4c37-964b-e7d7f955f04f", "value": 47924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763785762, "uuid": "c9315411-e2bd-4fc7-8a4a-6d8fc769aa61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785762, "uuid": "4364fac8-333c-4d69-b4da-1e5e77d48305", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7520bd-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855524, "uuid": "979daa10-a32b-4c71-a41b-a2470bc4a32e", "comment": "Malware payload", "value": "0752295912d2235966579c681a276672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855524, "uuid": "f510e273-f98b-4e91-b04f-10e1b8474ed3", "comment": "Malware payload", "value": "26d1505051eaf19b2e206da30e55558df09c8ebc8ea5bd18c4c19f05be247d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855524, "uuid": "d85b3a26-54e6-4989-b847-93990765b857", "comment": "Malware payload", "value": "cece4f23f62cce4ec9bb82b02619b68684246f19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855524, "uuid": "51ba264e-bcf7-43eb-9407-dc62d9bb9cf0", "comment": "Malware payload", "value": "e42d6f4c41f33a5055b1f7f84622abdc0ce58cdaa00568b18daac1e7cac1316fc8524a7ca854e8464a5a68157afc0f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855524, "uuid": "70578615-7760-49d3-8d95-f68f28e77bf5", "value": "T109F46B4073F8E61BD2AE5775E9700D2A07F6F026A762EF5F4944A0F92C93B419D423A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855524, "uuid": "d291c49d-0fac-4302-a209-7877a5fe91ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855524, "uuid": "f7d9fd78-333c-4f56-8ea4-ac135b32fb93", "value": "12288:wMcQNc+aZdc42rLC6eFqbl+1JHNOopB8LM:wMcdF/cXrWBqY1JAopB8LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855524, "uuid": "9bf8a485-f79a-423a-aa06-f4592d833d72", "value": 745484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855524, "uuid": "196b54f7-ad62-49b1-84e3-c879ff42d9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855524, "uuid": "12d1f542-472f-4478-b30a-21f826d62953", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40485d91-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855526, "uuid": "8a7067f8-7634-4992-b5fb-f086e2a16280", "comment": "Malware payload", "value": "97f5dd0b2452e67d968915b0a90bd7a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855526, "uuid": "c5f1be86-7a6a-4f31-b276-37eba84f9f78", "comment": "Malware payload", "value": "26f501194c730559dc3b2588291cc6dff826315a1632f101b2d4e354b80cfa65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855526, "uuid": "5e52d20a-eb75-4a3d-8255-afcd047a8ca0", "comment": "Malware payload", "value": "ba3efb39a0acf13b69b0052c1e00bdb5761e6980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855526, "uuid": "a95cc3d9-bf5b-4d5f-9ed6-be5449e57b35", "comment": "Malware payload", "value": "7b2c92ff7103bf00d803b2ce1d52c5bfa1ce63a19bf8ec52d56a633ed7c53237ee6ff8d8ae445d0692b65ec82089d412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855526, "uuid": "38f065ca-0612-490c-be10-88214344ed6e", "value": "T1EFE55B0437F85E32E16BD6B3D9B0501367F1F86AF363EB0B6191A77A2C53B5048426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855526, "uuid": "6a13b1ac-09c6-4fc2-b1f0-49dcdedeea91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855526, "uuid": "bcce46c6-eb1f-452d-9a67-80744dcdfdca", "value": "49152:uvGlL26AaNeWgPhlmVqvMQ7XSKMwG/oGHEy/THHB72eh2NT:uvGL26AaNeWgPhlmVqkQ7XSKMw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855526, "uuid": "57a71240-dba2-4282-be63-e4f7b85fcbc9", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855526, "uuid": "f8279d7c-c38a-458b-8518-74ece5cd864e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855526, "uuid": "4c6bb3a7-0458-4d55-88b2-56e297e9e90a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0faf6657-c764-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763789302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789302, "uuid": "cd0982ed-2fd1-4045-a379-6d563f08d0e3", "comment": "Malware payload (Mirai)", "value": "d6d26dbf6fd7e4277e1c865fb2f4a272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789302, "uuid": "91619d0d-b2c3-4b3c-bef3-0c17bab542af", "comment": "Malware payload (Mirai)", "value": "26f9d21db75b2aa75ff41ed630462b1a6088343e2c2e4f4df45174b79e5d6c3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789302, "uuid": "86343020-c610-4e5a-8957-892a6c975221", "comment": "Malware payload (Mirai)", "value": "10582ea1a5d6e7a8b58dad3ea8fb15413fa26abc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789302, "uuid": "b6a36917-623d-4f31-a79f-f46461e266f2", "comment": "Malware payload (Mirai)", "value": "dc96c23cb390d6fe3447a4c1b24593bd017c42ad32bbe05aa47445c4818dea3cf65d6f1c58c300cf24a4d607937bd424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789302, "uuid": "3ee1933c-22c0-43d4-8567-87b15fb283d4", "value": "T1B724E758F4508B7AC7C1217AFB55428D33735F68EBEB730589386B387BD6A255A3E200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789302, "uuid": "18cef330-fe0c-4afe-8439-85d4c8dd86e5", "value": "6144:TYTqMePba7tkZLI9NSloOkWrbobCtsWP7q/27Gg:cpeT7ezOkWrru/27Gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763789302, "uuid": "11e01c30-e9b8-437a-9bdf-cda2e3dd0605", "value": 216548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763789302, "uuid": "eaea3956-7983-463d-9d4f-7e6d91e301a7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789302, "uuid": "fdc8c789-e4b1-41e7-988c-d90e467f769e", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e41fbb-c7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763851720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851720, "uuid": "90bb1cb6-4e4a-4170-a2a3-95d8e44c6068", "comment": "Malware payload", "value": "a34ed3654424f72b99ff6da694d7388e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851720, "uuid": "b9956091-0fbe-4fda-b9da-01e3f118dedf", "comment": "Malware payload", "value": "27262f4bf8096f04e53309d4ce603cfbeb27ed10abdf1c461d3ccb14e012f61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851720, "uuid": "c87ff482-90e8-498f-9df2-9b4c4a15a35f", "comment": "Malware payload", "value": "9865b20e5d182cf3cd08eac006d41d4e9860da3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851720, "uuid": "ea88015b-11f6-47bd-b581-251b5ae0b737", "comment": "Malware payload", "value": "a903453a4e8f5948da02d80c0c0ad331ee5534c28e02f230eea407845af6b23ff0aed4b4766083f873b578373489e636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851720, "uuid": "7428b460-2901-45da-9d02-4ae7ca213218", "value": "T14DF29E07E6800913DEAB8E79A4F692C1CB30F38768C3E3A671D891BD4E523551B5E76C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851720, "uuid": "c30ffdfb-9c0b-4c0e-b451-dbfc1ba4fff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851720, "uuid": "bc6bc498-b2f7-4d15-a3dc-c92e0f04ef96", "value": "384:+Hy8dxVBUW/R1J0boP+nVE3RYAmy/JVE4oVNJJnZL/uo6ki2itHoi0aU2YWy8Rbm:/8LVBUW/KsIVgPo/JZCr2ETOg5ALAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763851720, "uuid": "c4726f01-e478-4dbe-a9d3-94d2289a04b5", "value": 34664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763851720, "uuid": "40fae6f7-ee7d-4992-bda0-964c5e8f1940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851720, "uuid": "72605777-48ec-437b-946a-6d2d5c2ff5cf", "value": "Easy2ConvertUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4119c141-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855527, "uuid": "f0e502cf-efa8-47ea-9b35-2e24bd59a3c9", "comment": "Malware payload", "value": "9660b4afba16e725a7086150c667649f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855527, "uuid": "62600eb8-2136-43ee-877f-913d7a07da0e", "comment": "Malware payload", "value": "27a0393aef65bdd9ed7d22908b5ed18467b4481f6adc68b792b32b8ae60a6029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855527, "uuid": "0ceeac9a-5331-486c-8170-84a761fdb451", "comment": "Malware payload", "value": "39087f51d8f0b5aef98f9c0a9c3405ee5af58e30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855527, "uuid": "07e55263-f4a6-4bb9-84c5-8ae3cd252887", "comment": "Malware payload", "value": "3252bf30599ef742aaf9f746caecf5b8f0268a27d3cfa17ff5f3a5096b26e282d20fb9e33a40b7ad2c153f17aac8c0b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855527, "uuid": "c2a12a66-f75f-422c-944f-d1c54be6a3ca", "value": "T120E54A1437F85E22E16AD2B3D5F0501363F1F82AF3A3EB0A618167BE2C53B555C426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855527, "uuid": "91516e10-6dab-4213-a5f3-9783f4139951", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855527, "uuid": "592bb6b5-ce3b-46eb-a90e-de64deda429d", "value": "49152:jvxAd23law6wGPAllX3SSLNUpyNh0yXqQmoGdzTHHB72eh2NT:jv2d23law6wGPAllX3bLNUpyNhBXqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855527, "uuid": "b39b6873-e40e-4ef3-a9ac-1ddc83f8f0c0", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855527, "uuid": "86fc8fba-9ea7-48f8-bf96-f270d24b2c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855527, "uuid": "8b0e7f08-616a-4f41-8fd3-ced751eee1ee", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849c0f16-c7b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763822999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763822999, "uuid": "8d195cb4-995d-4499-9111-f72a774eac4d", "comment": "Malware payload (Vidar)", "value": "f52504c4ddc8a8aaa05aa6a001844f92", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "nploits-com", "colour": "#B433B4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763822999, "uuid": "fe2e259a-3685-4b0f-815d-857aafe1d685", "comment": "Malware payload (Vidar)", "value": "27e8a91f6006e57f8e2370fdabed117932b147d39a04df1ea7bb3572536d4fe0", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "nploits-com", "colour": "#B433B4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763822999, "uuid": "29655df2-95b8-4acb-92c5-898b0df0b3ca", "comment": "Malware payload (Vidar)", "value": "79a659b0bbc409ef24a08c905b70169c2e9dbafe", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "nploits-com", "colour": "#B433B4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763822999, "uuid": "e3c14152-a1ef-4098-9184-6e9e90363703", "comment": "Malware payload (Vidar)", "value": "09a64328260e77f77797e4c9605150306f71cd1196bd7d0ffc5bb6f5fd313f7000ae96d42891a53f78ea48d5f961a1c7", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "nploits-com", "colour": "#B433B4", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763822999, "uuid": "02d125a6-95f4-4e91-8458-7db72da7794b", "value": "T12B4633D515E3F332DC3963FC5A6A0DB8B639B250172FACC58DE8B0962F46DA861C95C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763822999, "uuid": "b9ffb536-73af-4d2a-a026-0e3b9cffbe03", "value": "98304:Ch47OdjhIpQln8/P4F39BrdaP4A3hYPvKvvxmxtIha0ypKGaJXux8FFD+S:itJhZln6P4xcP46hY0DQ5p2kqFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763822999, "uuid": "75402243-c87e-4ec1-b0d3-c32f72d26bd1", "value": 5396136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763822999, "uuid": "6cfef91a-8c5e-45e8-97e1-b563614d47b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763822999, "uuid": "4eab59b7-412e-4702-b2c1-c95d5cca2538", "value": "Net\u0445-64x.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41defba2-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855528, "uuid": "10339df7-4e8d-43b9-b924-7b8bbd3fba83", "comment": "Malware payload", "value": "4752226540d5e9f2626db1d02c349663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855528, "uuid": "985a26ef-948f-4cd8-b8d5-dc0e99b5bb8e", "comment": "Malware payload", "value": "280df28f8ee799102a5073d1d3abb3b491756b812e1d20a07fe9004074f6d463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855528, "uuid": "cbe54d9e-93e9-4e13-bc64-b1685db59a73", "comment": "Malware payload", "value": "9ba6f5a33bc5d3cb5433250013b6a0de74889acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855528, "uuid": "730c9b81-ccce-4e2e-a587-9f13d6c388b8", "comment": "Malware payload", "value": "b9d4cdd5cc899adec12ab55ca1eb72a81a96deee7dcfd97eb9f83530e8d97b7928486299caf91b902692d42cff0976c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855528, "uuid": "c4b320a8-d512-419c-8c59-f618f99f1a67", "value": "T1CEE54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855528, "uuid": "490a61dd-4b1d-4774-a1e3-73f3fc8d9fb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855528, "uuid": "ba325bd2-80a3-4f9a-8297-9433cd159875", "value": "49152:tvLI22SsaNYfdPBldt698dBcjHA1JAIoGdFSTHHB72eh2NT:tv022SsaNYfdPBldt6+dBcjHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855528, "uuid": "cf3ff03d-d384-4000-a9ad-67376415289d", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855528, "uuid": "b50486be-3174-4a72-b4f5-0912a4f9bfdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855528, "uuid": "7c0efc71-78d8-488f-a03f-180abe846006", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c897bb-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855530, "uuid": "7f80699d-60d3-4f18-b272-39c1e0dbda6d", "comment": "Malware payload", "value": "53272c4cb0295606d5361e9f1df43b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855530, "uuid": "063ceb95-93b9-47fc-9ddd-641204323fb4", "comment": "Malware payload", "value": "280f6c53f1bf4e3f0add2dbce5adafe773b5668cf13924a4f640f53b5a171f01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855530, "uuid": "ae3fc526-b86f-4055-9dfb-939395d5e357", "comment": "Malware payload", "value": "cff7909189f4844b0b8987ab385b0a00260c82d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855530, "uuid": "016e5807-6a0b-492a-b718-ac4c30b509eb", "comment": "Malware payload", "value": "68e2262609f91246bff03f39d28e11484943b5c195cb0fbe15caa41edcc8a1e7f3724f1fcacf219d01dd56eda70334b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855530, "uuid": "b3e327ac-da0c-4237-99ca-b80022708ed5", "value": "T103E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855530, "uuid": "590e1c55-1b88-4ca9-bea0-d36be2d2d9b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855530, "uuid": "8b6e9307-27ad-4250-a996-c3044acc05af", "value": "49152:vvXI22SsaNYfdPBldt698dBcjHY0RJ6GbR3LoGd0THHB72eh2NT:vvY22SsaNYfdPBldt6+dBcjHY0RJ6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855530, "uuid": "e7cf8ddf-c0b2-44fb-aef5-499e67907ad1", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855530, "uuid": "e455ed70-8352-4b1b-98ba-e4b9d5a36874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855530, "uuid": "98ec6a20-0e23-4e8d-8ad3-9f0a15017dea", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4385c90c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855531, "uuid": "7e309256-8d9c-46f1-8072-d1db53ee1242", "comment": "Malware payload", "value": "78f6147b15865a1537ccbec975b26345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855531, "uuid": "75a3319b-3ea4-4d34-9346-1866cf39ddcc", "comment": "Malware payload", "value": "28164c9a2f3a5b51958c964a2bd47962ccd94e6fdada019ab0438d0a2a20a7c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855531, "uuid": "47d5a3ff-ad5e-4725-823a-a220c9462b23", "comment": "Malware payload", "value": "2dd390faefa14134a1cf27357183fa45661518fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855531, "uuid": "ae820aa9-9389-47fb-89d7-c6ef0d7e6e09", "comment": "Malware payload", "value": "6055467d6e5793f1ee1e4c5435dffd3da1796f9179aab18e996c0c6f0a8c0d6dc16531f8c126febe665b67cce7a99e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855531, "uuid": "784c598a-0ff1-4677-b4fb-3fcc423f94c8", "value": "T14F846A1373A4AA3BD1BE173BA03206155BF4D503BB16E38B5A6855BC6E133868D907F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855531, "uuid": "4af7862a-306a-4fd6-8b30-e5430d28fcda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855531, "uuid": "36598449-36fd-424a-bca4-8e408a3f9ba2", "value": "6144:HWL+PQIshfTR7dkYsytbu5Dmmsde2mpZu:2isoyg5Dm5E2mru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855531, "uuid": "7b880bac-fa9c-4375-b614-dfc8351f06be", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855531, "uuid": "752366bc-0312-44ad-a39a-294c5f2fa882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855531, "uuid": "0b300212-b00f-4025-9fae-7af92283d090", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44615df9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855533, "uuid": "724d581c-334d-4d16-9f44-7a597294dbed", "comment": "Malware payload", "value": "83ae6c345b256f7b0b99372b574cc292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855533, "uuid": "98b19d54-9128-454c-995c-1474505b10e1", "comment": "Malware payload", "value": "281684176cd1e80d4d46082b96a4d0c01cd0e84e1ad10207b57b10031b692508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855533, "uuid": "854ee1b4-d288-41cf-b5f8-c20d710d48ec", "comment": "Malware payload", "value": "a29b9fc2854ef869bb261970f9ff3c0af2cde755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855533, "uuid": "e13ea395-f5aa-45da-8236-234bb0ba3e97", "comment": "Malware payload", "value": "07d8e55a0eeb3118173fdc97069598c0e12dc9248d0c3ded007045ad097cddbc039fad726f5a94daa14ca9916f0d2700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855533, "uuid": "cc8df763-dede-46c2-a84b-46896df438ca", "value": "T1F8E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855533, "uuid": "c75f926e-c61c-44e9-a498-567b390492c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855533, "uuid": "3a65189d-cb29-4f9c-99c3-d3ccf825dd8f", "value": "49152:Ovkt62XlaSFNWPjljiFa2RoUYIOWRJ6fbR3LoGdHTHHB72eh2NT:Ov462XlaSFNWPjljiFXRoUYIOWRJ6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855533, "uuid": "d2d2c469-df11-4770-9475-55330d5150fb", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855533, "uuid": "9f923ee9-73da-410a-b9f7-87a88c7ef9ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855533, "uuid": "4d05f7d0-63ce-4a6b-9795-fb0e5da980f3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452b653a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855534, "uuid": "4d314fce-a05b-4eeb-8cbc-667f327b4954", "comment": "Malware payload", "value": "1153734461232fe4532e1a342643653c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855534, "uuid": "7bd0d8ff-c4a7-43ff-8c08-282f2ac9e1f9", "comment": "Malware payload", "value": "2840e106bfe0c4f1c560dc31af30706bb030b878279d1867fc6c9c2f6850dba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855534, "uuid": "13e78086-444c-4a0f-99d4-3f51b0bbc37d", "comment": "Malware payload", "value": "4162ac7d110556938752cf95b7b3744164cf5df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855534, "uuid": "797c728a-df63-4ce7-bf59-51eff282b1f7", "comment": "Malware payload", "value": "7f999a32bfdfa3a2af190790ca6e21e40492984bad271c0fede32ef761c2386f83600a09562600f9c49506667fd46d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855534, "uuid": "5d5abf28-17e8-4e4e-b03c-9b376c9bd3c3", "value": "T1D0E56B143BF85E27E1BBE277D5B0041267F0FC1AB3A3EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855534, "uuid": "fc719f02-fa91-4833-9f61-f983bcb769ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855534, "uuid": "0ab50e7f-c95f-4708-8074-f536c4896599", "value": "49152:YvTgo2QSaNpzyPllgamb0CZof/JawRJ63bR3LoGdKTHHB72eh2NT:Yvco2QSaNpzyPllgamYCZof/JawRJ6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855534, "uuid": "3931a1ce-5cb9-495f-ba37-b9ae68e4bcbf", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855534, "uuid": "5b11957f-79a1-4a30-8bb6-c479775982da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855534, "uuid": "ee8faa0d-367f-4cef-bba7-6836e5b42ebd", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b718e9-c795-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763810384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810384, "uuid": "05039cd0-f9ad-45ae-8319-418044b85e09", "comment": "Malware payload (Mirai)", "value": "01bfc68107553e229a7246eefa98f7d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810384, "uuid": "e501b307-a286-4846-b9db-9f9531544ac2", "comment": "Malware payload (Mirai)", "value": "285d7fb729e8f6b7a49e8a3eb722a1961468823c618b4ff6b9886e116135137c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810384, "uuid": "4e576d1d-dbfc-4b3e-9dd8-39c7d7d7d157", "comment": "Malware payload (Mirai)", "value": "179948df40162175b847eaf9703a9fcd1799b344", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810384, "uuid": "4d4a2c0c-7022-4b62-840d-510786a4887d", "comment": "Malware payload (Mirai)", "value": "094e1c02f49d1ccde52fc61ee697266e518a860ce700de50cf0f9db142457d1ce6fe57a3aa7f49251a8fd26283d992b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810384, "uuid": "06e63592-8eeb-4113-bad1-a314f22f97af", "value": "T1C8935C56BE81C622C6C16577FB1E528C3B2753F8D3EA32038D216F61738A91B0E7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810384, "uuid": "1ed4172e-4da7-40a4-85ea-cc54cbc27dc5", "value": "1536:DrjMfufaU5Eao7iOLeFMkdOfz31kBK3RG3lDVBN1HemH:DrjMLFi2kU73iBlRdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810384, "uuid": "f50867a8-b449-4404-a9d2-226c80e4a20a", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810384, "uuid": "4f6782f1-0ee6-46ac-b915-0331d577dede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810384, "uuid": "9ce6cb45-f81f-47fa-a5dc-ecf67c0b887f", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bb5d9b-c768-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763791107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791107, "uuid": "02ed6dc2-25b4-4671-9b6d-32e505078409", "comment": "Malware payload (Mirai)", "value": "c03473e5bb364677ca57d9e2b9d0ad50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791107, "uuid": "f2ac3a0c-1ab4-4a0f-a00a-31104c567e24", "comment": "Malware payload (Mirai)", "value": "2860e01189f21f988ba7830e568c6e405fe7fc6131cc8f81051f7d1e8d7a1998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791107, "uuid": "0bd65fe6-6087-4bb1-ae37-a8a74520c324", "comment": "Malware payload (Mirai)", "value": "4bfec6094ec6621f5cb4f72fd76deb30a2b409e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791107, "uuid": "117d67b7-6d75-4a68-b170-cfdf32e99eb7", "comment": "Malware payload (Mirai)", "value": "d50d1056df2e9669ce65039ff8323b8ed013eadfa69d4c786cfc0eb370db4bbcce82f61b7c8e6960a92309b925ac3b0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791107, "uuid": "b161ac44-1ba9-425f-b8d1-07347f3e129a", "value": "T1F0640852EA412EBBC00EDE31411F87D921AD849953FB532BB278C51EBB8EE0D69C7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791107, "uuid": "432a5723-42f1-4ebb-91b9-68bb76a1b3fd", "value": "6144:XkVw8wIuAd/CxtiR8kJuLyKRbPe7cdabRDkMycovjQ8uizfC/KkjUfTJNQwqMlaf:XkiKLifTLQwqMlJybN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763791107, "uuid": "4f9c2d57-a6b2-4335-8af5-052640cb774a", "value": 310696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763791107, "uuid": "20850b5b-0047-4585-b74e-1da1e0e201ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791107, "uuid": "245a9b69-9c07-40a7-bc4b-051410ad7926", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ee240f-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855535, "uuid": "457430f1-bce5-41ab-a97e-f7805aedaa96", "comment": "Malware payload", "value": "46d54844306e6b43f04bfe4825ae87e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855535, "uuid": "277e82e5-0c45-4c9c-bec1-2125d0e07860", "comment": "Malware payload", "value": "286a1147424919ea410d54c1a8ba3c34a84183d483f3a4f4ad633aa85b35d1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855535, "uuid": "97128f43-0c25-4ae9-ad21-a9c517b6691b", "comment": "Malware payload", "value": "f26fc10c91c0bc589424560a38df41a768811257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855535, "uuid": "44cdd604-a3db-4839-b5de-d8db8a383300", "comment": "Malware payload", "value": "821bbe1a40c00fe8535388f115ef26fcf591e16ff95f8289d4ec860dea8cdebbbc623a54f1bd0a1245258fcf1047def0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855535, "uuid": "0487f385-90f7-40b5-b687-9eb2223f6e40", "value": "T135E55C143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1151677E1C93B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855535, "uuid": "66cac51c-0bec-4e21-ad26-4fef93107b19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855535, "uuid": "cf6918ef-5e5e-4bc0-b78a-8b619a38c697", "value": "49152:nvCvE2H5aweBHPbl6T/yGaqA6/Ox9E1zhk/Jx6oGdBTHHB72eh2NT:nvIE2H5aweBHPbl6T/DaqA6/Oxjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855535, "uuid": "6be4aabf-eee2-4305-8476-e18df76c7e2d", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855535, "uuid": "41769d44-4995-4902-ade4-cb803b4e10bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855535, "uuid": "97170699-e3be-4a2a-ad27-a0caf9bb5772", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c5a9af-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855537, "uuid": "654778ee-e377-4121-9fce-7ba9eb65ae64", "comment": "Malware payload", "value": "1ff225938bf5f9c6bcbe5afdd29f0e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855537, "uuid": "47461c95-4217-4031-9ef6-4ae85fa7437f", "comment": "Malware payload", "value": "286d010b39e56c40de1022086ad9c4a8a733d56f2946fe068d182b7074602041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855537, "uuid": "cc9fec5c-edcb-46f0-93b3-49b53087ebbc", "comment": "Malware payload", "value": "27116cbcbffac6628ba6feae83215fed9bfcdc19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855537, "uuid": "3a68d701-1c68-4b67-b1f7-aecdf3b36c5e", "comment": "Malware payload", "value": "a4f41bf353c7a89603d13999d44fbaf980a22c736c3e296777cedfe87f7ee2b5adc51ba3013efe6ea0df74f3fc023213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855537, "uuid": "cccb52f7-621b-4d99-92fa-af916fac4391", "value": "T1C0E55B143BF85F23E1BBE27395B0441667F0EC2AB3A3EB1B1191677E1C53B4059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855537, "uuid": "92cbda47-4403-4562-aacd-a6def4db90a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855537, "uuid": "2fc6eaab-11cd-43e5-b136-0ad9e0e5384f", "value": "49152:DvqI22SsaNYfdPBldt698dBcjHzRDnEDHJk/Or8oGdwdTHHB72eh2NT:DvH22SsaNYfdPBldt6+dBcjHzRDwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855537, "uuid": "84f5911e-019b-4fc0-b00c-2d69ab0ec156", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855537, "uuid": "0e71f3bd-2f84-4c9c-a540-6328f35ccaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855537, "uuid": "f36eb4c2-d3ff-462d-8275-7c0fd8dbeb35", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479f25f7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855538, "uuid": "d86fe445-4195-4a6b-83a5-e89e69164957", "comment": "Malware payload", "value": "6cda53eb9869854c6820bb55ddb6b8b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855538, "uuid": "edf25880-6192-4245-bc71-34fef3a03981", "comment": "Malware payload", "value": "2876c88a20eef4ac8b87ea096714bc6a28d6286402351d0a8b1889cfe2f42a2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855538, "uuid": "4231d7e5-1c05-4592-b0f7-ea127563d3f6", "comment": "Malware payload", "value": "dbe51122d02e759f108ffe32348500b13a0df8db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855538, "uuid": "ea2cb6a6-8651-4d45-a9ad-7149e6ad79c1", "comment": "Malware payload", "value": "d2341b394242333467854e98f0c99809a72b45fa4e3a4edb659ffdc7da020a5ed9bcca3a9ad92e7ecdb2536ce8ab9189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855538, "uuid": "3e3b774a-598d-4b11-927f-571863738995", "value": "T11DE55B1537F85E32E16BD3B3E5B0501263F0F86AF363EB0B619167BA1C93B4458426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855538, "uuid": "bafb1e3f-5759-475c-b959-ce214d1b1255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855538, "uuid": "c6c9e1d3-c5c0-40d8-807a-aa1eb96aefb6", "value": "49152:PvDI22SsaNYfdPBldt698dBcjHJHX/oGUhEOTHHB72eh2NT:Pv822SsaNYfdPBldt6+dBcjHJHPQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855538, "uuid": "2408d1a9-1699-40e1-98aa-7998b9a6b39f", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855538, "uuid": "d0c23e26-5e97-4e22-bcc0-9bcbb3e2dd1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855538, "uuid": "d37f62f4-7f31-4a07-b5e7-77efddc4497a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54bf4bf-c7e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763845495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845495, "uuid": "9792a49d-ade8-4e3b-8cde-ea1830e25f7a", "comment": "Malware payload (Mirai)", "value": "129c9a076c199dbdc7e6b7bc883d000a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845495, "uuid": "b4b10b40-7318-48b0-9c3a-2a1bb4680e11", "comment": "Malware payload (Mirai)", "value": "28d6bdc3187d414d8a91754534fce05df02d369d7b207a9177e43a7f400f71e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845495, "uuid": "1b66ecba-9db0-4134-a17d-0f1479551b65", "comment": "Malware payload (Mirai)", "value": "fc0e900351ed250a301886413dd048f625af2ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845495, "uuid": "575685ac-a381-4c8a-a151-dcbe92887a8f", "comment": "Malware payload (Mirai)", "value": "686541487fc7886ee0f33348201e9b5024c7b71a5e2a75871b56405591e2f3a0f56b775873a43237a4a249b179ad2cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845495, "uuid": "e1a2c3ce-b7b7-4e05-ac5e-8c065c988130", "value": "T10953F16AD29933D9C371663EE5444967FBDC07D8883134B331EB8AE06ECD4522DA819B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845495, "uuid": "c9b6c364-b1c4-47d4-96f0-71e347a666f8", "value": "1536:Gq3GDVFbIi9xpBmaRmyV9CPsZMSEqTK41GXQOfEl9Lp:v3GhFlfpB/fV9CmMSu41Cn49Lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763845495, "uuid": "90e6f987-b4a6-484c-bdb2-b6eff53c38a0", "value": 61784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763845495, "uuid": "284f2774-8527-4b58-9f65-43d5bb054ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845495, "uuid": "24faf173-433a-4247-8908-668eb56af48a", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485923ce-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855539, "uuid": "a16c03b3-6609-429d-886f-a2ce4e311e9c", "comment": "Malware payload", "value": "053ba2c066c5289aafcff93468fdb609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855539, "uuid": "721f34eb-5c53-4585-9549-3d387a784ccd", "comment": "Malware payload", "value": "28df3d6cfdcc2b8c3ff6ecffe329eeea59a9a8571f74d31cd4dd5b943cde84ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855539, "uuid": "f4d239b1-7694-455f-9103-d9b46b343fcb", "comment": "Malware payload", "value": "019140a2260bc77a4234a61321b3c3900e4e0d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855539, "uuid": "2f09a63d-7c2e-4040-b49a-15ad8a112af1", "comment": "Malware payload", "value": "9d2ad42303494b8adc83b8e2432027b272dd852164f51392b8894f80a37a604d8a0bdb38b5ec68587d2a2eb9f636d9bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855539, "uuid": "e0366809-40b8-4623-9cff-573b0496e562", "value": "T16C545A2527F8A93BD9BE17B4F43141094BB6FC07B557F38E6A5818B82C1A38985437E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855539, "uuid": "1310aef4-6d8a-41e4-a054-789115c9f9a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855539, "uuid": "b6880fed-b934-4103-ad6e-1a847c7c0906", "value": "6144:dKJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkDl:kzCGL69zVGkllbkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855539, "uuid": "88880d44-cc2e-4815-bdec-b902339049f8", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855539, "uuid": "b333e59b-1813-4bdc-b860-cda16378780a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855539, "uuid": "044ec43e-652a-4e4f-aaeb-fc4c72c4d6f8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491de98d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855541, "uuid": "4c346fbc-8e17-4ee5-a464-fb7ad3413867", "comment": "Malware payload", "value": "31d2ee36c408a2406e43d7355852e914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855541, "uuid": "892c5fcd-0f0d-4688-8ece-635485b9e59a", "comment": "Malware payload", "value": "296d5d7bec448b414f03407f6d9eeac39438296f48b98eb39a7d30a7daec5388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855541, "uuid": "d3134ac5-a849-4980-a287-1534c26869cf", "comment": "Malware payload", "value": "7212dade4638fdf7db406f92994d12a1a5809ea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855541, "uuid": "33aaa048-d037-4798-93de-cac08c26ce69", "comment": "Malware payload", "value": "41ad05a1c9e21be49775071406134455b9e44cb3c1e64ac651db4062b2a1dd2d5fa6d7065975da80e0a7df6f8d029387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855541, "uuid": "7b956bd8-bce0-476b-aefd-f0cead1cd445", "value": "T17D850250B7F58516F2BF2BB9A8B244464B37F6538A36C79F0D4890AC1EA7340DE61363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855541, "uuid": "98bda9ce-fbd0-4d11-a32d-0ed320652f41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855541, "uuid": "7ce908bd-25d6-4282-989e-fa60fd7b1f81", "value": "24576:GXcrQiSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkkJ:GXcrQgTYj77wRGKKm77LrwCB6hqany", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855541, "uuid": "5f3d1b3c-bc86-4ddd-ab6f-c449850e35a6", "value": 1833472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855541, "uuid": "664ea729-5ddd-4c16-8d74-0d1e03e4606a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855541, "uuid": "7952dfdf-89ba-400e-83e5-bfee03d6a561", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748c2303-c7bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763827267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827267, "uuid": "e1a1aa76-fb53-4d96-80a4-bd8c37636bb5", "comment": "Malware payload (Mirai)", "value": "8b90c355adf22a5cf69e70b528e8cf1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827267, "uuid": "ce831861-81ef-435e-ba9e-3143d9278193", "comment": "Malware payload (Mirai)", "value": "297efded469493b1f8642672c6699b2d982c938346925544d6da592d5dd3197b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827267, "uuid": "10da9812-1e54-4a5b-aac5-0c9b06715546", "comment": "Malware payload (Mirai)", "value": "0ec1a427bc877a5f1735c66b31cac9c3acadb89d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827267, "uuid": "15553e47-2f88-45ec-93f7-7f1ce5aff053", "comment": "Malware payload (Mirai)", "value": "9d97327c1c93dc2cfa7e183e18920a34c5fa311ec63e5b03ef6b36ca285d4b366e844ce0f97afe81e77497a478c78d85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827267, "uuid": "d7669923-3663-48e2-a2ca-e4e0ea88faf2", "value": "T13363029469813CCAD08405FC1C18EDCB8D08F5BF4356892C86E763AFDF7D596DC62561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827267, "uuid": "8d95b2c0-fff2-4e1b-8586-57c22d01b6f4", "value": "1536:XTfbPzsGtk5bMFA8PuCFVph17qsne0gGKxY1afsyNS:XTzPzubMFA8WCth1Dn/KxY1afsyNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763827267, "uuid": "c6c2761f-d0af-47a8-ae50-8ea81fa848e5", "value": 69088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763827267, "uuid": "320f10fd-e183-44af-a33e-63d10707e39e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827267, "uuid": "00ec5ca0-2dd0-4dd4-894a-c97ebb3dfb2b", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e9b762-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855542, "uuid": "42cc142b-28c9-4bbb-9db2-baa720a094f9", "comment": "Malware payload", "value": "62fdb413ba5f0cc91b67ae4f1aa5cc6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855542, "uuid": "35ba7477-f248-4619-abc0-929ccbbe73af", "comment": "Malware payload", "value": "2a127f54b1bad6f98d760a91de6cd12d4dab8d079bdd50443ff20da555a643c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855542, "uuid": "8e9209f8-7dc1-43b1-9aea-9188ea9df624", "comment": "Malware payload", "value": "28375b22587aefa66906ca0ceedd53d725371853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855542, "uuid": "2f291cff-34ea-4442-bf9f-d0a98f853a5c", "comment": "Malware payload", "value": "9ef08308a555aabac6f4a91f689b86013c5b3306116e8dc4244a720bc9335522f4d1bce4158a1dc0deaea0ab8d56e86d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855542, "uuid": "17b2f539-f030-4c5c-8d00-efc895b2d397", "value": "T12385012063F4860BE2FF5B79D47625054BB6F903DA3EC74F095890ED1EA37819E92326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855542, "uuid": "656a802c-8b75-4906-91f8-dd30419d00c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855542, "uuid": "db2afb21-ce45-45b8-a766-86ba5a0f3ebb", "value": "24576:fFo/Ql8uSyUHZSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGWH:9o/AP3iTYj77wRGKKm77LrwCB6hqanyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855542, "uuid": "5a23090e-8bf1-44e5-90d4-310675588d41", "value": 1820673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855542, "uuid": "e72ec1d7-9cf5-428d-ba06-4e935ce6edcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855542, "uuid": "8c32b135-fe0d-47e7-b2ed-a7fcccef4b5f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa70ec0-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855543, "uuid": "7daa2769-fe49-4671-9dc8-9d7e74865711", "comment": "Malware payload", "value": "a3d4e7206a82eb70fb1067abe15f2568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855543, "uuid": "a439934d-b384-42ec-9c42-c1af98babb76", "comment": "Malware payload", "value": "2a21776b8fd5a4f477fa01091d06e49999c5504d63c3931bd241b6edbe7aa840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855543, "uuid": "d3f132c9-abc6-4153-bb14-a4cacc99ca0e", "comment": "Malware payload", "value": "bcfb2f937aed2f3e07d864f1dc1965c274f435ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855543, "uuid": "9f19c018-b2dd-4cd4-8d28-08ec900e4305", "comment": "Malware payload", "value": "697423df0f17e3eb16531ad43e58ac49079c9452cb0123f3c92dbba0d23cad9d6f5bd2ba2bfc9cc37dd60a77bf909614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855543, "uuid": "ba8df335-f4f0-4873-ba55-cc6146160e4e", "value": "T180D4022427FD861BE1BFA7BD99B1254156B5B623AA23EB4D19C463EC043234189C33B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855543, "uuid": "d3b4ac40-1fe7-4c1c-87bb-0a77293b26b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855543, "uuid": "686216ee-22ce-4d95-8c81-44fd110c016d", "value": "12288:grpiYSfkqjVnl36ud0zR/6CtQ9PUHIG8Dl8gSD+37PWY1Y1+NFRE6W93rv:grpYfkqjVnlqud+/2P+AlUDcPt1a6e6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855543, "uuid": "2d86e88d-33b9-4dbe-acf8-71fbcc247d0a", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855543, "uuid": "4582196f-c2e8-461c-bbb9-5b8cee81f795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855543, "uuid": "fb289109-c75f-414b-a2b6-4a1f986e2034", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7096936f-c795-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763810510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810510, "uuid": "adbd645d-5919-4198-84a2-2d892659ea93", "comment": "Malware payload (Mirai)", "value": "aa1f7b5c2039633996a11ed23566022d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810510, "uuid": "96d3f4fb-f701-436b-8968-817e9b820262", "comment": "Malware payload (Mirai)", "value": "2a40bcd3c8f6d6935eceb3b52d321233d5ecb3cee63c68b17495734d66516ad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810510, "uuid": "4d4d0e49-83b1-4d84-9e94-66e5daca5acf", "comment": "Malware payload (Mirai)", "value": "81488af55f5af18b41ef89c7fad002209568b949", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810510, "uuid": "6679c771-9c92-405a-9cf1-9bc2faf9dd4b", "comment": "Malware payload (Mirai)", "value": "885c7f2a80c6fa416246d0e05ff8dc215e54de627b26270a009a0838d0723ca673f551fa661f4e3c359183b1553e31e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810510, "uuid": "bac2d492-b3b0-4c89-a99f-42bc57237ca7", "value": "T17DC33B17B9519B11D4D331BAFE9E814933136BF8D3FA71019D20AF6123CA99B0F7A612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810510, "uuid": "91095b59-0be1-43ec-b0b1-88b5c0f83e83", "value": "3072:J5Lf709WjA9UqxlpRaI7rcuZ156QLt6zm0loqi:J5/TE9UOPRaI7rcuH565zZloqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810510, "uuid": "b73aa58b-66e2-48ef-8c53-549f0e98b0f0", "value": 123672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810510, "uuid": "655e0262-17cd-4c0f-9794-d49cbfe9a5ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810510, "uuid": "e40c96d2-135f-4458-a167-3c77b1f3c338", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5e3195-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855544, "uuid": "0acb5498-4b0c-4627-8423-46329695d863", "comment": "Malware payload", "value": "ceee17aad2f61e0a50497a028e963019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855544, "uuid": "590e7abc-3c89-4716-861a-5e727661493d", "comment": "Malware payload", "value": "2a45f93118bb0d79f7b2c982333bba22d5cff969f4836e5d70b34ee1e0c5b9df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855544, "uuid": "abf73bd9-856a-49d3-aff8-7f098a863028", "comment": "Malware payload", "value": "a1afca6ad8a3f861a340156a2a7e9651e6dc8cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855544, "uuid": "97ed8408-cf77-4a3f-9898-ed8f05a20892", "comment": "Malware payload", "value": "d54925b86bf8b0ab977f110dd91b6a335d5f0f65d99b6a890926ddb196804a2b1c783c15b3a805579e4f9650aacd0556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855544, "uuid": "4609f2a0-325f-482e-ad12-449cad126b48", "value": "T1DB545A2527F8A93BD9BE17B4F43141094BB6FC07B557F38E6A5818B82C1A38985437E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855544, "uuid": "52693d19-a7b1-42d3-a0d1-71275f6fec69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855544, "uuid": "efd681f9-bb82-444c-978e-d62017ec00c4", "value": "6144:TKJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkD3:GzCGL69zVGkllbk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855544, "uuid": "60c81713-199f-4ca6-af22-3234839d6217", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855544, "uuid": "c58b04bd-90d9-46a4-9f41-30c0b90129a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855544, "uuid": "6a905dcb-3a8e-40ce-bcdb-58a7332e72f9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f79db20-c7d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1763837593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763837593, "uuid": "90f9cec3-dca3-4fe3-9b1d-e494ad28ae5c", "comment": "Malware payload (Socks5Systemz)", "value": "07e4c7ad17d688971cff1adc2d6149ce", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763837593, "uuid": "2b375c4a-5df5-4c94-858c-697a0194dd1d", "comment": "Malware payload (Socks5Systemz)", "value": "2a462e3e57d111ceeea878a4aeafb14f4948ab02c6646be9136c4a7eb6a0ab1e", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763837593, "uuid": "9a575482-3782-4065-933b-c2ded3de8987", "comment": "Malware payload (Socks5Systemz)", "value": "0d1ef67af5db593abd9fb0a97aeca21e81887444", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763837593, "uuid": "2425f37c-bb36-40f4-8f2c-fc9f377c2c98", "comment": "Malware payload (Socks5Systemz)", "value": "f4098d8e47719acefa944fbed6664b50907a1cefcc91e10ebcbe1e2c84b83ad9c9e94d28482b194fcc6cdd5d61553f5c", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763837593, "uuid": "c0d4c014-f99a-4ad8-86d5-bed065400813", "value": "T116F533C62496C071F08BAD395E599005DAA7BB057CF9E63AA28C8EDCDF539ED010B3D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763837593, "uuid": "06053a06-d47f-4255-a2d6-856aea5e8282", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763837593, "uuid": "6d3edf69-313e-4978-88a5-a9dcc34be5bf", "value": "98304:MQ7c/1WFcImIUT1peEEQS9YFvJ2lHVFTqo8nX0Hg5Q7NW2oK:FfcImn1pBpS9YONVFGhsp7NW2oK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763837593, "uuid": "1fba1105-083c-4301-b350-300c26eed12d", "value": 3622974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763837593, "uuid": "6592455a-cb76-40d0-b223-469f6e86b907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763837593, "uuid": "3f9ed89e-9de8-4d90-adef-def531a9c575", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bcfcfd-c7f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763851376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851376, "uuid": "d3802784-e57e-4766-b1c0-181b9935482a", "comment": "Malware payload (Mirai)", "value": "c5e3d013a7d9e7495f66793d3d715da7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851376, "uuid": "45f1d706-a248-4ea5-a35c-a20f41e2604a", "comment": "Malware payload (Mirai)", "value": "2a501c783f0b71ae32f4f66de4f1f39ab7e6c1adf6c45c0fed3a2149ed83e274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851376, "uuid": "1a850848-f4b5-4336-b899-f5b7c0632f9f", "comment": "Malware payload (Mirai)", "value": "a16e3fb5db86e39015592890a5e31b69d6c0255a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851376, "uuid": "844a8611-3096-422c-ad10-bb92bada0ed5", "comment": "Malware payload (Mirai)", "value": "454b77d7a53daf923d8f04d3c8e61cb5de0e221210f9a14cae14a4ac3b22843e04bcbb2a72699939fa9b5d2d8196d585", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851376, "uuid": "b4b87cde-8d4a-4faa-8968-4d72ddf9217d", "value": "T19243F225EBF48736F0B9303649A9AC090C30C60E25B7A5A1D8C4129D9FF1B1E167FE67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851376, "uuid": "311ca2ce-a8cb-416b-bc03-deb40d3eaac8", "value": "1536:ocsPzc5C28HSBQ5qIORueOmAuh6DeJEspnouy8Hye:ocx5V8HStru8BUeqQoutV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763851376, "uuid": "7ab5a1d4-78bb-4c64-96c8-46f42cbcaae7", "value": 57112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763851376, "uuid": "f451c723-92cf-4a43-ad1c-1987a04d8756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851376, "uuid": "54d1f256-20e9-4faf-99c2-2a16629a715e", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c22b068-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855546, "uuid": "948d7584-a8a1-46f7-a8c3-6b3ae0f41225", "comment": "Malware payload", "value": "45c59e66d7109f6b2c304260dc3261a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855546, "uuid": "a8ec73e2-5a3c-4b34-9601-774ef8346ad5", "comment": "Malware payload", "value": "2a5711a4075d505a8cac92222c2ff2a6c2a99f36c345aeac40be123b9053bcfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855546, "uuid": "a5542643-572f-47eb-a142-a32b4e5dbdf1", "comment": "Malware payload", "value": "2bb61c0b055f3939a974f4664a82a193c7aa5cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855546, "uuid": "ff620aee-b7b2-43fa-bc5e-ccbb7d7301a9", "comment": "Malware payload", "value": "4a8ebbb65c608d30375ac864edbbcd2c55cc98b45f6ca270bf8d2f77ddfc8b79c9271ac9714f33724fae42618fd0ad1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855546, "uuid": "4a15f40f-c627-443f-9bbc-4a625a567617", "value": "T1EF748C1337A8E63BD1FD173AF4320A194BB1D563B616E38B5A5A51BC2D233868D503B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855546, "uuid": "9bd2786f-7e68-406f-9718-89cad0f93e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855546, "uuid": "9ac58195-b58d-4f84-8df2-8e123701670e", "value": "6144:hrNHXf500MbKhECcCC+6m1QPbZBkvoDBR6LFbkYoUqa8vS:td50FKhECpC+mnHDBYLFv/qaaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855546, "uuid": "a51eff9b-fc61-46e3-aec1-036f3812cbb2", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855546, "uuid": "853e068b-759c-458a-8706-4434be9ac45d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855546, "uuid": "5f5da1ee-1251-49c2-92d8-81702a67667c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c47979-c7b2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763823113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823113, "uuid": "85eed0b8-8b10-4764-9fc4-efc99b146da3", "comment": "Malware payload", "value": "747a6724f11d7b9c390dadfdf144fd34", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823113, "uuid": "99d79d65-6b53-47cb-b5c9-be48896f30ee", "comment": "Malware payload", "value": "2a6037ff1b3c819b51805c7ac23e33916ef034d86ac8ccccd2215b25fe727334", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823113, "uuid": "e8784d71-6ebb-4f5f-a659-35fa068eca7c", "comment": "Malware payload", "value": "d141b85d033983ba32c01c4cbfddf8c0fe5587fd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823113, "uuid": "e2e299b9-7023-4f1e-ab71-fe90c7efadb8", "comment": "Malware payload", "value": "b3be9f21d7847d4357c7509e22ef9300a76c29c16cf78cbc4808d8828e169ba8b11d54c30debb43e67f4f31ea58dcc7a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823113, "uuid": "9a623eee-8c5d-4e37-9df9-24efce23d2d4", "value": "T19856CF1179EE8532DB1E01B0E629FA1AE62EBDE31F6105DBA3E4F84A16305C35735F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823113, "uuid": "be43dac9-fc59-4e4b-be3d-1c9793d98bf0", "value": "98304:Z9wmfkXTgQOD4tPMiPdxavYknkq+yblm/qoIFAdVZJzBEd9YZsgOGgz:Zimfjx4uiP2Jno2oIid1zBEDgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763823113, "uuid": "d0ca1a00-57f7-496f-b30f-691b78310094", "value": 5974016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763823113, "uuid": "cdf7da17-d752-4d9d-ab8b-756e0edc8c4f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823113, "uuid": "d671aef1-ef28-4a04-a314-d47b31443a6f", "value": "windows_installation_package.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d01b8d3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855547, "uuid": "aa48f584-f861-467d-9dbd-46fbab6ea1be", "comment": "Malware payload", "value": "c28aea991419ea58b1a5ec82e84508c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855547, "uuid": "f1d23834-1a9b-4e2d-82c0-95cdf1d35966", "comment": "Malware payload", "value": "2a6c91371a2f89bb14722a732c77f0dd9178894aca184b48b80a5ef7fa211517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855547, "uuid": "e0ee6f98-84ac-48e2-ae2f-911ce82fa57c", "comment": "Malware payload", "value": "ff985d613ef01581089bec9b7c02cabe7e04a725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855547, "uuid": "d6dc6a1f-ff68-48a7-b88c-9c1c85e89f0e", "comment": "Malware payload", "value": "43ec10eefaecbbaab305ef8f727e81c3169c81d464a803a4bfb750288d0e000e687e107e3a2ae97a6dbef3ed98fd51d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855547, "uuid": "b7d0f5a2-3e7b-43d4-8261-fcd2ba5a0233", "value": "T101763302AFE5C222C4BD99728AE1DE125FA373125335D9FB57D843655F23EA281B02CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855547, "uuid": "9fe8300d-b058-48ec-906b-ea63973bf234", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855547, "uuid": "3b803c2a-05a6-4ff1-99af-78110297db45", "value": "98304:YaPGoImXxvm7dsZBhu39utY5iCsBzWIu5zal/vjL8oubj9YXoOKFNVMaC2:Y2GoJwsr034tZBK71alzjM9Y4fNVMaC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855547, "uuid": "945fe8f6-7c15-422d-8e88-fe8a42826d6b", "value": 7201792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855547, "uuid": "9f9d4d0b-654d-444f-bc74-dd6bb5220141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855547, "uuid": "542d2caa-56d3-4dda-9831-5df8fd6d9a8f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc13231-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855548, "uuid": "c28c5e3f-6da2-418f-8fb4-eb763ae6981a", "comment": "Malware payload", "value": "855c99ea0d3f93a04ca2cba641728c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855548, "uuid": "976f0e57-7e7d-46ff-842a-ddb137d77414", "comment": "Malware payload", "value": "2ac4fb81983288f2d48708e0c08c50a1353f82525184e4f533c9f303d644cada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855548, "uuid": "31a57abc-3d73-4f42-927d-918772751396", "comment": "Malware payload", "value": "b885929e1097122465b1aaa104586cfccdb7d6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855548, "uuid": "99839551-bd18-492c-83f5-f4f243a6b943", "comment": "Malware payload", "value": "631081b3e851082bd7f2f24ea56ad8a23e2ee01349dc61f5a8be9e669b94dcca6b9962de9cdde3121cd34c744f15b2c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855548, "uuid": "22aa273c-4cba-4224-aee5-4b1258fd1973", "value": "T1F8B46C4063F8852BE1AE577AE871042597F4F407B2ABEF4F4A40A1F93D6670AAD40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855548, "uuid": "5b040c61-7596-42b4-85bd-3d3ec9021826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855548, "uuid": "017d3624-43c9-4670-a644-435bb5f6f9b0", "value": "6144:xTEgdc0YhX7IxUpGREWduIEdP/9Ko0tQpocElab8F9z+IgwpngcTR3y:xTEgdfYixUJZ0PVdlhpngcdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855548, "uuid": "675ed7dc-e5c2-493a-8530-1c6a6a836bd9", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855548, "uuid": "07fb46a8-d4f8-490a-9fd0-9d221837521c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855548, "uuid": "c7f752d5-9e8a-4ff2-a272-c83aa8f8df38", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea6f6a2-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855550, "uuid": "3cc327ae-d5bb-4ae8-84d3-64f73e12d8f4", "comment": "Malware payload", "value": "ea08100b943c4c8b3e90a1a86886a1a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855550, "uuid": "7447e38f-d3df-42af-8dd7-075d59cd21a8", "comment": "Malware payload", "value": "2aef1e00ae10fbb8f39e53fba03701e1fa5b33c59c662d2cab300055fabfcb8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855550, "uuid": "d48a01b9-d0e9-4934-a49d-9a908be37677", "comment": "Malware payload", "value": "d4f3698339e508bea03d8225f4077d397965f2d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855550, "uuid": "60627e3c-a5fa-4366-bbe7-ac37cc700c1a", "comment": "Malware payload", "value": "7d24b762da1c6f85b1771aee5bdd6d907c47ca1a823d442913157ec731ce83d9edf2ad25f153b61b0963e1c6b97190fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855550, "uuid": "06151457-cb05-41dd-bb27-75f531ce2b3e", "value": "T1DEF56B14BBEC5E23D67E93B298B1402267F5F85AB3A3EB1B118066791D13F505C822F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855550, "uuid": "7f2171ae-d520-44e1-b377-5b95c1e8f9bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855550, "uuid": "37e41c29-486a-4214-bcc5-5e35d740172a", "value": "49152:T57G4vNZjGxV/gPz/0RQR3LWDzIYvJNJ+irMafUygAHHB72eh2NT3:V7BvLi44RQ3LWDz3R7DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855550, "uuid": "e4959e7a-e52d-4258-a8ea-6a2adf578662", "value": 3389440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855550, "uuid": "214fcf70-3e96-4a0b-8187-73f57746bb8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855550, "uuid": "64c6a824-b989-49e6-934c-8ceb2393d1c7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f65b355-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855551, "uuid": "956d2e58-fe87-443a-a049-7017151663c6", "comment": "Malware payload", "value": "55b835af53d6b07ee750e944ea119583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855551, "uuid": "838d7e53-1e22-4bfd-812b-5e8af9c1567d", "comment": "Malware payload", "value": "2afdc39b9cd16fe0c497efbed48e707e271b1e8db52f4f8e812239d972b5b9ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855551, "uuid": "9753bc04-68d5-4e50-a7d3-86fb9efd636d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855551, "uuid": "1a26d1b5-d566-4677-9eca-4b033fa892df", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855551, "uuid": "828baf45-1b20-401d-9cf3-890854f5d481", "value": 163852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855551, "uuid": "97b1efd3-ad08-4289-aba0-ae30f03a1450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855551, "uuid": "ed12173b-72c4-4c66-83ef-a3d652f33830", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5038a721-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855552, "uuid": "564a8c29-c388-42f2-a340-04fc849adf6d", "comment": "Malware payload", "value": "28d77f381307eebefca6808c3d1947ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855552, "uuid": "2a4573c8-4513-4d2b-a5d4-f72aa42de210", "comment": "Malware payload", "value": "2b0f646b9d534e2199c94f8da59a684731dac2cc3f3a18b7ad961808cc64be21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855552, "uuid": "1776502c-160f-4dce-a372-4b6728c93d86", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855552, "uuid": "e07f9478-41f2-4e3d-a160-b9385ce2f31c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855552, "uuid": "6edccbdd-876d-456f-990f-d13eb9dffbc5", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855552, "uuid": "fccb382d-f62c-4021-88d9-ae891e2b4b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855552, "uuid": "e0185487-4bf6-4fd5-baaa-46d2293ee522", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51047824-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855554, "uuid": "1e233505-4f3d-4fc8-9aee-17a45b9122d3", "comment": "Malware payload", "value": "0f57c83437b5f58d2a1ca213e0707928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855554, "uuid": "73d6d918-c2a7-4142-aac3-b3fe115a45f0", "comment": "Malware payload", "value": "2b16346023ec24b3e268d06e2dfd7832e9f57e5a63004d3eb92a5bfd313f3c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855554, "uuid": "63b3082c-7cb3-418f-8c2e-1464761d6c21", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855554, "uuid": "94a78328-cefa-4efb-8901-d1fc349ebd0d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855554, "uuid": "7ca0e916-f22c-4a71-942e-416a03415a58", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855554, "uuid": "5ce0fcd0-52ca-4fdd-9692-6a7c1b8ae609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855554, "uuid": "5bec8d3d-4434-4841-8e5e-f655dafb0074", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3201b34-c7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852363, "uuid": "4c7495aa-0f06-47d3-b24e-3765049d5180", "comment": "Malware payload", "value": "b720943d7bae78eb27b24a2f4fb28e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852363, "uuid": "18e5b839-22c5-407d-a273-6c1fe16fdcd1", "comment": "Malware payload", "value": "2b4b63737a540d342d32a9edca06195b5c028c3b4fb9af578a736d731e7fdddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852363, "uuid": "d3d0c3c0-17f7-40f1-b100-e2044f78f81d", "comment": "Malware payload", "value": "64efee3904133dde56409c7ca1604067aa2a014d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852363, "uuid": "35c399ba-cdfa-4035-8490-0c115633ce16", "comment": "Malware payload", "value": "c244fd3695eb4154f518850b2dbbd0e4e28e55fe24f4c2cccdb8b25529f0bba385bdccb48238182b8429d52d8c12668e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852363, "uuid": "b4a6f49a-9b2a-4104-86f4-ca8392dd2807", "value": "T15436EF82B291830AFD1F19F5E2D2B353E372AB41A60392866674251DC75FDA43FC618F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852363, "uuid": "e64acdad-f8cf-4bb4-ae3a-5c0b6bbac48a", "value": "98304:dx3cU2AkCcXI0ywLHBv9YMu5e1OS63zEAuF5olVxU52iVwDkui:wI09wML1OSTDaU5Zw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852363, "uuid": "044e34a1-d43e-47d4-96bf-3a35b7e71a48", "value": 4892136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852363, "uuid": "9c24181e-b3f6-4ce5-b44d-ea2938e67f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852363, "uuid": "ea0f0f0e-599a-4f7e-b7b7-0426c3349a79", "value": "PDFSkills.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b559d85-c77b-11f0-a129-42010a9c0007", "comment": "Malware payload (AmosStealer)", "timestamp": 1763799227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763799227, "uuid": "9a4aae0a-80c7-4c3e-af97-590bf759d3f3", "comment": "Malware payload (AmosStealer)", "value": "63084c3f4848e952e0a24b680ed4c9fd", "object_relation": "md5", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763799227, "uuid": "763fad30-a6d4-4294-b3c8-00ee8838422d", "comment": "Malware payload (AmosStealer)", "value": "2b790c4d3eeddee410bb8f666759030e7f037e407144706931e0e68ccff976d2", "object_relation": "sha256", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763799227, "uuid": "d26acf4c-55b6-41ad-9fab-2493a27c54d5", "comment": "Malware payload (AmosStealer)", "value": "4c71f935c074aec865b929a73a7143dd9e0d476e", "object_relation": "sha1", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763799227, "uuid": "bb675e4e-4b4f-4a3b-a937-72cdd5664947", "comment": "Malware payload (AmosStealer)", "value": "0248f570483da5044a0b1f1328cf17e569638c6ca0bbac79356350e7bdafc2c22ca0aeccc95f88966144090b9cb1e400", "object_relation": "sha3-384", "Tag": [ { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763799227, "uuid": "c572edab-89ff-456b-bbe6-d753313d2e1f", "value": "T19EF05CB1F4145C2022AC847450084029F453E727972A2C5461F3C2343ABE692E59E71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763799227, "uuid": "3ebacf74-8f9a-4189-86d4-09d251a2620f", "value": "12:Q6A/bv/S7FlGp+Deu7DBP/JLMEam3FmrOrxDZshVIY:Qj/bv/UbxnBP/ham1O2FZ3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763799227, "uuid": "78450e99-52b7-4fd8-b005-177cd44aa65d", "value": 442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763799227, "uuid": "28af86b2-1afc-479b-8061-1d867164d18a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763799227, "uuid": "85c85031-707a-4c33-b907-e6a323270e4a", "value": "cleaner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5203215f-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855556, "uuid": "da5a1bee-159e-4935-a1dc-fd776b9782bf", "comment": "Malware payload", "value": "d52cc6f8f2df2ec03155e1ffa7a7ff96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855556, "uuid": "ac2d6b2d-d8ab-45f2-8f24-bfa0cc1a2da8", "comment": "Malware payload", "value": "2b8d25c562b20467aea9ba78fc9ca6b64fee9540948df239b0588c2c6e70906b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855556, "uuid": "2b1b7ef7-247b-4636-8833-c49ff1c04ec6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855556, "uuid": "8bb8ef73-2af9-4a82-85bf-6ade1de2efa5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855556, "uuid": "acce7b83-6c02-412e-ba47-79340e07dc94", "value": 10781188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855556, "uuid": "70b1f5b2-d973-4846-a450-990ba9046371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855556, "uuid": "924d0e89-bce4-4811-9c8a-d11f20ca1321", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52dec0f6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855557, "uuid": "114f2e75-a141-4a22-ad42-7de317703104", "comment": "Malware payload", "value": "01923eb2813c5bf330635cfe006b3d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855557, "uuid": "c2f38fd8-4916-406e-8f32-3c63ffd1d9ce", "comment": "Malware payload", "value": "2bae76165af90a4207912ae63d1256c40519c70d62b9ad3a83f3f8688c3247fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855557, "uuid": "22cd2dfe-7979-487e-90f7-b9df036b4140", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855557, "uuid": "6997dd42-49f7-4703-b45e-ef11da4a31c6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855557, "uuid": "9f71965a-6b02-48b2-81d1-774582bd8a3a", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855557, "uuid": "e8d6b845-40ef-4cd1-a100-2e82e203008f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855557, "uuid": "25924cdb-058c-40be-996b-0481874e5ea0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b29fbc-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855558, "uuid": "c202c12f-2ea2-4d1b-8943-54a21641d85f", "comment": "Malware payload", "value": "ef47002383b0292235a8b960a21d93dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855558, "uuid": "4366be23-acbd-4ce3-afa3-cb8ed4a450eb", "comment": "Malware payload", "value": "2bcbd156f2d145de3f123b66f6ede7798850171fc37db141bf1c71553a6d028a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855558, "uuid": "6a0148d2-4fe0-4e05-a4db-b4e71cb2aa63", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855558, "uuid": "751ade41-100a-4049-8f6a-0f3c08cd0b66", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855558, "uuid": "059ffdcf-8844-4bab-b86a-2e0d13e4770e", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855558, "uuid": "d700a1e5-0f4f-43f9-b784-a6906d098116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855558, "uuid": "655cb0e3-59cd-449d-b44a-fd7500261ccb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548e4515-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855560, "uuid": "25e3a62f-0825-4dd6-8e63-ecf56cff75ef", "comment": "Malware payload", "value": "5ecbd1e23d18e5f199be246ea121573c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855560, "uuid": "8cd15d99-7e0f-4384-b3ec-991ceaee745b", "comment": "Malware payload", "value": "2befadadbea10852c8d9c42a488ebfe1b9096e91571b3b017408567409a699ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855560, "uuid": "eee0f172-6c0e-4c54-bb6a-ad27276020f9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855560, "uuid": "c9f58349-e64e-45b5-961a-0f4ee0ae88f0", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855560, "uuid": "36563859-3580-4e39-a5e6-5f8b57759700", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855560, "uuid": "5bb3fcd8-7e97-4efc-b540-7d964f7e9336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855560, "uuid": "9d133e59-0d96-444c-ad59-d72af230fdbc", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5561b696-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855561, "uuid": "d0be3b7e-7430-4c81-8fd3-90dbc6a936ce", "comment": "Malware payload", "value": "4c2fa6f6ef039815f032f5ef92a86b5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855561, "uuid": "3d626e2c-92ea-40ce-a165-fc7871f7eeea", "comment": "Malware payload", "value": "2bf4d3d0469858e17d9d17c3a56ead1d24d51d5f70453e94e17bd020814c292c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855561, "uuid": "cb1aa03d-5eee-4b1d-9509-f684d1c77687", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855561, "uuid": "63abfd68-006f-4ec9-86d4-33506c8dc2ef", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855561, "uuid": "78cc3391-2c55-4ca3-8a21-26cc89d5b2c5", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855561, "uuid": "0cfbb649-eb16-4f4e-b44f-564a1172cdc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855561, "uuid": "04144a60-aa7d-4241-8e0d-1de4ac74e3a5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56248172-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855562, "uuid": "3c9d0b2e-3e64-476f-bee6-3d51e3c26c50", "comment": "Malware payload", "value": "13d18b5218e605a0f691bb5e89e892b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855562, "uuid": "5f979067-172a-4853-8ba3-8a9a4c241e40", "comment": "Malware payload", "value": "2c0374473b6cb9e75e41bedcb3ae32c0bfc9b2bad859a031e5ae35c5f2168479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855562, "uuid": "1fed04ca-213a-4ab3-8f01-44251826e34f", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855562, "uuid": "914e143d-79c3-4924-9951-626340c893ce", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855562, "uuid": "9d4a148b-5666-44c1-8834-23a7309a7a70", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855562, "uuid": "46ff6427-fc0d-4230-9a6b-fa7c4b236c8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855562, "uuid": "d5da77c9-6121-4a54-945c-d9d9ab2fab4e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8921533-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855379, "uuid": "bf9c64b5-c6e1-4771-b676-406982497230", "comment": "Malware payload (Mirai)", "value": "2132e168d728b7f9cb3a45ec75cd4846", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855379, "uuid": "70461281-c935-4213-9233-590b66a9d9e1", "comment": "Malware payload (Mirai)", "value": "2cd631e6f7aa3badb6730874598da224e007401f9f8ee2a4c64ac74fe0b34373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855379, "uuid": "373346a4-5e4d-4c83-a023-c0e93eb36bf8", "comment": "Malware payload (Mirai)", "value": "83bb7b3accbdc63717ff28896e0a925739f6084d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855379, "uuid": "d5910d4d-a058-4ec4-93c9-026f956726fb", "comment": "Malware payload (Mirai)", "value": "8d179823956e53e81490727b3aa1a7e31fbef12e8367ebdcf45ec3b0de6f88f5db60d031eff15d9fc699aca5463a2e32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855379, "uuid": "0847988a-7f5b-43f5-8b7f-f36236812ae4", "value": "T156933B56F9818B21D6C112BAFA1E118E3313177CE2EE7212DD146F6477CB96B0E7B802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855379, "uuid": "92c49005-beef-4960-a318-645943fb8adf", "value": "1536:4nsnAO0Y+Y2KHICj2XrMDkmJZt0au5x8WCBD1iVfhGSgVA7pR5bY1g/N:4fOxtoI2X7yZt0aunfhGSgVAdR9fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855379, "uuid": "4e2ba365-690b-46f4-9568-619b3b52689e", "value": 97464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855379, "uuid": "0999cc66-cce1-41fd-94fe-321d341f9a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855379, "uuid": "6ce44732-58a3-4653-8e76-3f10f3d8dd4b", "value": "Labelloperc80.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e818f4-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855564, "uuid": "6fedf060-6308-4510-a839-b065b7487fd5", "comment": "Malware payload", "value": "3d59fb9dbc431bea9595792a4f49522b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855564, "uuid": "5286b749-1518-4980-9784-b07585b0b3b9", "comment": "Malware payload", "value": "2cd8d23b5531c2c16c76c71441aa65991e8f65e548ff205916244b2783625844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855564, "uuid": "f76f7177-25fd-42b9-a30f-1e5634855ae6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855564, "uuid": "3b2c95d5-d59d-4e4a-9310-c5a8be05e236", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855564, "uuid": "225a740c-4fae-431a-9211-4726fee87850", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855564, "uuid": "7b8b3b40-1412-4728-b198-890ab1db9fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855564, "uuid": "74bb9924-6bb3-4877-9db2-290ad03ec3b4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083ab8c1-c747-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763776834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763776834, "uuid": "885635d3-da02-49fb-af2b-5939fec033b1", "comment": "Malware payload (Mirai)", "value": "9bfc23c41f729d70dfda8f62adb5700e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763776834, "uuid": "72896665-d8b4-453c-8776-28d6cfb78b2d", "comment": "Malware payload (Mirai)", "value": "2d2ff3c28909b4664be5fbed58d4009c245e5aef46eefbecba9f90ed6a049b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763776834, "uuid": "4883708b-763c-45e4-9700-75369fec888f", "comment": "Malware payload (Mirai)", "value": "27c3649ab417f095306783a636adfe7fc545a666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763776834, "uuid": "4924d0e1-f539-4b07-b04a-234841071825", "comment": "Malware payload (Mirai)", "value": "0aedb3f54aa3c9228b3d0547b51edcb94ad51c0a9809c4fc78fea4d5c71aea96df3c8ad839f49fa6cb11d062c825c25f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763776834, "uuid": "0d72cfc2-fd57-4574-8b02-e35df2675630", "value": "T142D36C0A78D230FCC68BD13156AFDF61AA36749C01183DAB9387AE711D36EE05E16E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763776834, "uuid": "0551b867-588f-44a3-af52-2bb23a174a3f", "value": "3072:Z4rfmLh4JnCPx7vSV+/OyGaetiFaU8YY7pI:gmK7yGaqaat/pI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763776834, "uuid": "705de992-ded3-49b9-a149-2bbdef3b897b", "value": 136256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763776834, "uuid": "922f5c23-86de-4007-99c4-fa916e440a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763776834, "uuid": "921ee148-1c8b-4a0a-9917-946b6adb6150", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b297ad-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855565, "uuid": "4e6f8777-08d9-473d-8ce3-a5b153ee3a6f", "comment": "Malware payload", "value": "93e71f8404f99c322d702ecb78cac3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855565, "uuid": "e2737880-927b-491b-92ae-3bc9fde489a0", "comment": "Malware payload", "value": "2d68cfed231cf8795f91bc17d6659c9d1861822e1018878f626bbfe718717a58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855565, "uuid": "21aa163c-e6d1-4c2f-8865-f08e72d86bf1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855565, "uuid": "620d03de-dde0-4555-a1da-d8ed7cfe698e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855565, "uuid": "ad4a2751-9fd6-4c14-8085-974f15e50df0", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855565, "uuid": "ff332830-161b-4970-85c1-94e3c632b47c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855565, "uuid": "48fec917-e5ba-494f-b59f-a9e1a9940e27", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310d10e5-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850776, "uuid": "21f39783-d155-4070-a811-6092dea6bcbf", "comment": "Malware payload (Gafgyt)", "value": "83b14c867386d59ef1537a01fbb4ed7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850776, "uuid": "ce291991-0cb8-45ad-947f-d64160242746", "comment": "Malware payload (Gafgyt)", "value": "2e2b0dfedfcccd8f8cd2efa36b2ad9539b87711a7b14e2e93a08ed06a20ad486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850776, "uuid": "5b3f03a9-d234-4cb8-9161-73f86290bd67", "comment": "Malware payload (Gafgyt)", "value": "98c4ca25f5674bdba9ce9789636049f95c5e8775", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850776, "uuid": "e2c141a1-0cb8-4904-9ad1-40c143b12729", "comment": "Malware payload (Gafgyt)", "value": "ca5bceadce2575f156cb31d49909fb14d84cd8adf334c9e24cc03568548312849239285b0478b9a7201c8c695324ebf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850776, "uuid": "b580abd7-2520-42a8-909d-5792ca7155cf", "value": "T18F832A42E646C6B3C4830AB2029B9B560A32FABB0E579E55F35C7CF4AF128C57117F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850776, "uuid": "08623def-0bce-4b06-bf22-c689d0c566be", "value": "1536:7XO7ySPJWVjRWH4Eav9gfW+M/MXxLBRYmJxKk5h3dddddVi0tmYHc0r6jmVfKXd:S7ySPJWVjRWH/VOF/MhLbY+55hLHtmUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850776, "uuid": "1821d500-d324-4c4c-a4c2-28a9b5e8e947", "value": 85756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850776, "uuid": "3885d569-6fb0-4443-9b0a-c09735325a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850776, "uuid": "2efb6bea-1af1-4bd3-92df-7ba71dad72b5", "value": "Ayedz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a15feb-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855567, "uuid": "766703da-5a8b-454e-9fe5-15773087582c", "comment": "Malware payload", "value": "62530cda796e087bdc8e4ab654bb30b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855567, "uuid": "51e717de-8641-46c3-9c23-94224469019e", "comment": "Malware payload", "value": "2e3bf821dfdd585a3459493944a485dc4bd5c94405159cad318f73592562ab2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855567, "uuid": "96bb2591-4742-4c8e-ab11-2f33ecd5e073", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855567, "uuid": "82e99a2f-4ff8-446c-98ed-7a6d2fa78bc2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855567, "uuid": "1d30bde0-cef8-470a-bd37-d255901df5d4", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855567, "uuid": "c485e115-727b-4821-a54e-04b5d866e376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855567, "uuid": "1b3b01a0-9ce7-4bb1-a5db-d164871604fe", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e2f600-c7f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763851609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851609, "uuid": "1992bd13-23e4-43ed-b1f3-5372af77ea86", "comment": "Malware payload (Mirai)", "value": "fedc0ea1c1f25841bd579ccbffcda583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851609, "uuid": "3b8f20a1-bbc4-45fc-a443-a6c6ff07db81", "comment": "Malware payload (Mirai)", "value": "2e494f734701ab05cbe6a64a651e12d21858399c26ff2565802303dcb8fc45a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851609, "uuid": "11b5572d-4d9a-457f-ac9a-f636f856e0d7", "comment": "Malware payload (Mirai)", "value": "51a0193dd1005cb3803e68188886e2f005b60177", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851609, "uuid": "2ca4915b-9d9c-4ddc-82ff-e7c6ca53b616", "comment": "Malware payload (Mirai)", "value": "87988a1fe930ed9b717c4fba23ab05624f74b06b4a5351cb667f49afbc0c8e2c253d21412d6cfa255525a998187e8c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851609, "uuid": "509619c3-9406-44c7-a760-ec11dce1945d", "value": "T15453016B63016941FB6108B639AECAD475BBAAF873E1717E08E64B14FF6103454F42CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851609, "uuid": "3fd81ffd-8ff9-4c13-a16b-f9420c2be2f7", "value": "1536:+PERROKruuVhFksUHQ57M52nndj2QGmEojfsUzY:HHO6hTS52ndjV6obsUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763851609, "uuid": "8bd0211d-132e-4915-8209-b38dc6d5997b", "value": 66020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763851609, "uuid": "1f85e21c-41c6-4665-bb9e-f245fffe9ec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851609, "uuid": "ebc67230-ad69-4c92-85ce-29076ae88eca", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5959c832-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855568, "uuid": "4da5f70a-711d-4964-abb4-38d6f244e82d", "comment": "Malware payload", "value": "e41e7edbf5552de2cafacc02ff915f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855568, "uuid": "cd8fc357-ef69-486c-ba18-e933fa523f13", "comment": "Malware payload", "value": "2eb075243bed26a9c6af88a91a82c23a7a5564e95fc20af086302fb491622318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855568, "uuid": "31e57ca1-e429-4d2d-a06c-d504b18ab0cf", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855568, "uuid": "5633ca51-0dd0-417c-b3ce-2133ef64f221", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855568, "uuid": "b3a89b5f-6573-4fde-8f4f-6e6884db4d21", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855568, "uuid": "fd75f4a0-82ce-4f7d-86b2-6c73f403577b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855568, "uuid": "4e0363c6-2824-4da3-b7be-569ef60eae7f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2ec090-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855569, "uuid": "27915249-f4d4-4ce4-bf10-af0f040ee328", "comment": "Malware payload", "value": "74268fca9a3c89fc758872ee37ffb3f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855569, "uuid": "3f256c78-0e22-4030-bf33-70c91f52ffdd", "comment": "Malware payload", "value": "2f0752271eea564cdb2163854fa141fc3c53cc98049cae2132093410a9b875ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855569, "uuid": "42c3811a-eed2-4643-9168-53f20080c0fc", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855569, "uuid": "605c3648-408e-4d3c-b73f-f8ba46999524", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855569, "uuid": "9d137a13-d403-4d32-bb7a-7c6ef98b7dd0", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855569, "uuid": "22050cd3-822c-4a2b-967b-23a26b40b9e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855569, "uuid": "b1d1c637-354b-4886-bc10-3db5b8f57f95", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e4aba6-c7b7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763824930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824930, "uuid": "d912bfca-8f99-4b3a-9a5e-284f4b8496da", "comment": "Malware payload (SalatStealer)", "value": "a65337eaa7a6104db04e607d9ce4d313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824930, "uuid": "3ef1b55c-106a-4f0a-86b6-3ed477736f33", "comment": "Malware payload (SalatStealer)", "value": "2f0f06882310632e20afd0733b679e96c84de9e3a7ce8c26c97ee2fb6315d803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824930, "uuid": "37eb07ad-62e3-406f-86e5-8c14030e3222", "comment": "Malware payload (SalatStealer)", "value": "2f091879fc0d58ce3229f5b53fc9146f46e9ed0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824930, "uuid": "473ed908-33bb-46e0-a44a-5180bc71f6c4", "comment": "Malware payload (SalatStealer)", "value": "dfa871386a06f0c4a6b628d6ff57c85fee73b0cec088fe73b7dc64212b8eaadb6f0ccc42ef652101c37303f00040bbf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824930, "uuid": "134be63b-aa1d-4e57-bac5-7fe838d7f13a", "value": "T187E5332F32AB48C9F9B279749CF67053C2A613F150321EA305B89B8257346BF615C67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824930, "uuid": "1c8c9f56-eae8-4624-83e4-e675fe967606", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824930, "uuid": "5ea652ff-45c7-42f6-bd86-c5ea3bb15033", "value": "98304:m/dUGA8r9TI7N5oASRcR9sP7JbxyddcLYeatn:GdUM9aN5vRCH4cLPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763824930, "uuid": "44474735-08e1-4764-9019-1ce0d2c358cf", "value": 3292672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763824930, "uuid": "e1e1d85f-922a-4741-8f7b-3a8557557c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824930, "uuid": "9d1a5ad0-511b-4764-8a60-c2ce23ff64ea", "value": "RuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b177c81-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855571, "uuid": "dc1e0fff-94a5-46d8-b913-2f9340351be9", "comment": "Malware payload", "value": "a3d72e68ee40e8e248dba35f3f858177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855571, "uuid": "92ceaa81-dba2-4451-8328-816f8c0ee6a9", "comment": "Malware payload", "value": "2f1a539a6d8a645f69922164e23143d1ce1cce46fa526a6b7f7c2d5dfb81c888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855571, "uuid": "e681b827-d34c-437c-a05e-908c7c37f2f9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855571, "uuid": "927914d6-8f1f-47f1-b94f-52d23927f895", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855571, "uuid": "c9d80eb2-29dd-4546-a10a-f683e0084bc3", "value": 3266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855571, "uuid": "d451ac16-b7c2-4754-a69e-25dc9449fc2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855571, "uuid": "6ea1d4b7-1d30-438f-a660-6a9c07f810ca", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfb2102-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855572, "uuid": "8e919ab3-3fc4-459f-a66b-e14adfaa3c7d", "comment": "Malware payload", "value": "7e1a67dd1842fb45695200f918b4e9f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855572, "uuid": "4f6a81ea-c967-4e67-a100-df96274b725f", "comment": "Malware payload", "value": "2f58841607c54e8907de46ebadac93faf3c34b52ada31db547753a64dd484379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855572, "uuid": "f8420021-126f-40be-811e-a12b02091397", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855572, "uuid": "84054b20-e825-4e16-a8ce-81b0b7194043", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855572, "uuid": "e8ad96a9-b32f-4ea2-97cd-7ea113d91454", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855572, "uuid": "1948a7e3-39f0-4389-a4d4-2dc02ef9a23d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855572, "uuid": "99eded78-94af-473b-bb5e-f7f325bbffbb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a23272-c7f0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763849740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849740, "uuid": "94eb9270-65e7-4e1c-b503-ac93d66a02f7", "comment": "Malware payload", "value": "b5ac16cf3a01a32cd5660945a8d0b59a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849740, "uuid": "6f5f8e48-828c-4f85-a6a5-498d443a039d", "comment": "Malware payload", "value": "2f5b745405c5d05d78e7833124f82c6c752e20607757be3603ce722eb9cbc057", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849740, "uuid": "e7905e93-1de5-4d2a-a018-215246fee319", "comment": "Malware payload", "value": "886c2d548a31b66968450bddb07afe76152762bc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849740, "uuid": "8ebd8c0d-18b6-44f3-8587-b55ae64438dc", "comment": "Malware payload", "value": "9327248fb3224f99fa42aa991ff368809468925bb6cee6a6a8d2f43b53aca0452d9355d331dc2db8f930110fed0c2f7a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849740, "uuid": "57ee5a86-880c-4604-8fa6-42adc2b67813", "value": "T19E564A663DD08B7CD959A23DB46551D3A6A0BC384B3963CF2E6039353E37BC06936B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849740, "uuid": "cfd8bebb-055d-4a5e-88b8-174091ef45d7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849740, "uuid": "45b5d24a-0d86-41ed-8ecb-298c42f97616", "value": "24576:HFNPveq+Ko7liLXbrW5qSTHDHyuILDQ4zjvIdxaCTGEzscxF6rn:HFNHeq6iLXbrWcwjHEw1xBONrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763849740, "uuid": "24b43aac-b213-41fe-99a1-773ca436b7cf", "value": 6089952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763849740, "uuid": "e4d0abc9-d5ac-4279-9397-66c5b691dbd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849740, "uuid": "c8de6929-b3ca-4faf-a31e-190afe481d7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccc68bc-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855574, "uuid": "87b13f56-e1a4-4bc6-8d45-26df26f1cdfe", "comment": "Malware payload", "value": "b92cf2d3f80024b9081da53288512642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855574, "uuid": "f767b04c-6572-488d-91dd-405d5c0a0287", "comment": "Malware payload", "value": "2fcd1eec9397978660ebf6dd9a07d0992ca9b4a9c9711b07afae20e5f55fc7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855574, "uuid": "b5341226-7d2e-4374-85bf-4b34cd9af899", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855574, "uuid": "00dff71b-7cb3-45b2-9775-6de59b03fa86", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855574, "uuid": "a8623b4a-9e46-4f29-b452-54b8c6b23ade", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855574, "uuid": "55b55bc4-58cb-4229-b04c-0c8ea4f47cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855574, "uuid": "e88d8ec4-d87a-4d85-ba4b-8c3135415538", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d981f49-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855575, "uuid": "d3f5e37d-a68f-4362-994c-61801ce0bcdf", "comment": "Malware payload", "value": "e188aa1852c93c87552b09cf08467c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855575, "uuid": "7523946e-2741-44d0-9aa5-cf6f0cf5e727", "comment": "Malware payload", "value": "300445b28e0b10c17ebbfeb468f48875f424948e054cd7b6330815a4c3c11f15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855575, "uuid": "f61e588d-978c-4b1e-af26-a2e831a32a31", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855575, "uuid": "f5a8dbd2-db63-4e0c-83f9-84ec8bc5a63d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855575, "uuid": "007ada4c-350e-4bd2-a51b-48a8151d196b", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855575, "uuid": "c4e7197e-01e9-44a5-bfab-3d22639fc91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855575, "uuid": "afe76407-60e7-4147-bf04-08f7db42e28c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a572b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855576, "uuid": "5357af09-3f50-4e70-a8a3-afaecd682fae", "comment": "Malware payload", "value": "2b7f461ca51d610c38e981de5f6b7b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855576, "uuid": "c5e7dc1d-6622-4a2d-93e2-8d8aca6b1ab4", "comment": "Malware payload", "value": "302f337ad308a41e7fa19198075645d7f6be5541bdfcca3c0e35c48e0a4a5e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855576, "uuid": "b7cdd29f-2d07-41b1-9722-24b1d9070d33", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855576, "uuid": "dad161c1-b86c-4f89-b43c-519d1767fbd4", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855576, "uuid": "0ff9bf87-44ce-4248-aa84-2b4e11ed01d3", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855576, "uuid": "06f4d889-b9a2-4450-9c50-6f23a4429649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855576, "uuid": "ace1c604-6b2f-42be-bb04-795aacb10794", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f35a764-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855578, "uuid": "b23aeb17-23cb-46f0-a52a-fccde1019405", "comment": "Malware payload", "value": "ee2f6ce17fa97e0e002730f68ee59398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855578, "uuid": "cb145860-e37b-4274-9dc3-b6292f095d13", "comment": "Malware payload", "value": "303a0eb2b731722b1a45fc09d3dffca5b7a72a1b7e29c4d0f604f5306b745feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855578, "uuid": "e6196a17-c16a-4d39-9de9-a4b08a7dc662", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855578, "uuid": "8eab8f97-78d7-4c28-9525-044f2d307fe6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855578, "uuid": "78041b67-afb7-40d9-8fde-8e5ae4a52ccb", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855578, "uuid": "be5c278d-0aae-40a7-ae1d-103b5ff416f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855578, "uuid": "eb27a9d8-fc44-42d5-9b22-08376280c76e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78079745-c7ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763847888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847888, "uuid": "fcbc0cbb-dace-4250-8700-fb1522c5d592", "comment": "Malware payload (Mirai)", "value": "1ccfd18ab1022a1bc3152cfbde645af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847888, "uuid": "a0e16d16-b879-45c5-bb7e-a0d7b8b0e486", "comment": "Malware payload (Mirai)", "value": "304f157616d1ac60866ddd413cbecbf8fafff38fe203fdeb75291884531f1192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847888, "uuid": "439142d5-7984-4ba0-9a76-4ba844c7949d", "comment": "Malware payload (Mirai)", "value": "257e19c11c0b849ff23f57aa2ac7220faebc9ff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847888, "uuid": "d3084f1d-117e-4f2d-8216-aa31150ac36e", "comment": "Malware payload (Mirai)", "value": "c5ac4a35bdc25d266f88b398867071f9cfcef0fc9018c7d4b6569dd53675e4c14e44dedeb3d3ee9e31a20abc41af1fe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847888, "uuid": "1b322f62-c32e-4c4d-8ded-4175cc5340c8", "value": "T1E0833BDAB400CD7DF80FDABB84574915F620A7544BA20F27B36AF9A36D720A44D1BEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847888, "uuid": "67f16790-90f2-4808-98ca-849ef162d8d3", "value": "1536:9sLgIJdDB/gd6RsXsQs0RR70t39fz1+rGo8iwnDiJiiN15qjTnRBTlayPnR:96gIJXgd6RsXsQs037cd1+rGXQiY1s71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763847888, "uuid": "1c4b91d5-130b-4b7b-b836-928bba9b6f59", "value": 83656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763847888, "uuid": "7c5d9565-0e33-45a2-8404-6a2eaf108d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847888, "uuid": "eaed9067-b7d6-4bd8-bcfc-4ba62286941b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601fd288-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855579, "uuid": "9674b5c0-8f4e-4a30-a006-825fe93879ce", "comment": "Malware payload", "value": "007c89c0b5e14ca268add3cdd35c152e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855579, "uuid": "8ffb3c5f-9c04-4a82-97a6-f076c56ad3c0", "comment": "Malware payload", "value": "30743214324a37a3830fa4e9177826b370cf30800844845a92b95261e1d8a486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855579, "uuid": "a0dee411-e399-46f0-87d2-8ee9456972ff", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855579, "uuid": "5b1cd300-bd7d-4ddd-ad57-f9f614d99161", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855579, "uuid": "110b528d-6eef-4611-aa14-d80e4f1697b7", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855579, "uuid": "5972dcc9-cbd0-42c4-a3f7-5438942a3ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855579, "uuid": "8c94a3f8-836b-4c06-986a-8b890bd8b2ae", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e8ae12-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855580, "uuid": "b2602820-3533-49e3-95c1-c44bd16ab540", "comment": "Malware payload", "value": "6439eef66667b7a26d2b23938f35003f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855580, "uuid": "700a5c58-9fe4-4fbd-aed5-580174e82317", "comment": "Malware payload", "value": "307637d17b80bc0cf0db4834d177b4c4e681e8ba54ec23eb3bea904d4ec183bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855580, "uuid": "508cd728-3af2-4f3a-951a-748fc2f8f1bf", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855580, "uuid": "d4a0ef7e-4097-496e-b522-780e137a9af4", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855580, "uuid": "4ae0f775-8fdb-415c-b5d1-13048b282140", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855580, "uuid": "2385c861-b8bb-4d73-8020-fb5eb2cd19e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855580, "uuid": "2603966f-0489-4016-8d31-bd7a56beab6e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ba2684-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855582, "uuid": "2a960733-11b8-4f90-b55a-0ae6754264f6", "comment": "Malware payload", "value": "67ef7083ec26e41923682487b2097f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855582, "uuid": "a3b2b659-d0f4-4aa4-b23f-945ef31966a7", "comment": "Malware payload", "value": "3077f4c72be6cb4d777c6885911bfab452444c6bb4673ad58b89fbba6fa0900e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855582, "uuid": "5c670128-11e2-4197-ba5b-e8a07a8c13ef", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855582, "uuid": "cf3bd820-4d7c-45cc-8eea-2712c04352c5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855582, "uuid": "7efab7c5-3e56-4c9f-9f09-9a062170a58e", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855582, "uuid": "e5faeaf9-5310-4902-9f08-4d11e9818aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855582, "uuid": "1c7e19d5-fbcf-4af2-b821-a7d657d3aee9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628a8dc3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855583, "uuid": "a3fa10d5-fcc9-4c4a-847c-d8a1086145d7", "comment": "Malware payload", "value": "3b414176827626633f351361496aabef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855583, "uuid": "3472bed2-3cea-43e6-8122-1235a02a6958", "comment": "Malware payload", "value": "30b8fe13782528d658e39939a192bd67adfa91c71aaf2f1ed31d2fc77e56c1c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855583, "uuid": "7ac6b42a-08cc-4b3a-8ce5-fb187dfa978e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855583, "uuid": "617a92b2-720c-42c6-8ba7-29584d5c4bb2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855583, "uuid": "18e742aa-85b1-49f4-aa82-6ce2901c0196", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855583, "uuid": "b464d49e-acc1-4f67-bcf7-10d283d98a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855583, "uuid": "0f53368f-9bad-40fa-a0c0-714380d2a0ce", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9529f8fe-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829469, "uuid": "dfb4bd6f-122a-4a1b-a6be-79c2c5e7c299", "comment": "Malware payload (Mirai)", "value": "e58cc4bc33b43995192669dd60a3e2c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829469, "uuid": "581976da-8903-4146-bd34-0503480b13eb", "comment": "Malware payload (Mirai)", "value": "30d57095d1350a5ce05cceb497c862b7ac7b8910fd41d31cee69b542d187f2c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829469, "uuid": "f41c7adf-86b2-46cc-a7ff-b96bcc95bb63", "comment": "Malware payload (Mirai)", "value": "0fe4c47bcac2a40c6eeb1caefeb36795bbb4fd69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829469, "uuid": "147cc652-9429-421b-b379-a274ee0ea4c5", "comment": "Malware payload (Mirai)", "value": "3f4fa255d5d9093e51fbf7dce315596f8d90d0b4ce40c4374279a44e5004305e414f5f2b9d2628fa24f2b0e4aa5e54de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829469, "uuid": "a6f76a41-60f7-4075-8541-ed3d4b7b1888", "value": "T1E2D35A9DF58BC2F5D8174970A066F3FFCB32A8255072C60AEF89AF31CA334919616359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829469, "uuid": "3f58539e-3d5f-4c31-98cd-3831651ed8e7", "value": "3072:dtlJ76RNjk055VsG/ha4bzrx1m7b77Jgy48h:X76RNjX7WG/zcXRg18h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829469, "uuid": "dabf404a-cc08-4643-a4c7-643189bde706", "value": 135820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829469, "uuid": "833b9c6f-b539-4054-85ce-43ad2482df08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829469, "uuid": "15991581-45b6-43e2-a365-581dbcb52a1d", "value": "Polar.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e28095-c7ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763820444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820444, "uuid": "a82bb64a-acd9-42ed-b260-2a510755338b", "comment": "Malware payload", "value": "cfbf88b3f15b6dbd05c7a159f9881d92", "object_relation": "md5", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820444, "uuid": "5ad9bf87-66ce-4538-8007-5fb19087c628", "comment": "Malware payload", "value": "30fa8956af9dc738b90d964bb1c33f25a276b57429a85b8a72980827b7c682d6", "object_relation": "sha256", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820444, "uuid": "5a76e496-4b1d-4a4a-9de7-b1c45ebe57f4", "comment": "Malware payload", "value": "946f257c61987a5c6b2ced809c596afafada01ff", "object_relation": "sha1", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820444, "uuid": "92b6fc38-f39b-4a1d-9788-64b833cc081c", "comment": "Malware payload", "value": "67d088dfaed0de18dae3904b54e549f3db1225af8539e59fe957ca4f0420a3af388a739902f0ef2c185012162c6b79b4", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820444, "uuid": "b785b66a-b266-4a93-977b-509e982dda6a", "value": "T105639BD717DC0AED9B9089D68159760768F7C17B2C1E528DF9E28643B03ED20B71AB34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820444, "uuid": "0a2f5aab-1e46-459d-9ba3-02a6106cabaa", "value": "1536:K5Oe4RTZas1upYo8pVvnGMFrux2FDbLHryY6Yi:Ke6Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763820444, "uuid": "eeb0b76d-aefe-4a10-9798-848829623d45", "value": 73167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763820444, "uuid": "31c2f988-350e-4f21-a41d-34b99d15580f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820444, "uuid": "9dde6f16-0603-4188-beb9-d805b871513c", "value": "t1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb66feb-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829406, "uuid": "8aedff04-0cd0-4aa3-8fc2-14a9a60702da", "comment": "Malware payload (Mirai)", "value": "4e3b33fa5d0e24926ac3db45ec5db2b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829406, "uuid": "76e531f9-384e-4df4-8774-893a99ce5c14", "comment": "Malware payload (Mirai)", "value": "31089c8a5283bb413a4d4baf0465cc0865bd741ec5243fa42c9e4a0b1e8b23a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829406, "uuid": "416ace27-9a27-4a77-9f6c-e8b414a8881e", "comment": "Malware payload (Mirai)", "value": "c1374516bd1d9b00e34a0bdf30378f1aa1b6e65b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829406, "uuid": "85e7cea4-71a5-4ffe-8d3c-cc28b8f20afc", "comment": "Malware payload (Mirai)", "value": "d9484d3b272e7489c408f98e1eadb162409e323767165beee9571ede5b4700b6e352b071eff142697b9ba17b56f09cf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829406, "uuid": "774653c2-bc12-45e4-a6f8-aa1943da710c", "value": "T1EC633D12B3F8173FC4B0A674C1772B137EA65AEE0960EA4FBD760D8ADD4129006667F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829406, "uuid": "40032633-124e-4ed2-a369-605832946ed0", "value": "1536:taK3g3Z9nJ6jeAGLaFd3bTvrvc+f/3fvrh9ZMd1IFoYkzvExGCw7h7zE:t1w3Z9nJ6CAbTvrvc+f/3fvrhbMu6Mmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829406, "uuid": "35e7bf19-3a90-4f32-97d8-75a778b0b5eb", "value": 68964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829406, "uuid": "b71de2d1-41cb-43d0-a465-f854fa0cfb3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829406, "uuid": "2edf7224-ea9f-43db-86fd-f68e013f16e5", "value": "Polar.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6362abee-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855585, "uuid": "78a7ac5f-a82e-4f5a-a9d8-269e197e71b5", "comment": "Malware payload", "value": "9af2fa00f1796e20cead33d3f7b7a373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855585, "uuid": "3ce43c17-5245-4172-a69b-fe1d57995612", "comment": "Malware payload", "value": "31323438645fe1e3990ddabcca227fc4d80bdcaedbdb3cf6c33de16b780551ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855585, "uuid": "9514556d-9682-4936-9f87-41d8645b803c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855585, "uuid": "af9a0fe0-07bc-421f-9420-9a0a49165567", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855585, "uuid": "d29934cc-d8be-4dd4-aea6-b052bae0806d", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855585, "uuid": "c4842e7e-b43e-4247-95bd-4087ddd4c51d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855585, "uuid": "f0a8ca87-60ea-478e-b93d-58cf29719207", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6431aa52-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855586, "uuid": "87883bf8-f65f-4c25-bb25-7e79d0ccf001", "comment": "Malware payload", "value": "2cf2356e6655866b03c2413a086347ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855586, "uuid": "b8d39ea9-90f3-4b0a-89fa-ca9f4e7ed09a", "comment": "Malware payload", "value": "313e3bbd68f7174f6992147a418a4bd61fef2234055ccc08272ee956c6e6f525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855586, "uuid": "d9e03ccd-04d9-4601-bb86-533121dc01d6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855586, "uuid": "542c7ddd-cb00-4890-96f8-6af0996a0010", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855586, "uuid": "cd1dee80-86fd-4a37-9b4a-53f6a4fc3bea", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855586, "uuid": "5a2e7f68-f5b9-4030-992f-3195006fa8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855586, "uuid": "c9000674-9b55-443c-be16-f4977ef2de08", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650ddd57-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855587, "uuid": "a847d979-04fa-4f2a-bfa2-cce31d41e826", "comment": "Malware payload", "value": "6a9412b64f7d2011c58c0a12fec3db09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855587, "uuid": "2ce0ac25-19bf-4400-89e7-a318fc50544a", "comment": "Malware payload", "value": "316cd571cd1a90c7dd47fb7b7d7af0155e4660937534f530504cb83f0892ab3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855587, "uuid": "6af31236-cf6b-47e1-aaa4-f53f6179bfe6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855587, "uuid": "aaa083cb-2afb-4e50-9791-3d32f5a79d3e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855587, "uuid": "c88c9fd7-b7ff-4c49-9227-8f4701c1148c", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855587, "uuid": "fac131cd-14c8-4fec-ab45-7dffa4399586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855587, "uuid": "efbcdad8-be37-4ae6-80a5-066a32764169", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4317fea-c7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852365, "uuid": "7c8d481f-5338-4b5a-870b-2e2db9dcbbb4", "comment": "Malware payload", "value": "8cb6c640c91f50cae8bd75106e1a1dad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852365, "uuid": "9bdaa652-a9a6-4b78-b4fa-e0f2b28653af", "comment": "Malware payload", "value": "3199c93d3301fa84f0d803932b2c67da0ecd9381a584f4fc52e84822da594579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852365, "uuid": "ee1e6eb8-5c12-4d54-b7f2-1eb32c306b1f", "comment": "Malware payload", "value": "5cbc6f548d6352bc1c2c3552cac3b0e5d2b50428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852365, "uuid": "785370dc-3996-47fa-b1ae-640833f4383f", "comment": "Malware payload", "value": "ed1f73d5f50725e8a86dab687b632e198fc85505d5f38650bebe28b6249e8b83452c5e4c81f0030f07a50df52abab5ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852365, "uuid": "31d0ea0e-4755-41cb-972f-d7508014e944", "value": "T10C534A826A348452C9770631F8FB8EA64E799A87999DBC47F04C720F2F31B43175B267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852365, "uuid": "ed519e36-81e5-4795-838e-66663c6a2bce", "value": "768:LPgeLhrVxD5zXCam0P5RRE55nLYEBiR0P5RREH5nLY09tYcFmVc6Kgr2JM2EgG:bDrf5za0P/xEE0P/b0VmVclQmMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852365, "uuid": "0ce74222-e29e-4245-a214-6e4289643c5b", "value": 63272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852365, "uuid": "4001ca21-d1aa-4cc4-92ec-6f6f6430604b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852365, "uuid": "5b337c3b-5ca8-4f6a-8626-7f3d0df6a317", "value": "PDFSkills.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65de4fd7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855589, "uuid": "ec34e21e-f0fd-413c-b168-940646bc3bf7", "comment": "Malware payload", "value": "2f9ca651525e18bde7f61b262834fc34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855589, "uuid": "964168b6-80d0-459f-a1bb-678d87b6ce07", "comment": "Malware payload", "value": "319d125d9f1aa9d654f31d6a4265d70b5b66053b92f92e604fc80462e4bff059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855589, "uuid": "ed55470e-ea85-4fc5-abd5-3046eddca2d4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855589, "uuid": "0502f384-1aca-4895-86f8-c9b9939bb0a1", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855589, "uuid": "564aef39-9918-4d3e-828d-af3109cde4fb", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855589, "uuid": "2c2d588b-5e09-414b-ba64-7671bdea012d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855589, "uuid": "ee4ab39f-05c3-4d99-b36e-2fc1b4006e58", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669dfbcc-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855590, "uuid": "175473fd-ec5c-4def-a328-d5c7402526b1", "comment": "Malware payload", "value": "e580355ef90b88b08bb1dac67a31d02f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855590, "uuid": "732bea97-fc33-409b-8c9d-2c700c03d83f", "comment": "Malware payload", "value": "319fc7fc20492e2f948c6f94f7dfeaeb25118176d1728b09b7e76129b8e31fa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855590, "uuid": "f69fb8f7-67a8-443c-9312-dca3d57d83af", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855590, "uuid": "08442097-9c32-4eb9-99e9-3724f716b7c6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855590, "uuid": "16024ab4-a736-4393-bebb-c2f224c647dc", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855590, "uuid": "bb3e0460-f7fb-4a16-b9e7-df29e531f7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855590, "uuid": "ff5051a7-4d21-4f58-836d-c0c70f1bf46a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82c5809-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853257, "uuid": "a94af213-acdb-49b4-b6af-d0b1f03d189c", "comment": "Malware payload", "value": "554dad3689bffeba5ed1d44b9d017ee5", "object_relation": "md5", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853257, "uuid": "4eca7e4d-14b5-4473-ba0e-2bc73249ba9d", "comment": "Malware payload", "value": "31b11fbe379104556a3f8fea4bb93ee9c39ef915e489402504888354ea321aad", "object_relation": "sha256", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853257, "uuid": "4875f768-98d0-419b-ac91-914e26ab048d", "comment": "Malware payload", "value": "29fa97ecfd828911de495118b6e02ece40924dbf", "object_relation": "sha1", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853257, "uuid": "b56c6052-501e-4cfc-ac08-195fb981f024", "comment": "Malware payload", "value": "32cc60730c850574d629c8b0e2b430a890e54cb1f079ffdb486d8913d77689cb5759665a2fc30604ae2edc43ae155519", "object_relation": "sha3-384", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853257, "uuid": "656ebbe5-2954-49ce-be74-af8074ce6c09", "value": "T1D6119B341204861F62B2A7BBAA04A504FCA2547B73EE1BD0B56CCC6C6BF2068474E572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853257, "uuid": "d8408268-47f5-482e-9c40-ba3bbb67a9cf", "value": "24:xvGn5JzM+0whuff/hoQ6H+WpOKAQa9hNISh+1Fbo4hhcn:pGnYwy+QPwAQa9Aksz7cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853257, "uuid": "faee68f8-9850-45ad-84c5-c62a33a0801b", "value": 993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853257, "uuid": "6b630b45-a492-4d84-a174-0a048617d6a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853257, "uuid": "9604f79c-1f33-4b12-9b2c-2adbe6152734", "value": "INSTALransomware.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60716d2d-c7be-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763828092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828092, "uuid": "d80ce6ad-3d4d-4576-9e61-c757e200e3f7", "comment": "Malware payload (Mirai)", "value": "bb7901d48eaa1a0c4b92d923576b10b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828092, "uuid": "8d62a060-a450-4421-98b5-a13808182e48", "comment": "Malware payload (Mirai)", "value": "3253d7555439a048f10a4072d4f0de847b01f6750871e996db7bf82f9f2116aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828092, "uuid": "67149985-0ab9-4749-8e02-02a433f6faf6", "comment": "Malware payload (Mirai)", "value": "3ec2a8674ac4686ec8bfcf96456d4401c9fffa11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828092, "uuid": "4f491c2c-0e76-42c8-ac7a-5bd073bda7ae", "comment": "Malware payload (Mirai)", "value": "15bc2e040ec2313cb24220e08bd4da215797462d61c965a9770353de1cf6b0c95667262c3d2fe323003e72bff1933ad5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828092, "uuid": "f3ffd8db-d9a4-4699-8266-21449edb74f3", "value": "T195145C2BB3C36CEAD11063319C312362771FCB051958EBFBDA1B3794A597B225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828092, "uuid": "397d3d62-35b4-4238-a81b-ea4ac2893659", "value": "3072:N5pOm5150ogAmr7LoSv8ld4bmp0iUJLlMkZJIVvUh3lUjXX7IKZ5tS:N5pOm5150ogAmrT60LM4IAOjn7IKTtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763828092, "uuid": "9d43f36c-dd40-4894-bc01-755b9892d2b9", "value": 197448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763828092, "uuid": "9000a06f-fe4e-47f8-9a04-07afc87fe566", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828092, "uuid": "c65adb6a-2e91-4ceb-b65b-84beef107ab2", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8b5f8d-c7de-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763841772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841772, "uuid": "edcc0d78-279d-417f-b86a-63686faab952", "comment": "Malware payload", "value": "5d5174158a71925184ea667acf1de25f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841772, "uuid": "73ff4ef7-9907-4eba-9e66-d7916ed14706", "comment": "Malware payload", "value": "3256836c9f7cac124ff021679e7b2947b1633793c85c4251bae4b67b23081ee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841772, "uuid": "f02a094d-8d85-4e96-98ad-0897990c4a2e", "comment": "Malware payload", "value": "33005e7132968034e5a0d90c69cbefb00a4d0dc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841772, "uuid": "43c07bb7-b5cd-4da4-b58c-38e0fbdbcad9", "comment": "Malware payload", "value": "7eac2a100baed8f7231eec92ec71e2369969cc4008d720e0f76a8e8b24a537e7c85e3ee47cbbe25194865cac8688f0ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841772, "uuid": "4e0d9e7b-4381-41c2-ab1e-19477014a759", "value": "T1CDB3C70F7E228F6DF765C6384BBB4D35939C63D212D1C646D27CE5201E6024E682FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841772, "uuid": "315f8216-0df8-4c9b-b53e-2f798f0af323", "value": "3072:FWtl8HTVRWD7A/yqW7eP7pDnY1o/Sqavv5jsemYM:FdH5Ra9qW7eDxnnqq2hmYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763841772, "uuid": "a0fde22d-53d3-413a-8f16-d68b318efe37", "value": 114032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763841772, "uuid": "ef401b61-576e-446b-9673-0ec11b2708ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841772, "uuid": "f120edd7-13d0-472b-a747-4bd8297b9fab", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47654be-c757-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763784048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784048, "uuid": "94f7c260-ebe3-4e6d-b0e7-42ef32e3b5d3", "comment": "Malware payload (Mirai)", "value": "4272ad86903f1dc8ac23117fc746251a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784048, "uuid": "bdac0b53-2c7b-416e-96ab-1153e200ad70", "comment": "Malware payload (Mirai)", "value": "326db71747a340e3a15e7944de6ece050a4aeb1ed876a143a47434483d596b16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784048, "uuid": "05bbe93e-af44-4acc-be4e-02569c41bf9d", "comment": "Malware payload (Mirai)", "value": "e86e886fc2a46fcc668e64d3344982a529c8c2bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784048, "uuid": "c43cf799-6679-4a70-9c57-ee476ab1aa54", "comment": "Malware payload (Mirai)", "value": "70a68489bab6449315eba38434bcafb4492735d372560aa77ac6a5469f4bf38608deedd880aad25559662c2634f48801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784048, "uuid": "37607da9-133c-4ff8-b811-5848d36c8120", "value": "T17D146A12FB0C0463CA931CF04E3F4BFAA3621A9104F59111650C7F5A6A76D77A68BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784048, "uuid": "63d19a64-6f6f-4ee2-9fd7-134bedd91a59", "value": "3072:OIGTeu8Vt2EFUs/K2/umS/rPKWuB/ExgmVCFs990AI8SsnOx6Uag:ja8DK2W5zJuB/OAISAznk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763784048, "uuid": "612a35b7-d87a-4828-81a4-126c27cfa400", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763784048, "uuid": "9e370af5-52dd-49dd-81a5-c516788d938a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784048, "uuid": "8f02c4c2-1550-4a09-ad3f-e5495dc19c58", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675ab017-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855591, "uuid": "91f3cdfe-cd6a-4caf-98c9-9f132488dfb6", "comment": "Malware payload", "value": "00dac2a767edac928f50b4882b05d91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855591, "uuid": "576dc0fd-f460-41fc-8f5c-4459264b2d46", "comment": "Malware payload", "value": "32efbd73f31140f0644eef37aec518197b5a5abffb8bbe3b41df544917028f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855591, "uuid": "68b1617b-1ff7-440c-b973-514779fe30f7", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855591, "uuid": "a17e5fa6-5a86-4f6e-ad47-b97e0fd8cae5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855591, "uuid": "a65388bc-3254-4874-9974-16444c185ab3", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855591, "uuid": "d935541b-c06b-46ea-9f84-b89e6906c1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855591, "uuid": "4a97fbf2-2422-4db9-afae-5e018a1a9b43", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68277245-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855593, "uuid": "b0e765b7-2c29-46ff-ac34-2565a87969cf", "comment": "Malware payload", "value": "e0cc0137a1a031a8c936c7d6e8d5f44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855593, "uuid": "ebb3e263-dab0-41e2-bd56-9cee38047fc5", "comment": "Malware payload", "value": "330f503fd5c7cfe9bdade90f7a63498db62ade8af40ca5fec98790c99692c368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855593, "uuid": "032f735c-93da-4494-b8c1-061c1685845b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855593, "uuid": "f8068628-6830-408b-a575-56bc653f1c89", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855593, "uuid": "510edc7e-52d2-4775-abe9-b70a1a3e7ea4", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855593, "uuid": "9509afcb-9fc3-418a-8ad1-87717e1413e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855593, "uuid": "0d2f12ad-f6b9-4747-8c8f-496d970d4af3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa65064d-c7c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763830927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763830927, "uuid": "acac50f7-40f7-4917-80b6-64f056c6c324", "comment": "Malware payload (Mirai)", "value": "e47e30dc15042b5e06039ffd5be61533", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763830927, "uuid": "d38bb5b1-73e7-4de9-a841-dda7293ccd76", "comment": "Malware payload (Mirai)", "value": "332c9afa08430dfff162d5a0feefa0ed0374a4678a0f0d866320e67be88fd34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763830927, "uuid": "9189fed7-cded-4ca5-8f2f-b6f36e4a2358", "comment": "Malware payload (Mirai)", "value": "1a9e295c8e122b3d370eb7e351b04e6944e42523", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763830927, "uuid": "85609d28-d2c4-4446-af52-37095512a931", "comment": "Malware payload (Mirai)", "value": "f17700ddbfba29db9971b94bb55f570e5da8a8affd421178557f995720f6ef6f31dbf05a937f07bd890cb4638952ffac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763830927, "uuid": "f8f643ac-7f38-4b92-9bf9-2c78305bf2c2", "value": "T1FFC3122E8F36C29DDBB177B1A30F2DDAFA9545DFB890891F0E3E8D443644039A859E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763830927, "uuid": "4ca021bc-3c46-45e1-a884-826667b27a3d", "value": "3072:iW0JF/WaUbuuIr4tX6OnZ6DYbY+BOl3UXYWjVR:iW0JCIrQcD1ccUVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763830927, "uuid": "d3c55177-25c9-47c8-b9ee-b6f65ffd5d41", "value": 122420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763830927, "uuid": "41fb47f0-9ffc-4b6f-bea5-a8c6f4375f21", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763830927, "uuid": "0cb1ec2c-4273-45f6-9107-2fda5378d0a2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f14e93-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855594, "uuid": "fb7fdef0-fcf5-42ff-aecf-a05ec2cc38f9", "comment": "Malware payload", "value": "a82ef7fc869756b7fc6b4233377d855b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855594, "uuid": "b1b78789-ca6f-4902-93ad-2adc9eac41b3", "comment": "Malware payload", "value": "33419c9c28788202fba1f0a206e4da04374d00bb16b4568724edb2ee35e2d28b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855594, "uuid": "8ff768cd-c2bf-43ea-aaca-98b0ba0a1871", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855594, "uuid": "912ac9ec-71e5-4824-9a7f-79eb4ed9f63e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855594, "uuid": "a00fa71f-88ab-42fa-8243-de166b83c37d", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855594, "uuid": "42b43839-43de-4f77-bedb-a2a7c05d5be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855594, "uuid": "e0a9e763-136d-4bff-9640-6c65d5a455e9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e18c1f-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855596, "uuid": "8b8bd636-4daa-4869-a7a5-3862c5e48eaf", "comment": "Malware payload", "value": "a9ab5ba21764397d5a70be2382fb8d93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855596, "uuid": "cf76e225-9900-4512-8d21-f612abbb1660", "comment": "Malware payload", "value": "3387109aee74642840f8073bf8bca4079a2eaed84d1a5064777a485a72deab12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855596, "uuid": "33ee6ca3-5f4b-47a2-87cd-ec2b40074e05", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855596, "uuid": "5901960b-aacd-40e8-a6fb-657f8b8bc828", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855596, "uuid": "6944ca6e-a41a-41ae-bd37-64a98cb62797", "value": 1951232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855596, "uuid": "7a80357d-09f5-4093-ab50-7541cb98f08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855596, "uuid": "717e1750-1dd0-4a37-bbad-c3305ac62d39", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab8d737-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855597, "uuid": "bab54c2e-a64e-4717-9dcc-9bd90906ce26", "comment": "Malware payload", "value": "24b27ca61ce54b202da605a86efeaef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855597, "uuid": "97405137-8a62-45f4-9ee8-c02d0f490b80", "comment": "Malware payload", "value": "33974a73a5f424ad7b85cb91081aeff9faea4ef1fd86c72b2e005d5d8e1692b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855597, "uuid": "a630bab0-b59f-48fb-8144-ad63f56d9766", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855597, "uuid": "51d5facc-e031-4131-8323-d7ce7277e7b3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855597, "uuid": "220b17cd-0b7b-4f77-9887-7c57315dd12e", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855597, "uuid": "1a5af092-2ec4-4b93-b3ff-519299ba3da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855597, "uuid": "1f5b68f0-aaf2-42c0-a5e5-b2888d826a1f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8b5549-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855598, "uuid": "22147282-77dd-4657-9c7c-5fef4ba484a3", "comment": "Malware payload", "value": "8d9f1acd9411e17db8c0019168f1bec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855598, "uuid": "a645ad65-4fb9-4214-8c5f-e9368864d600", "comment": "Malware payload", "value": "33a890796e86017fcc73f2dcbe316b466f205c636deef94d9eed47db77032ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855598, "uuid": "5b7015af-ccda-477d-982c-151181d470c7", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855598, "uuid": "626cb4cf-ff20-471b-8d73-ed85389432e4", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855598, "uuid": "41b20df5-8040-457c-a977-9d4c23544d5e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855598, "uuid": "704cfe32-0910-4677-b86a-8dae4acf26de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855598, "uuid": "75f04abc-c985-448e-8a79-8144569f2fcf", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c50a655-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855600, "uuid": "88128288-8abf-417e-9e54-48e9ad1cbc4b", "comment": "Malware payload", "value": "edcd27946292c9b5f38e27ee11ae1cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855600, "uuid": "08ec5028-16f0-401b-88e9-a82c0ad26a1d", "comment": "Malware payload", "value": "3414522f84e45aef572ef085bd13fe3d492621635b875981c2fee50ef9741575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855600, "uuid": "1d9b8ce5-c5ef-429a-a92d-4046489c06a3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855600, "uuid": "ea1f2420-2207-4273-bcea-fd6f9a439111", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855600, "uuid": "ddcf5dfa-dbc5-4774-a08e-0ef72410dec3", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855600, "uuid": "c9d6045d-487b-4c97-b538-b5214f19ed2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855600, "uuid": "1fdd41e7-e45e-4044-a8cb-0af381b4abd5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d123844-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855601, "uuid": "c2469d7f-4d50-4be3-b20c-fac1d54daf76", "comment": "Malware payload", "value": "0a244045c63760c52a9c9207fc20b7ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855601, "uuid": "7fa659ea-bc9a-4d5e-aac6-fdf2645b37de", "comment": "Malware payload", "value": "34513d6b0091c3430845277156d8e32bdb247aa1b2f830625c8c2e1d01846b9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855601, "uuid": "c087cf56-381a-435c-bb5c-ec7b4ca30656", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855601, "uuid": "8f404463-351e-42bd-b783-4ad04b24bbc9", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855601, "uuid": "86b35936-45be-4142-82d6-5cf61a96d4a5", "value": 1638412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855601, "uuid": "f2dd4e5e-1913-4d4c-a857-6e830fb4caeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855601, "uuid": "2a119610-6fa0-4385-a331-ca2c0094aa7a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6debda9e-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855602, "uuid": "6f93a5fc-04b3-4673-b958-73838b6e2c49", "comment": "Malware payload", "value": "6f5061388a1fd16290b6ab40f3fe2bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855602, "uuid": "77c91b44-e3bd-4f09-b438-31aa9af6330e", "comment": "Malware payload", "value": "347e2be3fbb67ff42014a4dda3b6c75101868e27027d9753f9486cfae28864c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855602, "uuid": "22e73a3b-61b2-4ba7-932f-adaa3b9151cf", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855602, "uuid": "74e59083-c414-4448-ad73-09158eb24d55", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855602, "uuid": "2e69ba00-935e-4fe9-8810-27aec1044724", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855602, "uuid": "9270003e-86ee-4b10-86f2-69d4ba366844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855602, "uuid": "03baa88e-4737-49f2-8f12-8bea7c8d4236", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9a0e08-c7b7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763825056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825056, "uuid": "fcfdf655-4b22-48e4-84dd-d5716867c79d", "comment": "Malware payload (SalatStealer)", "value": "589a49ce0d22097c6ee35911c6aaa3c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825056, "uuid": "f8d96a39-bf21-4acf-90de-a6a26c9c5942", "comment": "Malware payload (SalatStealer)", "value": "34cd5d9c95ea6c445998aa9ce2edb7beee66d73a4f3e3f58900d09f8c0040c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825056, "uuid": "2179866c-eeae-43e0-95be-22211220641d", "comment": "Malware payload (SalatStealer)", "value": "497c65cfc90fbda1faba57742f1e5008cfbe9130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825056, "uuid": "a177dc4f-0c7f-4ce5-8a2e-b35e62c9b80c", "comment": "Malware payload (SalatStealer)", "value": "7d2eaf06eb8f70d99cc8b3b9311c9be040a2125cea49642abaf792bc3379f9601314859a922e6e1f939b9e3da751b345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825056, "uuid": "ea55cc2c-2d11-414c-9a27-631662f014d2", "value": "T14CE5331D9C8116C2E4321AF48E82E57D2DD46293B4A3F227D4A07EB25ED76BCAFB0154", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825056, "uuid": "7bab6515-9676-41e5-ac8c-6636d4563b55", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825056, "uuid": "f4c4cadc-f037-4705-97d9-c5d739ce7921", "value": "98304:EHeIpGJlvjBrm4tMizrskGqxKWA5xPMlra:KeK80dcsk7xKXxPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763825056, "uuid": "f1b90891-8264-4950-b5d7-c7e17cc10c09", "value": 3291136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763825056, "uuid": "8be21bc5-4d46-4c16-8c65-d25e0f03ded1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825056, "uuid": "5af5075a-4754-49f0-85a9-b187557acc6f", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eaefd2a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855604, "uuid": "cb1e1e5b-4141-4070-a616-1e82f17392ac", "comment": "Malware payload", "value": "9885acaec667fd73c7c8eb6d5201a448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855604, "uuid": "7520394f-c101-4575-a851-3040f831b6d9", "comment": "Malware payload", "value": "34d8889f9a165ab125b3e1b3d93f596e4eeccc5d0d1aa9998058facac3847e47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855604, "uuid": "8d7ef99d-aa8b-4406-a58d-c5ae91bd28d1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855604, "uuid": "ce7e7afa-9fc4-4148-ab75-0aec2cb817fa", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855604, "uuid": "33134544-5166-4259-9d20-f3809a5886e7", "value": 1762304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855604, "uuid": "0f7eadac-494b-479a-a6be-959a3fa76f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855604, "uuid": "171594fa-89f6-4495-8c37-d6d11f67c064", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6a5984-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855605, "uuid": "45eee2c7-5f3e-402e-adc0-1c6163a9c3f4", "comment": "Malware payload", "value": "07c015675fd114c2a89210c89126a6b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855605, "uuid": "5afbbb89-cd2a-452b-b000-de1fa3574caf", "comment": "Malware payload", "value": "34e2fe576f94a748842dc5ca6bcb2b30bc73f5bfc7b080c54582033b6c388cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855605, "uuid": "661eecff-3a68-4529-adad-6df0131c8803", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855605, "uuid": "c816b7f7-a084-4d24-96b4-0d51a37e25cc", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855605, "uuid": "6ec6752f-7d79-4796-af8b-a93ad6f05d09", "value": 532492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855605, "uuid": "080416a8-f7db-4c37-908b-a44290132818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855605, "uuid": "489051a5-2d01-4bc6-8d9c-56d9067cfc30", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b15ffe6-c7eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763847410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847410, "uuid": "7adcfbf1-6de8-4926-9bda-4707318fa2a3", "comment": "Malware payload (Mirai)", "value": "933ea798fd147fdf88173c6523cc6d1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847410, "uuid": "4a44f2fb-841a-43c8-91d2-64421ee6f5f2", "comment": "Malware payload (Mirai)", "value": "34f632e684ac5b928e7596a10a3ac1bbf5cd7804170d73b1cddc82d3a3959b57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847410, "uuid": "c70bf25b-6daa-429e-b5f7-c5cbaa36ee6c", "comment": "Malware payload (Mirai)", "value": "bcd346d571c492a866dfb531c1665455197da176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847410, "uuid": "3f8b9e4b-6e06-4fc5-a413-64da8e336e7a", "comment": "Malware payload (Mirai)", "value": "4689b0574b2ebf19aa6319409c488cce16ece71575b30e0561f7c742f6a4155eb67874a77875f7960af4ffb316a7d64d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847410, "uuid": "21906ebb-eb5e-44e3-b7e2-b6d6db62f8b7", "value": "T11C73F1ADD2506BCAC2CD567401A96B7B6588F1C1B0EA731A12904C84BE0F36E7ECD4BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847410, "uuid": "5be6426b-0feb-4880-99c9-1e96fcc44777", "value": "1536:HLbiq6CsiswYORfGsCsBL0r878Bl4hzFJ9IoBamydot/ZB88aPUQR1r:J6li6xjsJyWVSWamYqZG3T5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763847410, "uuid": "2aedde61-dae4-4590-989e-b7ea36d840ad", "value": 73680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763847410, "uuid": "fa3a3a36-7be8-44f5-b64e-30946fba1767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847410, "uuid": "0c053662-859f-40b6-a753-b1e1d3b9afb0", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca28ea9a-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855328, "uuid": "6b814904-3c70-4470-a601-67b7ae425a10", "comment": "Malware payload (Mirai)", "value": "61db1d9fbe1c53d82742b1dd385bfbec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855328, "uuid": "1ffe2087-fdd3-4eee-9570-367233e2cca4", "comment": "Malware payload (Mirai)", "value": "34fffa52a79f72cac239a6ac0b859abebafb04b86eb063cf8a8ee0c11407d3c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855328, "uuid": "bdf527a4-84bb-4164-833a-074c78227f67", "comment": "Malware payload (Mirai)", "value": "9ec6d280aba739fc17eac179ea5b998be27bca84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855328, "uuid": "065bb5cf-fe40-46e1-b457-0ef9937ef690", "comment": "Malware payload (Mirai)", "value": "605665e5c0ceb3e99738ec7b156c5e9261fb7dd6f581557d56b92a56ffa952cd1b6adb002483b83884a68edb311e5ad2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855328, "uuid": "856c2634-69aa-4181-8efa-f74979658543", "value": "T15E03F14C1AADC750DE2A71760CEDCADE961810DBA1096CFCEEECF06B4D89979931C193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855328, "uuid": "f9199a7a-f253-4e55-a4bb-1417abf1097e", "value": "768:Wvt792kzPRB8mftKiDsxpeNThOormhw5j74ZvonbcuyD7UtQRjI:Wv7nvftKCNtNj76onouy8ty8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855328, "uuid": "4a93d995-b434-44e7-8d97-3c39a0a1a42b", "value": 40300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855328, "uuid": "22f299ec-e477-4cba-b668-29c2c99384b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855328, "uuid": "6bcb512d-9138-47fc-8db1-2cc016d451b9", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d569fab6-c761-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763788345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788345, "uuid": "30d50c15-6456-4238-a8b2-c8352d6b8927", "comment": "Malware payload (Mirai)", "value": "0dce95a687c1034069fba881447c6ed2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788345, "uuid": "f57bb444-da05-42d9-bdec-3bde16978bba", "comment": "Malware payload (Mirai)", "value": "35088515ba116a711346d0afe02cbf5f2b052e1b240bab08f2bc5218dc6fb4a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788345, "uuid": "54cb762f-0709-4f22-96f0-ca4803a02aa9", "comment": "Malware payload (Mirai)", "value": "cf6e3c1d29f90d69862212d48a44e31476b11887", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788345, "uuid": "1a289f1c-f067-491a-8604-fa8a17e06f8e", "comment": "Malware payload (Mirai)", "value": "2e593f9bcd4e02d7bb7f7713b655e336fc69f26e659f72e57f45705e9c5e45315da47861cfb915e563f3766d2e91f728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788345, "uuid": "72213d9e-460c-46c6-96c5-b8962b06506e", "value": "T1FB146C2BB3C3ACD6D11063315C302362776FCB051958EBFBDE1B3794A997B225A24687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788345, "uuid": "b4a48054-7e33-47dc-b7c1-6c9eba6d84e1", "value": "3072:pldOm515IWGAm1hze1uVx0HEbCDrSrJY1ddaC7Ev7bLnuG2XX7IKZ5tx:pldOm515IWGAm1IdrbdV7MV2n7IKTtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763788345, "uuid": "19fdfd9a-58bb-4418-9e3e-a036efa15e27", "value": 197448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763788345, "uuid": "46efcc5b-497c-4ad0-a7f5-0cabd0fd6b74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788345, "uuid": "479291ae-3022-4332-bb42-4231a51b8247", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da606f96-c7e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763845047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845047, "uuid": "633b0f99-59bb-4b84-ae67-48f420fd9407", "comment": "Malware payload (Mirai)", "value": "4e74772c6d9f56e5f2da41132f52de80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845047, "uuid": "e6579654-15f1-4cc5-b5ee-62d20343a18c", "comment": "Malware payload (Mirai)", "value": "351d581c037e9bf2fedd0e8284c8c17cc7efe8011be0ba0fb3ea427c078af116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845047, "uuid": "9c500032-14a4-4ac6-9b22-70a81d3b8539", "comment": "Malware payload (Mirai)", "value": "bffb09dffb6e65d74d3f3e5e9027ca7d066d17af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845047, "uuid": "f7f6bd1a-3a31-498e-8ff8-e84b99d7d2d1", "comment": "Malware payload (Mirai)", "value": "1ff41fe5fd2ddb9a0ebc8733aaa46e854c2e41e765dc6bdf848c8f2251d2e0ecb51cccf893ab9ae0bf4738bc171eecae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845047, "uuid": "117e7ed7-4b6f-4b69-ba89-b7a32a9ec72f", "value": "T186145C16BAC090FEC9A5C1789BFFB036D831B0AD527C715A27D4AE222E4DE604B3D745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845047, "uuid": "dadd640e-0518-474d-a6be-2dbff0711fe0", "value": "3072:nR4ontieD60F1d7+R69/+RGAhkbGNs9V1ZYryK4MaKU:nR4otD/5gfAAhe9Zsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763845047, "uuid": "74e34ef4-5501-47af-95b4-78927d60d3a1", "value": 201144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763845047, "uuid": "1ba79599-293b-47ff-96e2-808b8f28840c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845047, "uuid": "404b95f3-92a4-43d9-a9c6-53322c58345b", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70285259-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855606, "uuid": "0996dd07-f25f-4a38-ad77-c5f7a0090633", "comment": "Malware payload", "value": "02d6d1225d71622427d7dfa6d52849b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855606, "uuid": "bbbbf3b9-1baa-4a16-b9cc-44e8ed68e456", "comment": "Malware payload", "value": "359ec84c659b3fd4e86aadb0f3a725ff2686311a077e0af7f63a32768c83501a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855606, "uuid": "02bef33c-100b-480f-b54b-36fc51ebdb25", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855606, "uuid": "1ae8470c-fa9c-405b-a6b8-fc2a8e032766", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855606, "uuid": "31e485c6-b0d8-4c7d-b13a-a40be0651eb6", "value": 761868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855606, "uuid": "016e0d25-45ff-43f9-9153-50e015b4a0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855606, "uuid": "59383668-6e12-47fa-bf3a-b3b91fb41f4a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3727c7d0-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852933, "uuid": "5ee67a45-9743-4786-866d-f49e6d7dbdac", "comment": "Malware payload", "value": "e611be5e53f19200dcf5fde6946566e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852933, "uuid": "e0a0ca57-1323-467c-a6f8-08986f6295d3", "comment": "Malware payload", "value": "35be0a7628fbf5401730c01b0aaa1c0033e6993349b02135a1fbcb7adb7d5250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852933, "uuid": "b58e1706-1185-408b-bc78-0eeb97760977", "comment": "Malware payload", "value": "c5c8ab22d3ae0eacf58fd5ef493075246d10972b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852933, "uuid": "1e09f96f-2e89-49f3-91eb-2aa786aeba2b", "comment": "Malware payload", "value": "f546eb738a4ecef88123a1d4f8d89c18ffccff51e12fe667ea792fcb9b34ce2bed8a3b116d8e0e4030689b405ef0fe64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852933, "uuid": "c75e7268-463c-467b-9c47-dec17e16588d", "value": "T12476BE06BF948F83C5DF2BB210751685F771E507C366A7CB5104A2F8ACB23C44D5AAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852933, "uuid": "5c45ec38-bc5c-48e5-b7f0-715987d4bd92", "value": "98304:VZWe84UEDhtxdu14rMTQektKgUOX32yn1lr8KuL:zWoUIvdfeOUg35r8K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852933, "uuid": "2d6334b8-efda-492e-aafd-7747f58987d7", "value": 7154024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852933, "uuid": "39679955-f09b-4a52-a6d4-8bc115b876a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852933, "uuid": "916237ca-9ede-4e42-b0e1-9d142d8ee2f9", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f8fdf7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855607, "uuid": "c37b3692-bbef-48f0-9a1e-abfa08424c40", "comment": "Malware payload", "value": "f41c8701f5a1bf72d1014a68e3a0f2f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855607, "uuid": "3ebd64d2-57b4-4e74-a415-bfcbea111532", "comment": "Malware payload", "value": "35d4fc1f63d83531a84f646f618cb10bb069fabd648f48826282506ef5ad308a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855607, "uuid": "8c9be095-aebd-4bec-a4e4-fd20a1884229", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855607, "uuid": "0dcfb3d1-4c7d-4de5-b860-b5a4028722ad", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855607, "uuid": "34b34c0e-70b8-49f7-bbc4-98fbc10c5fbd", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855607, "uuid": "51da2bb8-793e-467a-b5c4-53da6999f322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855607, "uuid": "87f215f4-7c7b-4fbf-9189-24a9a97fea24", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e74144-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855609, "uuid": "220d5d3c-276d-4ed8-af1b-fd2da99b2b38", "comment": "Malware payload", "value": "d0edc564ca37f750bbc8c5a0ee31b3d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855609, "uuid": "39bf7026-5439-4cf7-9092-88004bf72c38", "comment": "Malware payload", "value": "35d5b45c5d48a0676e2ac9a6b84bf078457db97529fed4a0216ca981b9b1078b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855609, "uuid": "6e225164-abee-4c16-b8c8-0480185c43d0", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855609, "uuid": "db39dee9-ea74-4ed9-b259-c9670d0f3ece", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855609, "uuid": "e3ae5ec2-d40a-4263-b400-5cb60556a7c2", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855609, "uuid": "f79aea9c-4c0c-455f-a907-b8f223a9de0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855609, "uuid": "7ec530f6-ce4c-4270-a3bc-ded5e9d8f827", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c9330a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855610, "uuid": "671bb92f-1212-47b4-97e6-c33a71197b45", "comment": "Malware payload", "value": "fa5f8b6b78dcbc06713740c2420c9efe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855610, "uuid": "381c350d-2632-4e5a-9f50-3cf4ff0951bd", "comment": "Malware payload", "value": "35ebd260624419050dee839d86b2cfcab62bbb3cb3413d4edc604b2ceb1cfdac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855610, "uuid": "1ec71c60-2021-4465-aa5b-9eb09a65fe0f", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855610, "uuid": "33c2bfd5-b89d-4f98-84de-f3c727242857", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855610, "uuid": "239627ab-8138-4276-8068-c66cc24fa9da", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855610, "uuid": "61818f63-c2b0-4498-885e-5cc4390fcea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855610, "uuid": "b6219ef4-b571-4387-a329-ed077ba23fe7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739675d2-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855612, "uuid": "23057d8e-cbd5-40a3-9cc1-f23af4e50c69", "comment": "Malware payload", "value": "3434f3020d0890034a279e7da7c8b876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855612, "uuid": "f5ca47de-a95d-47a1-8447-241ae49f1691", "comment": "Malware payload", "value": "364e340bc8908b6391009d55df89ccf46ad76bd22fb41d62f64090e09b050c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855612, "uuid": "61e4d665-b4c2-42bd-9f5f-dc9c29057a7a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855612, "uuid": "2d85f746-f630-466f-8f18-a2a3b2618d91", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855612, "uuid": "f3c4b8ed-6fb2-4461-9652-ff6d06ed3ee5", "value": 3280896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855612, "uuid": "0cfef863-d7b9-4776-8f3b-29b4db0f6e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855612, "uuid": "a87d01f5-d486-4872-8df9-cf7bee73864e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745d3565-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855613, "uuid": "4a871143-95f4-4623-9533-46d8cda1f10f", "comment": "Malware payload", "value": "7790fcc6ee9a18d06dccc9bd0bd65007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855613, "uuid": "ee344d09-3095-4ec1-9760-ea1915f50b11", "comment": "Malware payload", "value": "36910810fe766b0e6f44f6f2be5bdeef4a0b247e58f797631a2f2e2fd4405e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855613, "uuid": "ba22d88d-f41c-41e9-b39d-e36dfd0278f8", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855613, "uuid": "9ca69d88-10b2-430d-968b-dfe027e596e1", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855613, "uuid": "959b1952-b72e-47df-b94a-dc1023d066d8", "value": 3293184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855613, "uuid": "c81a9a1f-407a-46dd-b081-98edd9877137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855613, "uuid": "a671ad70-a587-4577-baa7-d247eca0d2ab", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3e798a-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853692, "uuid": "ceb1d44d-31f0-45f4-b422-75d4c90076c3", "comment": "Malware payload", "value": "ef7b11685c154e54deaf5c26f6d8ea59", "object_relation": "md5", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853692, "uuid": "5bd6266c-9b82-4df9-b252-33f616d013c2", "comment": "Malware payload", "value": "36e33398e4e687de267c4ba9387b14cc570a83397c2a0a2933b30a22f6ad9fd1", "object_relation": "sha256", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853692, "uuid": "30bebca3-57de-461a-bf7e-a943d9027fb8", "comment": "Malware payload", "value": "0f6db883af7e164d59eccc931ba68cf112792cc3", "object_relation": "sha1", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853692, "uuid": "2844d3ed-77a6-42af-8dbd-5e9fa2cae280", "comment": "Malware payload", "value": "11d763267f943e80f43005cdd3b3b73522b10074a8c8445506c9bc8b61f5584ff91560515c5852ec863a3f507159ec4e", "object_relation": "sha3-384", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853692, "uuid": "c74d6856-1003-472e-9600-99892a831583", "value": "T14132BCA1569A68CA0115F41BDC087E0D7CAB84BE3FAE536229643D6F36F2124C66D70A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853692, "uuid": "4c3d32af-70b0-4676-b8c9-c93354b42fb8", "value": "192:UdO5DtpU/VovISKVeZex3NTOT8MXBWF/GuexaIihlS:UU5TrvIlVeZexFOT88BEen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853692, "uuid": "c7095a07-b0ca-4d07-ad72-9ab06945957c", "value": 11518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853692, "uuid": "59e68b71-c25b-40d7-affd-f12f669d644f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853692, "uuid": "e169a3e8-7938-49d4-92ce-524102245fad", "value": "meow.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7536c930-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855615, "uuid": "c492fa3e-134f-4ed8-ae50-37598f8c8403", "comment": "Malware payload", "value": "61f9be4e1beec5bc3db972a07d3eec7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855615, "uuid": "ba7b7ead-7d7d-4e51-b893-451de66c394f", "comment": "Malware payload", "value": "36f206464a5e8f6f8a7d56c18c2be277b44fd3cdfb784136734af8b933dac841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855615, "uuid": "aee63014-cd45-4afa-b85c-bf40c125ea03", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855615, "uuid": "3dca7c0a-68c2-47ba-bffd-38f96f1f562a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855615, "uuid": "e6cda915-fd86-4661-b646-243b41617813", "value": 3301388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855615, "uuid": "de03c796-3a32-4b19-826d-4b5b80b50187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855615, "uuid": "442b4b63-8c01-4830-b3fe-e15bbd9f1f2f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7616f3e4-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855616, "uuid": "04bca0df-e2cd-4fa1-ba1f-fdceaf74a37a", "comment": "Malware payload", "value": "b8a39805634f5f0eb288491dc8f64644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855616, "uuid": "0d0e5132-f4dd-48f1-9b09-d6b7a8708ba4", "comment": "Malware payload", "value": "37023359fa2c02e9e1fc3a6c10aac4bb1ae729286f1dfeb60937051aa2055ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855616, "uuid": "2b8f5194-e5a0-48e2-a368-5fc2424e04f1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855616, "uuid": "a84f4286-4be0-42e9-8073-affc4ef4d312", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855616, "uuid": "8bf5eea5-8fe2-485f-a8fd-8b52000b1d8d", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855616, "uuid": "dcc82577-aa55-4d98-9889-0d37e2748284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855616, "uuid": "0ea45a45-f91a-4943-80aa-4a4601b3ef5f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e3f25c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855617, "uuid": "863a115b-8143-4448-870e-341cf194abcd", "comment": "Malware payload", "value": "d065a267982897310174ac163947366e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855617, "uuid": "60028231-233b-422f-a382-4d30d430870e", "comment": "Malware payload", "value": "378f2dffd7af706af361d64310b7b8fd60b00bd8358baf82d9367678483be352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855617, "uuid": "d76c1fa5-be17-4a39-b4ec-b8e9c50a12c5", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855617, "uuid": "82307427-4a63-408e-b886-09d79258c314", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855617, "uuid": "1e315dd0-7d74-4015-87f4-d469e510e60f", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855617, "uuid": "6b46adcf-99d1-4cef-b2d8-4ee1ec0dc3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855617, "uuid": "4d55450a-4c27-4935-8743-7a502109d2d5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f38ded-c76e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763793908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763793908, "uuid": "c0ae7716-6024-43d2-abff-fc561698929b", "comment": "Malware payload (Mirai)", "value": "3d07981599226b778db0602dcd3eebb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763793908, "uuid": "8bfa8695-b630-47f4-b0b4-ed642578827b", "comment": "Malware payload (Mirai)", "value": "378ff7abf0f5a98c2becb21ff58e7c0ea06643d797906b4f0b0b91353247e2d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763793908, "uuid": "8133304d-8927-4d25-8249-6f5163113a00", "comment": "Malware payload (Mirai)", "value": "d3138f7777d32d2f974f0c4b37a0aaf65d0f3e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763793908, "uuid": "b3a9d374-50f2-4fa1-baf7-b995a000c6d7", "comment": "Malware payload (Mirai)", "value": "9eca1668e937e66332b3f4f9cf1ab2440d8aa62253e5bc31d6eb46c38b0424a39ae0efd691a03ad7ddf147b0c2cbd3d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763793908, "uuid": "e79da33d-4e3e-4b3f-ab83-c5bb7bcca7e1", "value": "T11EB34B26F9919B21D5C056BAFE1E418D331307B8D3EF72125D20AF25638BA6B0F3E506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763793908, "uuid": "f0f2a52c-942c-45c9-bcc4-e3657953c640", "value": "1536:TJnteKdaZNTrUMSSAc8AgUHhUJ5bdKFatkIgh5d1i++9FLoy7HdY5ljgCemvs:3Hda/UDccJ1dKFat2+9FLoyDdmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763793908, "uuid": "a545d4aa-7247-4a4c-84bd-b97205fa8da0", "value": 107732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763793908, "uuid": "bc5e0818-02f3-4034-a394-fd6f996ddf75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763793908, "uuid": "825d7a1c-dc24-4291-ad9d-50c5b42eee42", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c211a1-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855619, "uuid": "8bb8cca5-0683-43b8-aea4-d4656f4ffcf5", "comment": "Malware payload", "value": "f2e41a888520af3d8c3a2b4cf0b955f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855619, "uuid": "8103e5c5-4f22-45b2-b738-9858282cf44a", "comment": "Malware payload", "value": "37a0dd551ea2039b55bb6b8f6e43482c5c6d5ad29b248a2004b428297669d920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855619, "uuid": "9cd8b2af-6259-41bc-8bdc-5d0255e13cb2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855619, "uuid": "28c2f576-849b-4049-b749-74814070919a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855619, "uuid": "3de0e943-edbc-45bc-925a-ec4ddecfeef9", "value": 3293196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855619, "uuid": "ad089d98-0970-458f-8b9d-942ae70ac3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855619, "uuid": "27aaaaa3-89b3-46fd-bfc9-7a2569fedb41", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788526ac-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855620, "uuid": "557d450a-9317-437d-a202-edd4c683c61c", "comment": "Malware payload", "value": "347f5d2328d579934cbb6370e1e03ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855620, "uuid": "f9a64e11-feea-480d-bb81-0fff21d2eb02", "comment": "Malware payload", "value": "37d082de533c90257c445fa9b3abd00074240c9bd5306860066441c72ef32418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855620, "uuid": "330b9065-e015-4bae-94a9-f3cd4b71e8b4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855620, "uuid": "0039801b-c115-4a7f-bb16-554577e7b909", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855620, "uuid": "576f0093-6c15-49ce-afd8-0f9dab8e36ae", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855620, "uuid": "95d0534a-750a-4cd6-b5b2-11b0fc8f3748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855620, "uuid": "39dde5ac-ac88-40f6-a23b-5a5d5e8e4fa3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794870a2-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855621, "uuid": "137fccf0-57ea-4d8f-ac50-ec5ac32ab6c3", "comment": "Malware payload", "value": "78c511dc52571c441ddc938c8f968129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855621, "uuid": "c956b736-90ff-4ae2-a071-12ddb519d266", "comment": "Malware payload", "value": "37ddabac442ecd9500cd6814e97a9964993cf2e10a87e43fc0a8155fd2d61171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855621, "uuid": "10070d87-ea45-4f9f-9536-12412faa418a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855621, "uuid": "488ef81a-5d3c-42e2-84a7-f8b9decc637f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855621, "uuid": "0d2707a7-b217-4246-9dba-340a670914f5", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855621, "uuid": "63d95b3d-6b44-4c41-a716-bf282ca4bdae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855621, "uuid": "6b18010b-cabb-4c7e-91a8-21dd6e008d22", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797743ff-c776-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763797210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763797210, "uuid": "2cfdf8ad-2049-4423-8a21-4fed14360b59", "comment": "Malware payload (Mirai)", "value": "0f3173a44135ab6d469723a0dc609782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763797210, "uuid": "e17a7d0e-2eda-4dde-a6ef-b4cbdf087578", "comment": "Malware payload (Mirai)", "value": "37eb76dc244280e4576543afe675f53f4aee62171d89f4e97d7dc47bc0eff3ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763797210, "uuid": "bd9f785b-f3b7-4d60-86ea-54045d3aa26d", "comment": "Malware payload (Mirai)", "value": "4801cc1de5069d8eadf8c4b89c61063650af26c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763797210, "uuid": "9cdc19cd-4b21-4554-bad1-80f70210f654", "comment": "Malware payload (Mirai)", "value": "a7e76239a4ec580fde92245f3c45ae73fcaec7a7d7e3d63aaaf6df575c69a735f229062b40f573af9c04dcc0e7186d58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763797210, "uuid": "07b3da17-ef81-4713-b3c4-d6a20d8c5756", "value": "T10BC3F809BF614EFBE86FCD3746EA074520CC695A22B83B7A7574D52CF14E24B06D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763797210, "uuid": "a94ba76b-5b2e-4fa8-8d87-a02b2b0a184e", "value": "3072:2xD94ws23zpOC2vsFMu/+VuufcjRAUyEt:ci+3zwC2vsFMuWVrfceYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763797210, "uuid": "22c02382-75cf-495a-a260-f6c53aeb188d", "value": 123676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763797210, "uuid": "dc2bfaf9-a398-4fdd-b48d-e89c3b0ca163", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763797210, "uuid": "4b9d08e4-4cfd-4231-bf35-573860e9f540", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3dd798-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855623, "uuid": "07aad690-84c6-42a2-bb8c-b2e3d659d0fb", "comment": "Malware payload", "value": "fe9ce0fdc3319d058e2b3c71f6cbc428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855623, "uuid": "4e62a443-e49b-44d2-a537-45630e6bbc3f", "comment": "Malware payload", "value": "381d6574d81fbda02cf619ba6eb06b9cee33badf8983d13b85bdc96691862efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855623, "uuid": "8d67ce14-a5cb-46c2-81ce-4eed53c4aea2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855623, "uuid": "0ba9adc0-85be-462d-87d9-6013c5600213", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855623, "uuid": "a5049e85-b8a0-45a8-b4a6-e45b45fdf0ef", "value": 8363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855623, "uuid": "6a1905ce-b2ee-4455-90d1-0c833b370c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855623, "uuid": "202f73c1-d6f0-4e41-a4aa-e210e9b2fbeb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0d3328-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855624, "uuid": "b02d2e39-a686-4dc0-8123-80e969e61572", "comment": "Malware payload", "value": "0b736e0c6e11c284fb36842f1056fe91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855624, "uuid": "4a797fe4-cb5f-40ca-b6c1-676bbf97f83e", "comment": "Malware payload", "value": "382afdacdfc162d510cd5f578fa0df68bb2a92f3fe7519567370120eb542ad75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855624, "uuid": "93a728ee-5a00-45b8-8be2-4a04d796b9ed", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855624, "uuid": "25e8db70-90f1-4178-99bc-881bf1341a34", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855624, "uuid": "079be51a-84db-437e-ac65-bc99be4cb88f", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855624, "uuid": "bb83110c-8ca2-4a5a-a2a9-15af43788e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855624, "uuid": "0d786b2a-226e-4906-8c48-003637ae5af6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd7fe37-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855626, "uuid": "080ea1de-3774-4cce-91c1-bf33410b6312", "comment": "Malware payload", "value": "c4b0ceaf463bf4b5319374b3d909b988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855626, "uuid": "2079a053-b10e-4d2f-94b1-313791515955", "comment": "Malware payload", "value": "3833d9338737a9f1851650b7de66e14cecd8eb6bb36bdbf3b502e7342a21f6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855626, "uuid": "a6c7f6f8-caa5-4101-ae25-e990e63ac3b9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855626, "uuid": "160aff4b-f798-4312-9b22-dda44bc4b1d2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855626, "uuid": "2d11bf3f-d59c-49d7-8d1d-ad4d830bd7e7", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855626, "uuid": "b7af567d-daba-47c2-a837-4be8ad38d5bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855626, "uuid": "d1ec1b30-951f-4a5c-a3ff-2d33991e16d2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbd035a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855627, "uuid": "d9c7807c-7de5-4433-82c8-f569a6c8f367", "comment": "Malware payload", "value": "6e4daa295e77db108c8e908cf8cfa227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855627, "uuid": "487cee67-ba5d-48c4-bc5a-2a1fa4a7b046", "comment": "Malware payload", "value": "3851a60d03c86cc9ee338c36d881dbcf61b3d0bef4bf1f4ff776ee6a939519af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855627, "uuid": "32c9bac0-461b-4ba1-ba34-c024230c2a56", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855627, "uuid": "cf6d1787-a0b5-466a-a0c2-979005f9bffc", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855627, "uuid": "d319f1f5-44c1-4e18-87a5-a1ce4f1d42cb", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855627, "uuid": "5c13dc8f-dcf3-4666-96ea-2554a25364bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855627, "uuid": "8aba113a-ef10-4640-84eb-3603a086d522", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da60e53-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855629, "uuid": "a54da8d5-67ac-4fb7-bb6b-9363f2073274", "comment": "Malware payload", "value": "faa3bc82121a8994b00ca2c8cbef74af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855629, "uuid": "5586f7ec-3586-4b46-b374-79fa0f99b2f0", "comment": "Malware payload", "value": "38c5cfa18e72e48cc0fcdc8f627a3ef4ed10b042213b18fc0e82ca53bed2f62c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855629, "uuid": "40e9df5c-c091-45c9-9b70-6addbae14db3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855629, "uuid": "b555017e-0110-4963-b39d-812041086fbb", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855629, "uuid": "c2f7c7e5-d754-411f-8413-678fd687cd19", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855629, "uuid": "b40a1f80-abd6-4750-a903-e3bf50c62c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855629, "uuid": "4abf6772-3099-45e7-9fd3-1f457b50abff", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e799585-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855630, "uuid": "a5e0ca37-1a60-48d5-af55-1db174dc26ad", "comment": "Malware payload", "value": "f50bb1d2f5798fe19062aff489c02d91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855630, "uuid": "7b288f9a-210d-45f5-9891-cf4a9de08f6d", "comment": "Malware payload", "value": "38ce53ced0f6b711453d07d76a4cd9f8fffabb627353b44a9e60f362a8aad819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855630, "uuid": "d37b6b7a-4595-4f08-af98-7fcb40a70716", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855630, "uuid": "6b1515f1-83d5-4b39-8f77-82a15df1a961", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855630, "uuid": "dbef100b-7ade-4402-9f50-7b887f5918f6", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855630, "uuid": "7d82a020-ab3d-4edf-88f5-f1adc74d1908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855630, "uuid": "fd82799c-dccc-4a91-a163-6d228f7c56b7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c39b3f7-c7ea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763846929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763846929, "uuid": "0d5701c2-450e-4177-9c68-dbd36a87e449", "comment": "Malware payload (Mirai)", "value": "b73f227139bf133a2f7201e706dfed8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763846929, "uuid": "26cd2acf-164d-46b5-844b-0bb43dd0aa4d", "comment": "Malware payload (Mirai)", "value": "38dd1b3d0520b670d6e0b899a25ab5fbf9839a3fa74fd0d0d3f5773625f2a1be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763846929, "uuid": "d85c86cd-aacc-422c-9463-e0a5d4bddb07", "comment": "Malware payload (Mirai)", "value": "eee96a15937b89906b44862f898675c7657997ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763846929, "uuid": "2231879e-6b31-4153-bb85-7767514076af", "comment": "Malware payload (Mirai)", "value": "ef9ff096cf72f8411218f3485bae5ca8fc7efbf36ab60f4063c9d962b5a1397f44702b01eef246af26d20a3e7682a0a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763846929, "uuid": "8945eaf8-3fc4-4912-a212-e7e582a50681", "value": "T1BBE2F1E09685D0F2C230863D9B6D41835B7747BA7289307F251C4FACCBDA316D7B66A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763846929, "uuid": "7427625d-f0ca-4bd8-abd7-eb3211b6eef1", "value": "768:bJIRBv+swLTHbdyJ2EEkJ1M07l21s3UozK:KRBGvs3j7l24zK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763846929, "uuid": "043ab714-a24e-44d8-8f9c-ba959cd7887e", "value": 31424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763846929, "uuid": "55ad631d-5550-47e8-8e9e-96ba1c0a656a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763846929, "uuid": "b6781f6d-1a59-4c70-988c-68a737dc3559", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0b5f09-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829405, "uuid": "cac640e3-fa68-4ec3-a5c9-2ea93250bdd9", "comment": "Malware payload (Mirai)", "value": "b63a273e684a33e15daea979ac367396", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829405, "uuid": "11ead4ba-0516-4c1b-ae7d-48e884fdaa7f", "comment": "Malware payload (Mirai)", "value": "3913c5e5e2c0324d51da1c172928b0d32e8dbbecae4f180b4f0ab643afcbd389", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829405, "uuid": "92dac64d-4aa2-4d45-b34d-4f357e5368fc", "comment": "Malware payload (Mirai)", "value": "9e69956514d31537049846ef3ef493c5c3088cbe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829405, "uuid": "bc47038f-4367-4916-99c8-87643ca3ca8c", "comment": "Malware payload (Mirai)", "value": "4c68f6cc6a3bc8295153d86947e0b81cc5e457020ee98c229c202bf8cb276d3c53a608b888befbea56b44ef94e5465f1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829405, "uuid": "195fb8de-2f2b-4bbb-a537-452b87c83c53", "value": "T1B0516F8910D24A7EBE979A5372B9DF043981E0DA25C66F4EECDE34B5684CF153500FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829405, "uuid": "6b49a299-ac38-4b67-ad25-115d85154fbc", "value": "48:i7gA7dm7KM7Ve7jC73S70aa0aX3KL7snA7nIL7IuJ7dO7R67G872Y71bh:i7gA7dm7KM7Ve7jC73S7010E3KL7snAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829405, "uuid": "0d58dbbe-9647-4b85-a6cb-16fe080fed11", "value": 2954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829405, "uuid": "f15a00e9-d952-4449-b312-8e8b8bc4b5c6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829405, "uuid": "9173372a-0208-4aae-86bd-82912af9c129", "value": "qkuys.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6ede36-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855632, "uuid": "5b36b608-cc8c-4b3c-845a-cf059005bf37", "comment": "Malware payload", "value": "05fcd31c1bcc86449ca5bbbcf08a2042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855632, "uuid": "3f6d301e-0e08-4315-bdf6-d9c9c9635af3", "comment": "Malware payload", "value": "3921d1dfcb478f251693422dc19ccda36de82bb1e4cad37f66a87471aa796811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855632, "uuid": "e8a2e16d-7157-40e5-9ba3-2703a7e0012a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855632, "uuid": "a041d0b8-1f66-4633-9980-ab5f0fe81e21", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855632, "uuid": "c7dcd57d-bc35-4b87-abf2-b83f24eff3d6", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855632, "uuid": "24dee1b9-978d-465c-8f27-1d992969dad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855632, "uuid": "7459fae8-2c35-48e8-8de3-51f63274e44f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803c7d50-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855633, "uuid": "c155775c-6dab-481d-9c65-909563c04de7", "comment": "Malware payload", "value": "18d38b352b101442cf5976ab2f793791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855633, "uuid": "9f62b7da-ea62-4f58-8065-ae3be6bab972", "comment": "Malware payload", "value": "39912e4907ebe3987b01dc30e3754ee253855a0db09e293979180f96d50dbd22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855633, "uuid": "7399a0be-28a4-40eb-af21-2805c4d795bf", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855633, "uuid": "994e7ac5-49f8-4173-9ca7-e09345c0ade4", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855633, "uuid": "96f57384-8491-4c12-a2af-131364a276a1", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855633, "uuid": "7f838093-bdeb-41dc-9dfa-40f0a3a83dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855633, "uuid": "de77fbf3-9b4d-4e52-9133-eacdf185729a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fe8fc0-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855634, "uuid": "d1213fb2-5aa2-47dd-8b57-69957809d2a4", "comment": "Malware payload", "value": "a22c877d7b28714a5b3e6cb3a3149fc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855634, "uuid": "ce05f053-60dd-4103-ad20-78fbd12d8ae0", "comment": "Malware payload", "value": "39d9d007292ecc941d6e8232b0c0680fd444b60026c1549464c42be61d4b9d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855634, "uuid": "464060ec-82b1-4195-8b43-94350b510e4d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855634, "uuid": "c4479759-0682-4953-bb2e-1ca82d161040", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855634, "uuid": "5290efac-c139-490c-852e-42ece3b14383", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855634, "uuid": "e680e3bc-987e-4f08-942e-f7d082e0d25d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855634, "uuid": "9d5379a0-971d-43cc-97eb-79938647a05d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3b8d46-c7e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763845538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845538, "uuid": "cbe6eb82-879e-4b7b-ac02-40971360965b", "comment": "Malware payload (Mirai)", "value": "4034d586f6129947e628dae5ff3667f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845538, "uuid": "bfcef149-7a46-4617-8f78-e27ce310928c", "comment": "Malware payload (Mirai)", "value": "39febd3acd5a442051432174ea512aaa2c1757ce2e2b55a7c96a7abe7d55eac5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845538, "uuid": "18a7c8a7-fcba-40ac-9bba-93d570fad2de", "comment": "Malware payload (Mirai)", "value": "02cd83983078d2db914d30daf7e30e728d842e70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845538, "uuid": "4f8e620b-68db-4280-98f7-8d5dfc785d37", "comment": "Malware payload (Mirai)", "value": "5109ff31b94c353580c163c8ad185330ea93a474d4f5e92ea9fe72e7b6264fa539be3b05645240ebab6e9d0c3d4f55bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845538, "uuid": "04cabe84-7cdd-4887-9f66-483588345c34", "value": "T170F32A49E9929F15D4C722FAFB6E514933136BB8E3EB3102DD10AF6463C658A0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845538, "uuid": "91299ee6-0db8-4286-aab0-d1f86a2db8c6", "value": "3072:3Zy3Cdn99Wuu3aY31wK2Qs264GoLWo16V7+pdHj:3Zy3s9ML3aY31wK2h2koqo16V7+bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763845538, "uuid": "f8372f30-e714-454b-aaba-9b2becfc7516", "value": 165676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763845538, "uuid": "4707df58-47c1-4e54-9725-b433cafafebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845538, "uuid": "c71f0ca3-7863-4115-aa64-89996850c700", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d221c7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855636, "uuid": "0bf84e7c-1ec2-4aac-818e-38fa6ff54085", "comment": "Malware payload", "value": "9cb734cee89e14c03fed6b60c17204d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855636, "uuid": "6974beb7-55f0-4579-a120-cf34bbfd51d5", "comment": "Malware payload", "value": "3a2cb12e5c0be223c8d02f366f0ff16c318bf8a14b1eab86adee4897b182fa3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855636, "uuid": "c318b893-a277-4f9d-998b-193f4221c999", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855636, "uuid": "ac85376d-1e4f-4e35-8b8a-ebd489558330", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855636, "uuid": "0a817cc8-15fa-479c-947c-0a9248b877fa", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855636, "uuid": "e8c7e09f-ba5f-455d-9ffc-28b662b9e091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855636, "uuid": "bcde9fd9-8cd3-4cdb-a2b2-e68a9f751188", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d88264-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829413, "uuid": "b2a8cd73-f68d-4c82-8182-aad561af6ca0", "comment": "Malware payload (Mirai)", "value": "50d72acb4954ed6302ab40d4eb73bf12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829413, "uuid": "4034f720-c213-4762-be2d-e5341957eeef", "comment": "Malware payload (Mirai)", "value": "3ab21df5266014a5d499a423818b1ecce0ed014d99cb2670e582b2449a1d9789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829413, "uuid": "42a5e852-000e-43be-a798-5b6c60760a0d", "comment": "Malware payload (Mirai)", "value": "db6aee7f7e8049ae11e1d354ba66c08787d9c604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829413, "uuid": "6b7523b7-988c-472a-ae42-923d04cc4cd4", "comment": "Malware payload (Mirai)", "value": "0ffa8e269e3c864dc4f01ccb13c0c1b5c3b326c06c97d6c2d880f960843d68b9bb29ad13c7761bb3544ea6acdf6e92e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829413, "uuid": "747898b3-801f-4369-bd43-397641aec4a5", "value": "T1B3E38D22D964AEA8C62495B0F0A1EF795B539E9642831FFB1AA7C7714043DCCFD053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829413, "uuid": "06319d99-1ba7-408a-bd63-585120e81eb4", "value": "3072:Xnee0PIub31zhBXWrPwjQ97IBUNjDir0ZWf01Oqr:Op3tXWrPwjQ97jViwEf/qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829413, "uuid": "3280d516-7854-439d-83b3-18544d404726", "value": 150308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829413, "uuid": "2d306465-f142-40c7-a29c-68cb8224cb62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829413, "uuid": "ad5abfb7-a191-4b72-84c0-0cc3bc581f23", "value": "Polar.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a46e7b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855637, "uuid": "27abb78d-a0c1-4acb-8967-f0b73e631085", "comment": "Malware payload", "value": "906a077b6eec32655a4504a7df8443e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855637, "uuid": "ba4884c3-c1c9-4e4f-a9ed-11a73ec465da", "comment": "Malware payload", "value": "3ae71335bb85630935f1b0b484ede1a905542cd291439e29f9832e45f8a55320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855637, "uuid": "81b202ff-143e-4405-988e-db4ca698500d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855637, "uuid": "51c243c7-89a3-44e2-86a4-5f1779d9f678", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855637, "uuid": "391b0874-3d62-4acb-b3fb-747cf9c2bd8c", "value": 1873920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855637, "uuid": "4c26ee0f-f29d-4840-8577-e52b1f883ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855637, "uuid": "8cbeacf6-0845-479a-a193-64a30240cae6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83734565-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855638, "uuid": "4999e447-07f4-4882-ad9f-e83c592820fd", "comment": "Malware payload", "value": "ddb6706794897b65e5abd8cdbcacde73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855638, "uuid": "90f31412-1b82-467e-b3c0-f13181dadc88", "comment": "Malware payload", "value": "3b7f76e81bba48288e37a76ff9f001b22a90a5133a8e441dbc94dd309b8651d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855638, "uuid": "835b5a93-05e3-4b2a-8a2d-69ecb501ea55", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855638, "uuid": "db5747cd-e5c4-4b04-9e4e-7723e7a306c5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855638, "uuid": "8184bb62-ab33-44ac-8021-64432290bb7f", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855638, "uuid": "a16be843-c443-46ce-b2bf-76b9f419fac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855638, "uuid": "e813e7d8-af07-46d9-a587-bca9b509fe9b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7740f7c4-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829419, "uuid": "2d6afa88-fdef-4068-b839-b99dc1cb8483", "comment": "Malware payload (Mirai)", "value": "9ba0e76a6ef9cfb6bacd0b6135e682be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829419, "uuid": "48627247-aee6-47ff-bd38-060508ef0c8d", "comment": "Malware payload (Mirai)", "value": "3bbb478c8b9d843bfac8b3e30c1a8995c8083c9bec566afb0a8cc83f0152a855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829419, "uuid": "7962080b-8d18-4355-b925-3719af3f3ee6", "comment": "Malware payload (Mirai)", "value": "dbe2cb6069406d5dc08b0e40fdf101469502df40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829419, "uuid": "14aa1fd1-c077-4f89-ab1d-1502a413e9d2", "comment": "Malware payload (Mirai)", "value": "77c35c64fa3307254ea518c7fc2983ccaa830d1f7f3867d2864c51f0d2e509b620c20ccf31ffc405ed2ae84322f9c592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829419, "uuid": "08118331-bd68-47c2-b01c-0046ba46c9c1", "value": "T1D80429CBF800DDBEF80AE77A4C530909B130B7B254925A337257796BED3A1A44527F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829419, "uuid": "bd33fa4d-747c-4de4-9847-9c6a902d5162", "value": "3072:NMoXwVQ2Y3PMh3OVKJIO5IytODNXZpYqwGpN69RpcPVKjbiuLWH5zB8l:NMo22PMBiyt8NXZ3wpbpcMLWHT8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829419, "uuid": "09091abe-3de0-4825-8e0d-7e34f31dfab0", "value": 184736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829419, "uuid": "1fdd9369-51fd-435b-aaca-260933d3cc84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829419, "uuid": "e363feab-1a4f-4bdc-ba80-9c0aa011cc76", "value": "Polar.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8439fdc7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855640, "uuid": "2ca860d0-3a46-4905-857e-f9916620a721", "comment": "Malware payload", "value": "aeee2084e56562da13428924cd5f8f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855640, "uuid": "a811cc84-cd0e-4acd-ad34-8eeda3067efc", "comment": "Malware payload", "value": "3c31db433ba7ee81d8c25764e810025dee0b19b1c76d1a9ae59a6e858d7bdc66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855640, "uuid": "6d3ea527-2c94-4459-9b82-41e7cf263011", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855640, "uuid": "64aeea83-2a77-4a15-8847-87b7926a9bec", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855640, "uuid": "be45f66d-cb70-443f-a74c-5f52a7d6c61c", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855640, "uuid": "a1de0c50-510e-4723-a7f7-3b55f0d6fdf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855640, "uuid": "a194444b-d28f-45d0-b3ae-247c98e331ae", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f5d726-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855641, "uuid": "6179564a-7b1a-4d63-a9dd-66478d6c66f7", "comment": "Malware payload", "value": "48de33adfc768d0771cbce2e8ffc4352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855641, "uuid": "a56e95ec-ac98-4971-8a0b-58139f34dc40", "comment": "Malware payload", "value": "3c36199f3ef466a270b479f0599781fc76d196a6f2eb7a153e1e2d86bc61607d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855641, "uuid": "3b2f984b-0536-4156-9f46-52af3c6362b1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855641, "uuid": "046fa477-6ae8-40fe-82a2-99a14e948a88", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855641, "uuid": "55cc6c9a-8d28-4b21-9b94-fe65f4163ca5", "value": 311308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855641, "uuid": "aa6863b0-4b62-44a9-954f-be9cee8e7c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855641, "uuid": "3f76b9de-3b11-4899-8e69-5324718a760b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d44550-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855642, "uuid": "48fe680f-935a-4525-b169-21713ea46f0c", "comment": "Malware payload", "value": "a80a9ef25cc8a761a229c08ee98290af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855642, "uuid": "74177953-3a6d-4cc3-9987-4c26718e5eed", "comment": "Malware payload", "value": "3c7e8c0a4a67134f6af1061dae7a40f5dd0028d688da6ee3da71093a978382b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855642, "uuid": "37a7cde2-94a2-4c77-9342-0e3b5674e0d0", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855642, "uuid": "85f3331c-46ed-45d5-8200-6706a1108c39", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855642, "uuid": "fed0aaf2-5957-4998-bab7-4919cdf53106", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855642, "uuid": "91cf977c-0550-4320-8211-5a6199a8dcdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855642, "uuid": "dd695c6e-cf0e-4637-960b-a8fae148e3fe", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387ee6c3-c7de-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763841769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841769, "uuid": "efe0318a-92ea-4968-8ebf-d0c1005ab216", "comment": "Malware payload", "value": "25769909fdeed8aa894ddadd92c0ee7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841769, "uuid": "09479ca2-9862-499e-bd16-ca2c289a6b3a", "comment": "Malware payload", "value": "3c819078a12972e4ecfae0362c13747a0cbea67603271497eaef71d17a6592a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841769, "uuid": "0263971b-ce0c-47c1-b277-05a33ea72bb8", "comment": "Malware payload", "value": "0b7ad65498b125ca41f8758271790fe91c0447bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841769, "uuid": "04930e9a-4bee-4a5d-b043-ad20c9349aa7", "comment": "Malware payload", "value": "6f2381b7c0f25492dbd5608c7f6dbe8e4b9d9bc851fa056325a3fb85f083dfe8449a9beb1164b8c18dc43eedb15d34dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841769, "uuid": "5d49b4f6-f314-4967-8af8-2abb9eeb13c7", "value": "T14CB3180ABB500EFBFCAFCD3706E81B56258C645613A92B367274E818F95B14B0AD3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841769, "uuid": "4e888345-530d-4c19-b368-2e2a2b0bc6df", "value": "1536:rz7bm/+8pUoQnV/Gi0iH01pHfV+9SqzqJHDsRpcckP4woAnrdyh7O2a9lK4jZjmp:rz7keoQV/NH0XJKqE8rdtjzusSZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763841769, "uuid": "c37b76b8-93d3-4269-b39f-2e3ba6b068b9", "value": 117648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763841769, "uuid": "02c8cd9a-08fb-4f6e-b77b-7356710be027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841769, "uuid": "69afd126-0d53-4ea4-9eaf-06d9545f0385", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aaaf48e-c7b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763825827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825827, "uuid": "0ed8594b-cd96-41bb-9a59-2be542634676", "comment": "Malware payload (Vidar)", "value": "ace5d17432658b0ef9732465ce7afc12", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825827, "uuid": "0fbdb607-0de3-41e5-8376-92a47efd9c45", "comment": "Malware payload (Vidar)", "value": "3caf6c520e0c865304534f72abf9a0184609792d6553c77e48218194d5bfc341", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825827, "uuid": "e693e967-96a4-4f83-9c49-ce4b7ca6af4c", "comment": "Malware payload (Vidar)", "value": "0f75499082955766e96b48db5b3370d7e76b73bc", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825827, "uuid": "fd0832df-692d-4fed-be4b-185619f8b677", "comment": "Malware payload (Vidar)", "value": "0408b5715f508009a0eddc0073858198c99e6481a2c4f1cb2258bf1d821c992379bcc606eb0a3d7ee23b81876bded382", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825827, "uuid": "732d8190-f85f-4575-98c2-da5c4630ef75", "value": "T1A8957E877CE014BAD866A7328DB215C27675F8190B3623C33A68B3783FB6BC15935764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825827, "uuid": "07ff0bf6-7d72-4c48-b38f-babe5473f295", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825827, "uuid": "ff495df7-8108-4867-99aa-15004861cff2", "value": "24576:7z+fiQC0v7N3SFIwf9ns9LtW9WCA+0TGEzbk5g:7z+6D08Nf9ns9LtW9iF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763825827, "uuid": "116a732f-79a4-4b15-8ed6-04449ce96572", "value": 1994752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763825827, "uuid": "7408036b-561c-4ff9-bbe0-d5cf8b69a02a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825827, "uuid": "78134e94-527a-4962-ad44-6ba997a80783", "value": "download autodesk fusion 360 full crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e2d90a-c7bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763827297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827297, "uuid": "199b42b4-623a-414b-8821-64e7901881fe", "comment": "Malware payload (Mirai)", "value": "2a0e16059c022f2be02f2a40d4f5a095", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827297, "uuid": "5ae222fc-5be4-4010-abcd-ed7dff3b552b", "comment": "Malware payload (Mirai)", "value": "3cd665d15d360ba78855df769cd183de96f4d86c443cd9f5bbcc1770721df058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827297, "uuid": "e8cb7b79-8cd4-4055-9032-034183f7caab", "comment": "Malware payload (Mirai)", "value": "7f0c003abaa7a455aadf7ee3a50fff1727ffdfb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827297, "uuid": "45853515-0256-489c-9856-69e9767e16f2", "comment": "Malware payload (Mirai)", "value": "d8cb0c1afaee4f5f9ddfd9592e70953ceaad99a8e76cd5ed6732ee35f2c4a08aa09f058325dbb9da43e49d1992ca778e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827297, "uuid": "42d8d70f-4908-43ee-8a4a-ca89a78ca258", "value": "T187143B0B7B218FA1C368D6700AF3CB6796E6259616E19985E66DDD107F3035C2C3FEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827297, "uuid": "1c124b0f-6a09-497e-978d-1bcc48ecbb4f", "value": "3072:0+sE+U2a6HS/cUHT2IeXIiWcUyU7VeL3/jzTZO/nxxpGlmHz08jfaWP:0+s6cUHNynWlyU7VeL3LQ/DpGwht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763827297, "uuid": "7ff06570-3304-43de-8489-178236d00ce4", "value": 198792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763827297, "uuid": "7cc44e33-94cb-4c31-814d-f187999216e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827297, "uuid": "28fedb10-81d0-4b10-93cd-538884a1a052", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ac1497-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855644, "uuid": "98a2c5cd-3e55-4bb2-8839-48172164af01", "comment": "Malware payload", "value": "21a709d6d6060d246daf2fb49459e0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855644, "uuid": "3023d1ac-c0ba-4b39-b91e-c38c0572d2bd", "comment": "Malware payload", "value": "3d512d12f00dfabc2fe81e93a791fe1d50361f8ee392f8c630c3fc017da87f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855644, "uuid": "06cbcf34-c7f2-41f8-8c20-ce28a3642317", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855644, "uuid": "a4db5f1a-f67d-4cc7-9ce2-1bc02dc7c246", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855644, "uuid": "82bfa9da-746e-4ce7-b987-9dd084235bea", "value": 3265024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855644, "uuid": "5ae5b01e-7d76-47b3-b597-69e4c5235a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855644, "uuid": "22be275e-2fc8-4c41-973e-f04641a6db0c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8770cc33-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855645, "uuid": "b509a326-ee84-4f73-9ece-38978418da44", "comment": "Malware payload", "value": "9be41169e2cd8d5b33519672b154c064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855645, "uuid": "390a3deb-5794-4c90-b84b-d680c6b49b9f", "comment": "Malware payload", "value": "3de0146efae2059a8e1ee3b1301e2cfb862f50304ea2b33a26a7b85f7f8f68e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855645, "uuid": "e3083166-0ced-4438-a3e4-8480401eaec2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855645, "uuid": "2fd8502b-1965-4252-83e8-e98653941e4e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855645, "uuid": "ec9cbd14-3156-4b15-bffd-7ba0437fe804", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855645, "uuid": "e1c588e7-953e-4d25-9eed-c7f46fcca7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855645, "uuid": "43b583d6-807b-4e19-befe-510a80b14a1d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfbd921-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855384, "uuid": "3d90e7e6-97dc-43b8-9338-8e96f7d57f14", "comment": "Malware payload (Mirai)", "value": "01aa06bb85b968df80fa2c61cdb32ea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855384, "uuid": "8105b754-b51c-4d24-9971-deb65055ded7", "comment": "Malware payload (Mirai)", "value": "3e40743f7f7a4108ddbcea21b053a0493483e7aa54feeb597f247105eee0b99d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855384, "uuid": "28e5ae22-c19d-413b-b742-fbcbec286c4f", "comment": "Malware payload (Mirai)", "value": "e627d7d2e2d65f00ba6c5646fa51c8240e3cad21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855384, "uuid": "1bb1786e-3c01-40f4-b941-a6558aa7c7da", "comment": "Malware payload (Mirai)", "value": "10eb897b43fa056185135dd80c89e077cc63e1eaf463b43af8ca3520713b12fd6c9a6b71d4963cc8c37f23402c68e766", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855384, "uuid": "90bc7527-673e-4973-850b-a4dbdee1e446", "value": "T189736CC2AB47C4F4EC2605716077E7328773E13E1029EE43D769AD36ED52A41A62A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855384, "uuid": "91c66bfe-0c9a-4d83-be99-4f742aa4babb", "value": "1536:XbwcQ0p+cLBZFMKzdIpmQ3Pk798U755e1j+w:40VZ6KzdgmQ387O0Pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855384, "uuid": "de081c5f-6ab7-4a49-a731-d561952664f7", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855384, "uuid": "8f56a100-9bf0-4828-a2e9-016114d40863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855384, "uuid": "4cf6f5f2-e472-4c18-aefe-597cb5e4c9ee", "value": "Labelloperc80.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f69d22b-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852920, "uuid": "0f9d9ba4-9137-4334-8993-3bf467c8de27", "comment": "Malware payload", "value": "d05f44bed6b86f01c4260166ef389ee6", "object_relation": "md5", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852920, "uuid": "ae925548-7d7c-4b2d-8091-48fbfd74b4e6", "comment": "Malware payload", "value": "3e44e23c5d1a3e4596367ec1ff72e2c3a78fa3673994e73a9c9b4a6da15fbd8f", "object_relation": "sha256", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852920, "uuid": "63f09cfc-1386-4518-aa0f-3325992b8702", "comment": "Malware payload", "value": "67a8e5cf417f0bae2aea26f2dee7d3407767f93c", "object_relation": "sha1", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852920, "uuid": "e05c6ddf-6275-4964-a4af-24b33e30e15f", "comment": "Malware payload", "value": "0e9b65b7d06fef1bb4bd36676110a3bd5074d9d61d7e0abb1115ad27ce7d222a356569dde59a5b0e04e33388f085d0ff", "object_relation": "sha3-384", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852920, "uuid": "da0950a6-180f-4e00-9a7a-3380fc8102a6", "value": "T166E15B6A7C8F8C7C117BC9F69A573785EBE46057468C2C1B390D1A942F3B08D28F59CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852920, "uuid": "e0d5c22d-d472-4cbf-a3da-2d3126031ff8", "value": "96:YGnPfPDFY2vL911Zw2H6YaeJURedU7fAmWgBuq8tV4b26i8Aq49L:tnHPHjgAJ9UR/haV4bti8Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852920, "uuid": "f31e67e7-3036-4ecc-b1f9-193ccc6629c6", "value": 6794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852920, "uuid": "b9a7650e-cc11-4442-81a0-8f6cc7aaa05a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852920, "uuid": "f0d0ee7f-68cf-4a91-9d71-b8fb9976b7cc", "value": "O.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883cb357-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855646, "uuid": "c50e4379-4876-4eef-9997-d30a0d0d55c3", "comment": "Malware payload", "value": "5b4b7dc5fa395da4c2dac854281295d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855646, "uuid": "7da6d0e3-c937-4229-8c20-93e3bc7cda8c", "comment": "Malware payload", "value": "3e5ecba11fe4a2d58c2fe0f880cb06ae2e094d88b30e12403abc9b85b021e500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855646, "uuid": "8be88cf5-401b-4b2d-a1f9-2396fe5ff5fb", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855646, "uuid": "448c1ca7-19b3-4c92-b78a-a4a4a44876c2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855646, "uuid": "4d6f478d-5f25-49a9-98ea-bd90efce4eb8", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855646, "uuid": "e7e3f425-7adf-4438-8b3e-e2f11fdb4d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855646, "uuid": "5e34b257-343d-49a7-91ff-a13a005baf5e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891dc88a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855648, "uuid": "10b2fec4-9352-4474-93e9-9ee0954e00d1", "comment": "Malware payload", "value": "e28a9af5b0c30f2ffbaa9b00e43e578a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855648, "uuid": "ba635127-5b77-477c-b6ed-7d66b29f0cbe", "comment": "Malware payload", "value": "3ee3e1dd82ab3543fb7fc228e49e55179d57ba6e5d255969068e2408b5d0ba45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855648, "uuid": "18fd56e4-d66e-42e3-9722-d73e7adaf2d6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855648, "uuid": "bd950f58-0cd3-4056-8b8c-2240b38b8c30", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855648, "uuid": "3c856aff-8a07-4be4-b340-2809e655ad0d", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855648, "uuid": "4453bed6-0cb8-421d-9384-a034dd3c1697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855648, "uuid": "77ef7efd-7e57-475c-9dcf-8ea43384a13e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f60cf8-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855649, "uuid": "6d43a881-08c7-467b-8898-e9b1f29fb5aa", "comment": "Malware payload", "value": "85fce716109d493563d1a8ad194cb339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855649, "uuid": "767c4b43-633a-4348-b24d-82764b9dc484", "comment": "Malware payload", "value": "3f0fc80a246bf521fe389a7abdb501de9e25bb831b23e656d545dc0ffb762165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855649, "uuid": "5975c408-d429-4efe-b177-b0c8ea16d8cb", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855649, "uuid": "42264acf-aabd-45bc-9f75-8582f077006d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855649, "uuid": "e0cbe4a8-16d8-4aa0-878c-a7626585db6e", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855649, "uuid": "1cb9f104-efae-4392-8305-fc754c115e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855649, "uuid": "77180101-0991-4212-89fc-15abc3164108", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fc4600-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829489, "uuid": "49f43c98-325b-4d3b-8dd4-9e2cf66d716b", "comment": "Malware payload (Mirai)", "value": "f654805ce1ad57cb05ba778ea5a78ff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829489, "uuid": "1309d152-839b-495c-a1b8-bc6439379f70", "comment": "Malware payload (Mirai)", "value": "3f241fc2cbf460f3d46a06f5ed8cb85ea00bee491c7379847c4c0699f932e397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829489, "uuid": "fa88d051-8265-4fa3-9b33-0c583fd14c46", "comment": "Malware payload (Mirai)", "value": "63c163ea76d629f8247230453f6b7fa2d99b13b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829489, "uuid": "ac2075dc-9872-4590-bdc3-be45c33b3ce6", "comment": "Malware payload (Mirai)", "value": "b50b2c12af4f542682b719dc35764a898b9fc95d5d76e8d9ebbc375a060d546a3d87be2cf3d0e517375191d0484a3b13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829489, "uuid": "cc7c682c-1564-4633-9c17-b2df52f8aaf8", "value": "T135040886F8C18B15D5D115BEFA1E514E33235BB8E2DE7202AD256B20778B8BB0F3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829489, "uuid": "ee08ad5d-de64-45dd-8348-b39f1f1d9f59", "value": "3072:58OWfQI451DbddIhQmjqGIyXKCtWaag733lX53qIQIqBnk5:ifQDJOlj+yXKCt5aqX3qBxBnk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829489, "uuid": "9c1635e5-4799-41e5-90a4-049a849dde4e", "value": 181500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829489, "uuid": "abeee9a4-4552-4419-8fd1-bd792f282962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829489, "uuid": "bce2b441-2a60-4cbd-aaa9-e39ac4f3d14a", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab670bb-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855651, "uuid": "e0ab923a-ba81-4e7f-b58c-ac7d97bc4520", "comment": "Malware payload", "value": "238561a064511de527206e7fdf34b272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855651, "uuid": "6156526b-1240-4212-80a6-c85c53cd2674", "comment": "Malware payload", "value": "3f540820b3e7a854666495e26ff7deeece414bd71c7788601fd352e5365e1d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855651, "uuid": "77adfbad-2026-45bb-bfb1-7910499a89b2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855651, "uuid": "d7b94b2b-d50b-481a-863d-61cabce748e7", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855651, "uuid": "02661c56-3838-4e0e-923c-7d447d143a1b", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855651, "uuid": "94307f62-cb32-44f7-9c59-1d12eb759bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855651, "uuid": "0724203e-4dd9-4211-87fe-6f743b13327e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0e78fd-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850772, "uuid": "273e9ec6-fd5a-416c-88ec-3605b4eeb3c4", "comment": "Malware payload (Gafgyt)", "value": "1b0f03339f5048810d04b4634d95f4c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850772, "uuid": "a16c5900-4dd1-46cb-81e2-d0643088b375", "comment": "Malware payload (Gafgyt)", "value": "3fce667e95b0a00e54c1cc8598c11ea0ea2fef1ce50ecc4c4740e9c20f65f963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850772, "uuid": "ac318093-d736-4a51-ad06-dd82ed79a59a", "comment": "Malware payload (Gafgyt)", "value": "7497af67e477799dd21fce46af9bba4de7e0d8cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850772, "uuid": "18d579cd-3beb-4d3f-a0fc-7166a75359b2", "comment": "Malware payload (Gafgyt)", "value": "85cb424111d63d6760101c62ab3f207e7165fd9f6fa0f18abb83850085da5892d8253b5d6431a196e171420782bfcf0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850772, "uuid": "f8dde82e-c8c6-44cc-835d-c18ab4758397", "value": "T101A33B03B71D0B43C85B59B029BB27F1CB5EB6E216E261C1A11DEED05773AB02522FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850772, "uuid": "81641b93-46fc-4ba6-b8d2-219d077b1f8e", "value": "1536:tM7o+jylSXL1r7AwewAW07+D0wh/f8id5h9dddddbVAXq6mYj10PZjgVf3Nj:tgAmssAW07+vj5h3Ka6mK10PZkVf3Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850772, "uuid": "7257ae87-3681-42d5-b200-2ff7dd58a12e", "value": 98046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850772, "uuid": "b6fe8b6b-abac-4e67-8085-7cf1457d3ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850772, "uuid": "fab16af4-9eba-48ee-971c-5f48d2dec44c", "value": "Ayedz.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8e7f81-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855652, "uuid": "249fac5c-8991-4fb5-9c4c-40c8f47a16fd", "comment": "Malware payload", "value": "9f7343e512585ae6ee4a087d3ad6ee92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855652, "uuid": "d3d09aae-ba50-4b33-a756-973f6e9eb030", "comment": "Malware payload", "value": "3fd87da2600760ec3c7cf4c24a9071062f5630b66013b60617b9f9f1d8e259ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855652, "uuid": "bd2c7ee7-5af2-41be-a6cd-765e36571fd6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855652, "uuid": "b69c949e-6620-4df3-b7af-9c33434a8088", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855652, "uuid": "ef37bb67-601f-436c-8e1c-4c1799284ed3", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855652, "uuid": "833529c4-6edd-4a8e-a608-3c775d7ac91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855652, "uuid": "e0ab3bb5-6264-4ef1-9c4d-db944de02949", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcc842a-c7b3-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763823605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823605, "uuid": "b8ad8bb4-45cc-4dc2-b95a-8d49269f4e95", "comment": "Malware payload (Stealc)", "value": "685cb4413f2d5fd574d47f1d8413bc75", "object_relation": "md5", "Tag": [ { "name": "149-102-156-62", "colour": "#07086A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823605, "uuid": "ae0469a1-c443-4085-a469-de0a9265f2ab", "comment": "Malware payload (Stealc)", "value": "3fdf56d8f290107873f8c70cb37e1bad10c6ee0cbe1b96c9a0057cd7e28b2669", "object_relation": "sha256", "Tag": [ { "name": "149-102-156-62", "colour": "#07086A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823605, "uuid": "b06cf77b-1567-4861-ad9a-4b6ebe5623bd", "comment": "Malware payload (Stealc)", "value": "0a883a1e3a85c6e17a3efc31d2f0630a319cf4a0", "object_relation": "sha1", "Tag": [ { "name": "149-102-156-62", "colour": "#07086A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823605, "uuid": "40cb42f8-a76d-416d-9bd2-74145110ee19", "comment": "Malware payload (Stealc)", "value": "a6c809347236b890218e01b84cddb6ce4615e74f0f0db0f4148776bc10433396459d488ab73d109c5ec15853d99f3469", "object_relation": "sha3-384", "Tag": [ { "name": "149-102-156-62", "colour": "#07086A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823605, "uuid": "084cf0af-d7d6-4e92-adb0-b369145b3d2c", "value": "T171D55B533E908C69D0AAA33498A261B6B661BC084B7E73F30ED16D352D77BC0653EF54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823605, "uuid": "28fce2d1-3a74-4126-9ec7-02bf00ade28f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823605, "uuid": "5ce87581-6a9f-4f1a-9a0f-3edac188f92c", "value": "49152:QGKUCZQl4f6SF1rXGfdPKGbl2kt/gGCBO2g:Qr4FPKGbl2kOdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763823605, "uuid": "8dbee372-9aa5-4fe6-b1bc-006fdb42f2d2", "value": 2971864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763823605, "uuid": "0c611152-44fa-4fa1-a244-b361d034739a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823605, "uuid": "f6b72780-e14a-4d76-924b-a814281bb011", "value": "Pauline.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c748c46-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855654, "uuid": "69237ef7-e283-4bba-a755-a86fa4ac15a0", "comment": "Malware payload", "value": "3c716b5d605b3f757830c059705384d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855654, "uuid": "469af5c3-e955-4fc0-8abc-0266b9b780c8", "comment": "Malware payload", "value": "3fe8f4417953e01e926f7f596c974ca4b18602f3367f4f765349a1500137b84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855654, "uuid": "7303efd1-d189-491a-a7bc-3e35a6d9c692", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855654, "uuid": "482d091e-8e9b-4419-911e-3f7ffae9d3bf", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855654, "uuid": "cc50ccce-8aff-449e-952a-9497d34f53ab", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855654, "uuid": "df57f928-a470-4435-913f-970b110c6691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855654, "uuid": "7962f908-1eae-439d-8e27-e04b0d421e45", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4935e2-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855655, "uuid": "d7124481-a290-4595-b27a-ed6d8beaba29", "comment": "Malware payload", "value": "2611b2c5f56d82603261e3c6e73ffd73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855655, "uuid": "34b9975b-bf7c-484f-b3af-18dca14feff4", "comment": "Malware payload", "value": "4011f4eeea8c699bd23713437e1d8614a016db1c2caa1b7c0c501118d456e104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855655, "uuid": "d47f85d9-e0bc-461b-b4f1-fca2ea464d52", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855655, "uuid": "230705e6-4953-4d7d-a05a-72b064ef4ec0", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855655, "uuid": "4d649988-a3b2-4305-b286-2e20ca44c764", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855655, "uuid": "35198f31-cae8-42aa-bbf2-74ba9439015c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855655, "uuid": "6cfc48f3-86ea-42f7-b4d8-7701f009b794", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0b77b3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855656, "uuid": "8f555157-27a6-4eb4-9cd1-056a8ae1050c", "comment": "Malware payload", "value": "e2e8c5025be9cb53a71977e79b481f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855656, "uuid": "c4c22bbf-5e4b-45f3-8ea2-a0208e6c352c", "comment": "Malware payload", "value": "40b0619cffaf3618ae86e818251320ae6fdf51eba5c3872c3d2c863e456b71ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855656, "uuid": "dd7b0ae7-9190-4f7d-b3b1-ac1731c04c81", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855656, "uuid": "d351c7c0-7a15-4d54-a346-b15d91dd0286", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855656, "uuid": "8672d8b8-9c1b-41c4-b976-c6a447d0cab3", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855656, "uuid": "c4411e83-7fc6-47ba-9849-92dd805fc2bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855656, "uuid": "6d82be83-0379-4279-9805-5b97277f4cb3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7632c5-c7a2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763816004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816004, "uuid": "d9efe7ac-6682-4e3d-854e-8a438e9dbedc", "comment": "Malware payload", "value": "38dd2bfb557051f3a4b31323e6019fda", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816004, "uuid": "6f24bd86-222b-4a70-a26e-8791f1da2e03", "comment": "Malware payload", "value": "40f9235ce703b27727b0e090b917970da34213cd32953414467f922946ea1964", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816004, "uuid": "48a09496-47d8-4c4e-a979-2e2f7609f22f", "comment": "Malware payload", "value": "535da1d38820f5071ddb2b6037f80bd6856a3e6a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816004, "uuid": "3b946e5c-3c73-46cf-a8a1-0d1f699abea0", "comment": "Malware payload", "value": "0c0188ae21ee0f6416431443d6071357609f44d7d893d9159ce04fddb732bd926cdb830e0cfc262a51f5e100bf5c60bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816004, "uuid": "2c2a08d3-5764-4f95-a025-036497ddc1be", "value": "T139142C2DF42FE3D4F41DC4788D2A5651EBFC3CEEA695E86C851738B52429AF17328620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816004, "uuid": "7f746d6c-751a-4082-a237-68eadd784aff", "value": "66d96819fd3c157faa1509ed2ae2b2c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816004, "uuid": "add7762e-16ce-4567-a2ba-41615d47757c", "value": "6144:JSF0H1fxKf1HU0xl2Ex9/xyQW8ukFqywji5h:JScfYf100xl2Ex98inFWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763816004, "uuid": "2f42840e-6499-4fb9-a00c-e0f10408cbc3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763816004, "uuid": "00eb885f-951a-437a-ab14-651063af176c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816004, "uuid": "f52225de-b46d-40d4-9a36-5adf0f5a7f10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee75abc-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855658, "uuid": "b56c0ee8-e436-4a39-8fc7-9ef3d9de411f", "comment": "Malware payload", "value": "84000533ecb2ad9cc3cc8b0ed4919393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855658, "uuid": "b3c8aa4e-7d5c-40ab-b701-f97cdbf93d10", "comment": "Malware payload", "value": "4140a54e72bbb6a8e103cb109f88fe5a62b2f83735f085d9612674a17b48ef2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855658, "uuid": "52886b1f-dbec-4fce-9ec6-3f10901dd065", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855658, "uuid": "618cfd4d-16eb-44a3-90f4-1a944d06302c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855658, "uuid": "2511f201-3967-4046-8979-2b42ca5c1149", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855658, "uuid": "eaeb7e77-e908-47d3-953a-95bb87205a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855658, "uuid": "299e6516-756d-49e4-91e1-04f597d49581", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb04628-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855659, "uuid": "02840af3-e575-44ab-8f24-a0d250c43bcd", "comment": "Malware payload", "value": "1c9083ce32249264f78d6383b999d814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855659, "uuid": "2614f501-6a08-4c59-b8b9-1c4b6f1cacce", "comment": "Malware payload", "value": "4144d44f2b1ffd2f9b62da31460764b87e7a3b6b48c27a70f9a5043542c38867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855659, "uuid": "d875076c-6a72-4af2-8b3a-26e8cc97266a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855659, "uuid": "d2e49aa0-7be6-465f-8b42-c19705f37989", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855659, "uuid": "d456dd63-798e-4776-ad4b-43a5c7054e45", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855659, "uuid": "c94ddf25-6d3d-418a-8b54-d3a2b9084668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855659, "uuid": "30776877-2ee6-4195-bdaf-420c8631986e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9617464-c77e-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763800861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763800861, "uuid": "3423f968-d6b5-4f54-872e-cc77c3ff5f87", "comment": "Malware payload (RemcosRAT)", "value": "37d8f0f84e01f756f77668692ba04548", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763800861, "uuid": "b8a9c155-59c9-4879-b0c6-78c55f6bec53", "comment": "Malware payload (RemcosRAT)", "value": "4153a193ab84784b9598abbccfced650662a66d6dfdc1003ce37198c056a5b22", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763800861, "uuid": "817f3056-d7b3-40f2-9c1e-1b558c68b809", "comment": "Malware payload (RemcosRAT)", "value": "b372cd2ca3861018ae802e7080e6b45095589461", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763800861, "uuid": "4255973a-c3a4-4dc5-ba0e-6a447803280b", "comment": "Malware payload (RemcosRAT)", "value": "715cac1d6d2d810f5e3a6edbd6cfbed28b50794bb5b6b6c0ae9ba0055ac6a2b04f86315469b620b512b63d12910b9625", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763800861, "uuid": "d5a66b71-b14c-418d-b96a-27e91756177f", "value": "T1FE756D039C49CB53E02993F4BD474DAD2B1B6B1CE98679FF11651ECF2E206260DCA16E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763800861, "uuid": "da3781ef-df9d-4cac-b2a1-ef29f981adeb", "value": "24576:MKGUdvlX+VpeUbr2v94RjkI7loeKmKiwry3vMqrWU8n7UDWaxOji7O:MKliWUbq0D1VKhR0WUpHx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763800861, "uuid": "7c1305a4-6d64-4b5b-aa5e-7bfe4f28a9ff", "value": 1554944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763800861, "uuid": "b2eb91a3-9fa4-4e08-90b5-a730756f374a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763800861, "uuid": "84dd4ede-a183-4120-8ffe-62e3c5b3e39d", "value": "SecuriteInfo.com.Other.Malware-gen.87993989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c53840-c7c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763828800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828800, "uuid": "b365e796-0b84-48e5-8b69-9ea879574db0", "comment": "Malware payload (Mirai)", "value": "5f560790733cb7f54902c01d8c25b133", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828800, "uuid": "57510722-5fe1-4ae3-84bd-394d65b819f4", "comment": "Malware payload (Mirai)", "value": "415cc4211fc6c0a520c62edeb8d72c5cf4a3b4a2f9d8ccabc5b94d4201e33b04", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828800, "uuid": "dc418f87-ad36-4da2-9d28-0168c47ab590", "comment": "Malware payload (Mirai)", "value": "5c63a8431647460ac277755308834c0dd7fcbf4b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828800, "uuid": "8f7930ab-5df4-4300-ad7e-af7138d3421f", "comment": "Malware payload (Mirai)", "value": "aaac648de5f66a2f3b7bcf197ecc34dd5f654e3ece96add08cebcaae37d7579544bd1ddc7acd19155ba2da73f415de4f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828800, "uuid": "908f13c1-3640-437a-aeb5-155be127483c", "value": "T11B4100ED02802F7A35068A25A3E755AC9C468FD1718A17ACD48A7C278C0F71C7BF9D83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828800, "uuid": "20630a44-7870-4efe-af19-8828ae2c6aea", "value": "48:pIIdYsIaMnh2apwMZByZhV8R47AF3OH8ENpuXjwzE:pZexP0aGuBwhqSdG8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763828800, "uuid": "42eba4b5-122d-4e54-82de-0cd461a6b2d8", "value": 2346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763828800, "uuid": "2887fe84-423e-48c3-ac73-d2a724080643", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828800, "uuid": "303e04b7-b296-4294-bff3-5247acf2b2c9", "value": "wget_telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39b2b97-c7f2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763850646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850646, "uuid": "52c1fa38-dad6-4b79-be2d-033558745e56", "comment": "Malware payload", "value": "799ac1182fe4b01cbcc46b416c524e96", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850646, "uuid": "d8c0dd40-6fbe-4429-ab80-017bf2157ebc", "comment": "Malware payload", "value": "41abee81a9cf1657e98ea8c7a6a966d70e032d44cc3b526253fe636230c710df", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850646, "uuid": "0bc80d3b-de02-4b83-b2e7-db1de5389937", "comment": "Malware payload", "value": "ba1095dd0b23faa69607a336006a9926a97dbd56", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850646, "uuid": "82b2e5a5-0c8d-4700-8f8b-6db5899479b2", "comment": "Malware payload", "value": "17914fe4b6c87395519106ecd21687e09713567f658d95a43efa7b479b2d6dbc97062adb5917fb148470325446cee7fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850646, "uuid": "91082433-f89b-4bce-8d1d-a4173b92ad50", "value": "T1F121348AD130AB62CECBCA2F77A06BC9908D45B3A26F9F659944DE35DC4F5843117B00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850646, "uuid": "ed7bf5fb-f09d-4a04-8eb0-ead92ccea28b", "value": "24:sYlYE1YUYnAG19ZVwaVmA+lt31rkCN541VcqV2AVEVaAI6IMpos:aR98vPJwlHMpos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850646, "uuid": "18a0d31c-4d6f-49c1-9675-2cb380291f15", "value": 1402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850646, "uuid": "5dede9b4-f097-4c15-8363-7840a2b2beaa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850646, "uuid": "78806dd3-69b9-4828-86e4-7070e76696f0", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907bfffa-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855660, "uuid": "da98c225-ddf7-4254-ae66-91d141bcda9a", "comment": "Malware payload", "value": "2a937aa9cba4e43c538eb1424f0c5688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855660, "uuid": "c4dc3f2f-e459-4168-9426-9583f95d13b9", "comment": "Malware payload", "value": "41d0ca5b0cae995ecfaea1ee15ea5a8351f303ec9651492b7e959be4ca70e8e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855660, "uuid": "b7474f67-bd12-4248-aee0-dc37370a106d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855660, "uuid": "55b88d85-e69c-42ad-9322-b34dd88bbf66", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855660, "uuid": "e6fe4c29-bb53-4a92-9911-3859bcb02d60", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855660, "uuid": "104886b0-8012-4b0c-b1d1-38d18238ec3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855660, "uuid": "34667bad-4af8-4f0f-a288-5e635225fa4f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917bb0f6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855662, "uuid": "a674b543-7077-46f0-8fca-f65c27c0e5c2", "comment": "Malware payload", "value": "705be14cad1033ac20a09c454a556967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855662, "uuid": "12408f11-2947-4d12-ac00-503702714435", "comment": "Malware payload", "value": "41f630f2c90e7709851f758ba7c7e353a8b7afe1af5f3979a3fdf02c1869d7ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855662, "uuid": "e5b92ee6-c029-4c3a-b47f-55d3a773503a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855662, "uuid": "a3f97dc8-941e-45c9-81e3-9c59fdd0c190", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855662, "uuid": "90d73cf4-b0dd-4369-9202-620fae20d62d", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855662, "uuid": "a99336ad-d5e5-456f-a183-a493f7e99245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855662, "uuid": "87364d38-0a6a-4eee-81b6-2a92efa6b0a7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39aad7b-c7ef-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763849330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849330, "uuid": "eea11efa-46fe-476a-bc10-979f20c10ed4", "comment": "Malware payload (Mirai)", "value": "10d5189682f688e84ac25a364bbb5b6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849330, "uuid": "60eca2c7-d80d-4e19-98ff-b3ec23a7b7c1", "comment": "Malware payload (Mirai)", "value": "42358a3f9c2bb9af64dae21e175801fdce9fb0e60c19172c78eaead401b9f40f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849330, "uuid": "ffd10b5c-7967-4cd2-b0b2-56428a3282e4", "comment": "Malware payload (Mirai)", "value": "925ca03c5e1f3c93efbfdef150ed8c4b090914e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849330, "uuid": "ab9bb289-b36b-4e56-93e0-49f92c170c9c", "comment": "Malware payload (Mirai)", "value": "312b29150ae616b98aacbaf56941e793f3c63883b94a1c27d54550175a3a4a3e2c579ec07de8a3fe7ef439517d641939", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849330, "uuid": "2a4a8242-94a1-47b8-990b-c2664da6bcc8", "value": "T191833A82B9819A17C6D452BBFF5F42CC332653E8D2EA7203DD156F25378A81B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849330, "uuid": "cb120c2f-be63-4bb6-9adf-cc6c9f252e7f", "value": "1536:CJ2wsTyxZnYtv0YozM31yuYba9qh/z7nGjWv6ug7R6kU:CJ2wZucYoQ31yuYbaOXL6ugok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763849330, "uuid": "720c0b93-804f-4c8e-9900-41d12f7a2819", "value": 83108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763849330, "uuid": "3527fd2b-86e0-489b-9439-c47e767ab0b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849330, "uuid": "527865f1-d40b-421c-9401-951ee842032a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92569bca-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855663, "uuid": "c31d2e75-d0b1-4b0c-afbf-4ccc67709dcc", "comment": "Malware payload", "value": "142b4e452854f64e4592a391ba19b6c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855663, "uuid": "fe3ae22d-3ff3-4144-b978-83217584ec3c", "comment": "Malware payload", "value": "42c60c305f4b8de9f987ec080bf2e98634773ba0d2756c599718e56ada1dd78e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855663, "uuid": "f472879c-0ecb-4d9c-a6be-119567e9d974", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855663, "uuid": "a77c0235-ef83-4fe7-ab3f-418c0a931f74", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855663, "uuid": "b000c08d-2bd8-4996-b340-fb55128d15dd", "value": 1868800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855663, "uuid": "1908ed4a-127d-41be-bd80-77b512aa5d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855663, "uuid": "2ec87c7d-09fe-4209-ba6a-509bffb25d06", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939a0ea9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855666, "uuid": "3901ec12-4d8e-4fc3-a053-6415aff59202", "comment": "Malware payload", "value": "80786a58e7fc9595f960db9aaafb1383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855666, "uuid": "fea80e50-8761-43e8-a387-7c1fd313f133", "comment": "Malware payload", "value": "42dc9d522be7bab34133ca69093e716e9a5c917666560796c956c9c46c9590b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855666, "uuid": "7ab29520-7f1c-4f51-97ad-328d745c13a1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855666, "uuid": "42161cb8-f007-4212-8d9c-6f3352c253c9", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855666, "uuid": "d30acf93-f433-4e58-9acd-5a36139762f6", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855666, "uuid": "2e96ee79-474d-404e-b97d-1c0e32aeaac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855666, "uuid": "549e1a21-9f21-46ca-8d2b-e7cd899d61a2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce21bbfe-c753-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763782320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782320, "uuid": "fb4b4101-ebe1-424b-8443-4fef03a7e672", "comment": "Malware payload (Mirai)", "value": "5a1e5de92269cec21badf922332aeb02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782320, "uuid": "53c8d69c-ff0e-465a-9c45-76e82bedfb47", "comment": "Malware payload (Mirai)", "value": "42f89fcdbee41b364f91d2747a0e96f730f334a61e4ad61f9dbe9fd80765574c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782320, "uuid": "cc1c91d4-af03-44e9-a92c-dfd2cbdec7c8", "comment": "Malware payload (Mirai)", "value": "9a9e5b3014c9e376d1d06cd5a28d3bbc71e01884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782320, "uuid": "87f8d3d7-161f-4ed6-b993-687d52f603ad", "comment": "Malware payload (Mirai)", "value": "667461206f7b41ec2a802d7bb8c55cde833ad74fd3531fba39845a3933bda5ffd56e34566990cd8274971cb966c0a2ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782320, "uuid": "afa33fa3-4b11-40b1-bfbd-e5776acbb5d9", "value": "T12D430182078C1C60D92B97B7D7218E668077C9E1625B5394EF316F4484FA3937B8DEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782320, "uuid": "845455cd-21aa-478f-8840-1364319bc495", "value": "1536:xnvd3HxvJyp+igTRpABMOJpyov2LXCfqrjow2MoLkg4azHf2:x3FxpABMgp3vG8w2nLGazHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763782320, "uuid": "a160207f-89d9-44b1-914a-ea20d9fb37ae", "value": 59380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763782320, "uuid": "a87ae34d-a7a8-47de-8794-ad2c007b8007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782320, "uuid": "83b81764-c0e1-438c-bffc-6d1cd4edebcc", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73ef75b-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829499, "uuid": "265e2086-3816-4058-9a81-67ae17d28e3f", "comment": "Malware payload (Mirai)", "value": "f863b1d2cc78d43f3917991b32c85d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829499, "uuid": "43c86dab-aa2d-4ff9-8386-94ef67138125", "comment": "Malware payload (Mirai)", "value": "42fd930ec6d08f84d3197a9746e4cff6af2ccd2d3eeaca1f5a982701e66864f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829499, "uuid": "14616697-c7a1-4f46-83a2-c2007aec4cca", "comment": "Malware payload (Mirai)", "value": "f2d4f97b381770e58b29270f2e904a2c62d72c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829499, "uuid": "470c221f-fbde-458d-8e10-a4ff25f450d7", "comment": "Malware payload (Mirai)", "value": "8570d10ab1fd105db665a4c58edf63179a11bdd981947327001081597448c8690dcd804cf2e8825ed7617e02b0064b5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829499, "uuid": "233b9970-78c7-4731-9ff3-ea647de8ce47", "value": "T16AD35AC5E68FD4F6F80215712032B7368A72ED3A127EDA87C7AC9A319CA3581D91735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829499, "uuid": "c694cc74-af2d-4ff5-ab6f-f8588b649adc", "value": "3072:nSzwqXtFrpYqU15BJW/9STrQsE7r6yCG:nSvXtjLB/CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829499, "uuid": "a330431d-5900-4f15-a656-430a5f3cc6a3", "value": 133484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829499, "uuid": "6e745cf1-95b2-438e-95ea-4de9a09a3cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829499, "uuid": "20bf7c48-97f7-46ac-9144-f893d47df230", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948fb7e5-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855667, "uuid": "f33d89b6-6b35-41da-992e-19cd8e60d183", "comment": "Malware payload", "value": "7a28f9f4f2fcd02fe9e9400f637c7394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855667, "uuid": "dd9f3b23-b983-4d84-a2fe-0304cbdf0558", "comment": "Malware payload", "value": "4360de4099381cbd5c1bdeb3531b8e8e98e01e1b68047520781d081dbb10a01d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855667, "uuid": "9d03d927-24a5-4c58-8d55-285a82bd7536", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855667, "uuid": "da9d8787-24e8-4514-8821-24c586756c47", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855667, "uuid": "223a8be6-7b4f-463c-9fc6-e35181284276", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855667, "uuid": "ede057a0-b153-47eb-8be0-23aa8fb40c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855667, "uuid": "ddb73c32-cb2f-4dca-a599-cfdc77e89267", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bdf458-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855669, "uuid": "fb6d5a4c-15b9-4bf9-b8ce-35f0433f6d52", "comment": "Malware payload", "value": "f2da3a009f33da5bb68d504a8c32cc28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855669, "uuid": "31c49afd-ef93-459b-a017-3246cace1661", "comment": "Malware payload", "value": "43898746c75a626c1dd2ba6a5fa01876849a08f4d437b8afb9462202ebe3fc3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855669, "uuid": "048d7b11-bcf7-46ca-ba74-08e1ec28d1fe", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855669, "uuid": "2208be93-2ec9-4fc4-97c8-e4939c852e09", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855669, "uuid": "9edb5c97-ef9a-4952-aebb-9c75bc411cc6", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855669, "uuid": "2470866a-12a9-4a33-9d76-bb0bf2878373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855669, "uuid": "c5646cea-276d-476e-ba9a-0b4e597f1a6e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969a7598-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855671, "uuid": "cf83ff36-8d14-4dec-9090-6c09e9f3008b", "comment": "Malware payload", "value": "1fe47987a5bc6913d1e8a013d0d71851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855671, "uuid": "78f82f5c-aafe-4756-8166-c5e04609c840", "comment": "Malware payload", "value": "43fe5595478789590e7bab34ff87e87ee73d25b94e25c2d1cebc878f22e2f897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855671, "uuid": "29d1c4c6-5f5c-4025-a2fd-a31aa67523ac", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855671, "uuid": "f2a85867-d857-4965-ab55-3c43f3e7e23e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855671, "uuid": "b636047c-a1f8-4635-afbc-2253269b1c83", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855671, "uuid": "196910c6-6e1a-465c-a61e-35648ca97754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855671, "uuid": "981e943b-afbf-4439-8f20-6e40242cc592", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9780ed06-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855672, "uuid": "b3f8d1f6-da4c-4156-a7f9-cdfc6d3530e9", "comment": "Malware payload", "value": "5cb2f4367bb9d489814b3723aa02389b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855672, "uuid": "74a721ca-92c1-4542-8df4-5673ff9819fb", "comment": "Malware payload", "value": "441778c2bfec2398bc9fee3544596d091c69dea283e2b5c90549943e9163711a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855672, "uuid": "42ed60f9-656a-4222-8707-3326438b8afd", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855672, "uuid": "a2feae91-5509-4c10-b116-0debe309f91e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855672, "uuid": "80ea2ac0-528d-461b-9b96-28f15416f9d9", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855672, "uuid": "5e557b62-8812-43aa-a402-90251a8ccf82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855672, "uuid": "7f055f8f-7ece-486f-a86d-02f11a1d231d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98435524-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855673, "uuid": "d69928ea-9a2c-43ce-acad-1c5369df355b", "comment": "Malware payload", "value": "c73ceef534285ffac9f53d5d47d6b6c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855673, "uuid": "61021f62-0f5c-4f84-b626-5a6bcff1b811", "comment": "Malware payload", "value": "441fc3ea750752d3e2d065ea5e5227d70ce48ab66c7a78115d87c999dfa89619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855673, "uuid": "37885fbb-4604-4552-83e2-3e889477ec26", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855673, "uuid": "2a6aecca-2196-4269-ba04-7c16e91334d5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855673, "uuid": "e33c495d-e226-4c5b-9e48-e2d4b187c622", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855673, "uuid": "57295f4b-903a-4b1f-9696-e55dead4ffef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855673, "uuid": "a5192a00-eba9-47f1-aff0-7f3d04ba4c36", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99166a0f-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855675, "uuid": "a1f67694-d9a3-481b-8da4-45aae7231c95", "comment": "Malware payload", "value": "282b4bed1857dd5d8d8dabf8fbd17a7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855675, "uuid": "d5db23b4-858a-4e4b-b99b-c02c46ce65f7", "comment": "Malware payload", "value": "44f6e25563492a2819f66ed120e0964ad1d4aa733771ecc2a1ed560613f6b3e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855675, "uuid": "f8220f2b-49c2-4783-9ab8-44ee3c65c683", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855675, "uuid": "d0f0d3e3-6f9b-40eb-ab61-82243fb0c4ec", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855675, "uuid": "f3ff22f8-0a98-4fcb-8695-2f7cd7480de1", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855675, "uuid": "af8bf0cb-5536-46b9-aafa-63fcc036a33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855675, "uuid": "9766edf6-b946-49dc-9a02-dce9731b0b54", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e40cba-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855676, "uuid": "1b75d191-369d-4869-b1af-c3bf00d396e1", "comment": "Malware payload", "value": "6b015602c760995d2e62698614209aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855676, "uuid": "c52c9f1d-f7e0-422e-8796-0a530cd5778d", "comment": "Malware payload", "value": "45275cf8067fccc6bf6d6596f95603fc2691f2ea4ff5aadfd3de94fabf3fcff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855676, "uuid": "67b54ca8-f941-4752-bbf8-69c174acc955", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855676, "uuid": "f605fd36-a395-4157-a53f-c4909f732277", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855676, "uuid": "6b0e2ee2-4594-4c6f-aa5d-cc5217fed5dd", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855676, "uuid": "6f7f8fb3-70c3-466d-868e-6a23af38117d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855676, "uuid": "c942e1e6-5971-48b1-886c-11d45941133e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aba1fb7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855677, "uuid": "17bc4fe2-ac97-4969-8a22-da1f70b1908f", "comment": "Malware payload", "value": "66e7c0353ebdfaea91ac979092af0fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855677, "uuid": "a719433a-50c0-485c-bc7a-eb3e8f42ad6f", "comment": "Malware payload", "value": "4545934220243c6ea41a170d4752e5862b8c65b6a93b7cf2d2e7d3ac7659d031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855677, "uuid": "6794d43a-4f0f-4474-8368-df2360cd32a5", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855677, "uuid": "8f3025ad-711d-4e1c-be7b-2b985cf27ca6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855677, "uuid": "82331d7f-a3ec-4ccf-aa78-525a80db5ff1", "value": 3407884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855677, "uuid": "227eeccc-d74a-4af4-b0bb-79250f93d580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855677, "uuid": "a684fe60-1146-49db-a559-0aa6cc7f6a92", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8b0d45-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855679, "uuid": "68124082-a337-4917-8d59-c479b4ac1f46", "comment": "Malware payload", "value": "03e2ed71a7e947b1628e8f928330f5b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855679, "uuid": "ed17c838-317d-4531-b78e-b868e2fda536", "comment": "Malware payload", "value": "454f6f17c7b09b9914cf336c1a71e4b55ec4f66917879a95a4d225b47e663f8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855679, "uuid": "df3f1367-2323-48b5-9a2d-ed4d527aa337", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855679, "uuid": "79cf1d40-716b-422f-bc34-af9023966528", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855679, "uuid": "5a4f19ab-540d-468b-af61-df8a35baada3", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855679, "uuid": "380317ac-ce82-4438-a885-e944476e3400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855679, "uuid": "8d6cb5c0-7327-4e7a-a411-ed1514bca304", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb8940f-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855681, "uuid": "5e940599-3167-4598-9c04-a50d411cc085", "comment": "Malware payload", "value": "4d5539b0fa0e145f60a5fa46252dcd3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855681, "uuid": "0ffcc924-a62d-4fdf-ab05-4c23c4deaf0b", "comment": "Malware payload", "value": "45b69051833ba880b6a9cdededab6249034c7b469dc2be4a5540760250f2f107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855681, "uuid": "51fb33f3-2537-4131-8736-e4ce6dac30a0", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855681, "uuid": "7ce15121-96f6-4cfb-993a-2d222cf2ebea", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855681, "uuid": "f9e68d6b-947d-42e2-96fb-76f1d3c35839", "value": 2281472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855681, "uuid": "0287f683-6206-4c82-817f-a7949633cadb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855681, "uuid": "63c84258-667f-4c5d-9f8e-bdfbc0d15c74", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d980551-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855682, "uuid": "b4cc41a9-18ba-431c-8970-0d51ced84ce4", "comment": "Malware payload", "value": "408dde08a6ba23ba0b3a26b52b0cd6b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855682, "uuid": "0ab23b7d-3f3a-4cc3-bd01-1402b8bed3b2", "comment": "Malware payload", "value": "460d557a0b7332ee057dfd639b90d9fb7737fd78b1b22f72f1fd398e184360db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855682, "uuid": "5099a730-3ae0-41aa-abbd-5c914bd2de4e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855682, "uuid": "2b294d0c-e797-4098-9345-d72f840979b4", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855682, "uuid": "5d223167-c269-4e42-b40d-f77d5d63b07e", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855682, "uuid": "1f8bec0e-597b-4593-9376-02cf5d91383b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855682, "uuid": "66c7a8d1-5677-403b-8591-03ce8224c754", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e73deb0-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855684, "uuid": "c3948302-cc9e-47eb-bc66-585083f80440", "comment": "Malware payload", "value": "9c15a631960b4d8dfbe06e2ba67b3954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855684, "uuid": "46081d68-5f40-4398-8bc7-fde34b53f2d2", "comment": "Malware payload", "value": "467a9e566bdbe0b9d43935909b22e32465871d0bc6cd5435ef508235a93a8ed9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855684, "uuid": "9ab7bc16-4f55-492b-8933-6a5497a7b0ca", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855684, "uuid": "e083fd61-31d7-4459-a7c1-f327891f92b8", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855684, "uuid": "fcf90ea6-4642-4a25-8096-0df447962de7", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855684, "uuid": "bb46d03a-9d6d-4f78-b9f0-75d2f584bc83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855684, "uuid": "5e3a823e-9883-4b9f-8796-bc43b1f0e64f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23440f22-c7b4-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763823694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823694, "uuid": "86be8e64-81b5-4fdf-941e-045f7b8f172a", "comment": "Malware payload (CoinMiner)", "value": "a70559acd5a04769bc6db0f62c0167ed", "object_relation": "md5", "Tag": [ { "name": "95-217-39-238", "colour": "#045555", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823694, "uuid": "7aa72e26-9f55-428d-a0ac-06e85e96b34f", "comment": "Malware payload (CoinMiner)", "value": "469e0027cb53e2ba2bfe66d4aac3ea456fe4e91efbd11b631db252a9a1b02a8e", "object_relation": "sha256", "Tag": [ { "name": "95-217-39-238", "colour": "#045555", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823694, "uuid": "110413a0-40ef-4c07-aeea-331c859a0c16", "comment": "Malware payload (CoinMiner)", "value": "ce4cd6b25852f3e466f41acf2c9ecbe6a828b0fc", "object_relation": "sha1", "Tag": [ { "name": "95-217-39-238", "colour": "#045555", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823694, "uuid": "738bfbf9-622d-49cd-9f3d-a520383067f4", "comment": "Malware payload (CoinMiner)", "value": "67d751bc41dfbb328458151e159fe3a5ed28abbebd1ed49cbc3baf71a3267894fd1d679278ea27351c5b62ed8fe0bf5d", "object_relation": "sha3-384", "Tag": [ { "name": "95-217-39-238", "colour": "#045555", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823694, "uuid": "62906c5d-856f-4104-aee8-2e0cf2298f38", "value": "T1FA569D14A3E804A5E57BDB34CA55C333CAB07C925635D24F0598F2422F73EA29B6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823694, "uuid": "d60a2ede-9889-4162-b633-a560c048ca5e", "value": "3b4eedc065e14ea4fc4b76ba549cbf80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823694, "uuid": "cdda7ee1-0bcc-47cc-b698-caf0b62a075e", "value": "49152:1k8XRMl3yZam5alpjIvy3T6saP5/0rQHolrnmPvTNm/yXXp2qTdzg3m7j3Wa14xe:E05oIvjmQHgnmPLU/BCj3+Ord", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763823694, "uuid": "718f540e-84ff-44cf-a649-8b634106e630", "value": 6178816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763823694, "uuid": "96eeadce-9405-491a-baf4-2139d22e8671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823694, "uuid": "1ff3de57-33f9-494c-9301-0eae11044db5", "value": "ooewqi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3edfe2-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855685, "uuid": "74698fdb-add3-4c05-89b2-3516be7a37e7", "comment": "Malware payload", "value": "375a9db425cba1af65e0d07a3d88782d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855685, "uuid": "c68bae2f-0ceb-42dd-87cb-032f3ac27007", "comment": "Malware payload", "value": "46a6d42aa3823e2bbedf5788ac42df08fcda87df9164705e5aad6092bfb753dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855685, "uuid": "f500367b-9c68-4f57-a495-9b1de7d87a5d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855685, "uuid": "beddb6f9-2f80-4f7b-a872-e74ae5801707", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855685, "uuid": "2fb65417-a775-4e66-8d2f-60e1adee483d", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855685, "uuid": "ab2ec8da-51c7-41bd-ab0c-e8ecae932aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855685, "uuid": "bd3ca1c3-a6f3-43d9-91e3-5b73cc2e2545", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3876330e-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852936, "uuid": "adbfce4d-f5f4-41ac-96d5-791db9d85721", "comment": "Malware payload", "value": "b87167c7e4d8c0b180fc6a6a6643069c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852936, "uuid": "ceb436ce-6bbf-4aa1-9aae-0804a78bbeac", "comment": "Malware payload", "value": "46c9f63648d1a0fab977ec7b921ee1111a85402591984b12bd41391ecb2f5d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852936, "uuid": "46cde8db-e13e-4523-a943-50f978990001", "comment": "Malware payload", "value": "e0db7b5eaf92feff220c805b0e5f3d8916e18d51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852936, "uuid": "6310c6c1-05a1-4035-8fb9-eef7308ad13a", "comment": "Malware payload", "value": "145b2f0f048aa73a55c9d43b93295fc82e70dfb095c8a90f8063e2640dd0fb2ece44ded595d5e035e384193cde540aa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852936, "uuid": "d76af9a8-f933-4c6a-a96a-c260049ca648", "value": "T13D76BF42BB948F83C5DF2FB210755281F774E507D756A7CB9100A2F8ACB23C44D5AAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852936, "uuid": "1c0760e2-10b6-460c-9bad-7d76d7d7c1b3", "value": "98304:KZoe84UE0yq6XDe8i3idu14rMTQektKgUOX32yn1lrm:+ooUESSdfeOUg35rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852936, "uuid": "4e85c7a5-ae96-4c4b-b77c-af1cc177ffb2", "value": 7813928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852936, "uuid": "fd45ce80-fd3c-4eba-b96d-48e313fcd3cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852936, "uuid": "0c75bf5c-e42e-4acd-95d0-66ee288acb9c", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff81fc8-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855686, "uuid": "9e65e7f7-427e-4621-acc6-ce8df7145c62", "comment": "Malware payload", "value": "cf2711a6fd10d9dc782430229d1e5131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855686, "uuid": "5e2c3f58-6147-46f0-8c42-ecb53f64b16c", "comment": "Malware payload", "value": "470333991e498af46a0511853c0497edf9909f99b1886a21df8341a7d047b732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855686, "uuid": "81a8aadd-2c43-440a-b08f-5880d8a48e51", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855686, "uuid": "be77fc15-c0e2-4947-8ce4-5f11af5834a3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855686, "uuid": "b3cf2bc3-9704-458e-8cf3-b1fe8c55ddb8", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855686, "uuid": "e7783c82-26a9-4cfa-a705-20459d4e0715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855686, "uuid": "444b886d-cd2a-47c4-a233-30e09354f467", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd23e55-c7ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763826448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826448, "uuid": "1ac5d15e-d240-4fe0-8200-fda9603bb54e", "comment": "Malware payload (Mirai)", "value": "eb96d5d3adcf4855287ab59d1966ad94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826448, "uuid": "3bdf3a2e-8c70-4c9c-beba-461924d4298c", "comment": "Malware payload (Mirai)", "value": "470918cbbf9a7bba8968ec8012921eb98b0fd43451ca57625ffa09195871a8ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826448, "uuid": "a3e66b02-b60b-4049-842b-4d11aa4666c3", "comment": "Malware payload (Mirai)", "value": "042a9851b79b7cf30ffbde0b56d5b5fbeda01814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826448, "uuid": "a8f0694d-ba18-485a-a5eb-2361e12f9ba8", "comment": "Malware payload (Mirai)", "value": "4896c875fa67b8c3c849d7f986ade95b70ab95db53f542d49f1d420cf6ec5d9d8990370248d500a1ecf62c81d1a67f68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826448, "uuid": "92c02453-d852-406b-a6ed-73b92c0323ba", "value": "T167D35B0A78E230FCC687D130526E9F21EA36749C41187DABA382BE711D36EE12E15F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826448, "uuid": "16d28c0c-9ddd-49fc-b58d-27e5b0c85209", "value": "3072:QIcSFzZyIvhnYC2p8P3Uce7oeuiVB1DJCCb5t:ltPCuiVDFCct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763826448, "uuid": "c09d59c5-74e1-4eae-a1ab-e1f101d10c9f", "value": 132064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763826448, "uuid": "51d130b6-c70f-4bd3-a49c-bd452cd65922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826448, "uuid": "1888b682-12a4-4064-94e0-7203503ce1b6", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c75850-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855688, "uuid": "49736dd2-b28a-4a0d-afb2-48995fe59220", "comment": "Malware payload", "value": "7803900c501b0e44832e4ef84cbda83e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855688, "uuid": "0377c17b-3302-41e3-8223-63614f9da821", "comment": "Malware payload", "value": "470fe193ca97acf4ed5b28e0990a3859c2d140b6176d6b2a63d303a6692f9b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855688, "uuid": "c9c34cac-93e6-47ac-b839-db87d710f01c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855688, "uuid": "bce4cc34-0e95-4d31-be32-00b416763551", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855688, "uuid": "167303c3-f71f-4700-a020-0dc64347bc45", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855688, "uuid": "cf3eabbb-0f6b-43bb-b5de-6fca6c2fec21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855688, "uuid": "f35bbeab-2e10-4d9c-a24b-89b395ba6b68", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1905e1c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855689, "uuid": "5b53e471-e279-43da-9486-f4b1ccd2775f", "comment": "Malware payload", "value": "844082a5af34dc65d5503d7efaf0e841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855689, "uuid": "bd02bb0b-9ac8-4fbc-a319-660fa5c405b7", "comment": "Malware payload", "value": "4748bd47d7efd9e01724450816c44178b222fc3653dd692f5b033a1297111dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855689, "uuid": "5bf6db25-2003-4e2b-822c-f24c500c0af8", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855689, "uuid": "34cbe0ae-828c-44f8-bdec-300fc342c8ad", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855689, "uuid": "919ed08f-a8c5-4356-8953-98732fdd29e1", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855689, "uuid": "04111f38-5ce0-4998-a19d-c365bb0489d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855689, "uuid": "7df5f3a1-2112-4a72-9268-8531854ad219", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27684ec-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855690, "uuid": "cc4e20bc-5cae-4cbc-b9d3-61a678ac9368", "comment": "Malware payload", "value": "d408c98a45adfa102521abdb8e2aae33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855690, "uuid": "758da2db-596f-457f-876e-2750d8a40b42", "comment": "Malware payload", "value": "476cb7dae294a2c8a90c601557f05588c98c30c72145911680ceab8e9f312fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855690, "uuid": "bc34373e-a80a-48f2-8744-856131015618", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855690, "uuid": "1a975d94-dfe5-43f2-8713-a10205381403", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855690, "uuid": "1f01ff48-8b9e-46e2-8e7e-e531e66f3a72", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855690, "uuid": "b8b85afc-e21f-4096-a54b-e18a844d4207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855690, "uuid": "525f959d-9f33-4922-aa7b-3dd71d1370b6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a345737d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855692, "uuid": "7e2b7a19-b5e3-458e-828c-78221b67161d", "comment": "Malware payload", "value": "7c08076698f92cf48f186afeffca0e07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855692, "uuid": "6ad265e6-9ea7-42b7-bbdd-443a4a407c23", "comment": "Malware payload", "value": "4770a5896c2fd4e98470e7c25f4bff6cd038e58d7c26ff2667c5afbca00124f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855692, "uuid": "0d42c3f4-3d7a-457f-abfd-1b79c76bb09a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855692, "uuid": "7de3f3a0-1103-4c8a-86a9-46ce5dc2bc7f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855692, "uuid": "45b2a0c9-b495-444f-8269-3986b683ac80", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855692, "uuid": "7435cae5-cd0f-472a-9bcd-b0f8e8a52104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855692, "uuid": "2ecebec4-38d9-4c7c-8586-c4990cadcf72", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a425bc3a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855693, "uuid": "7f22658d-5480-4636-8c14-c1461c73b1c8", "comment": "Malware payload", "value": "619fa0ec0e1b9d9ec80e7cb8fd803041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855693, "uuid": "1562989e-2f41-4885-9822-be11b449fc3c", "comment": "Malware payload", "value": "47ac0b652d7287f317e61f62a3a825beb8e8a230e853a411b500765eba561a42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855693, "uuid": "6581facf-ae13-4990-97a1-05cda3ce5fb4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855693, "uuid": "c69d4d36-ae76-4170-849f-9c101dda032e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855693, "uuid": "d10d7aed-bb11-42b8-8665-3978de16cf6b", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855693, "uuid": "eb4e9275-cdba-4c3b-ac16-6213aa58c614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855693, "uuid": "ba26d2f9-ce0c-46b5-98e0-ac173b94beab", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aed5b73-c794-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763810097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810097, "uuid": "ee17d284-8b94-499f-97d3-64f0749e547d", "comment": "Malware payload (ConnectWise)", "value": "ebf6b1a3f90ed973548e1b8e45515a83", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810097, "uuid": "8033fe0c-12b7-4f4e-a214-e2efa9333ec7", "comment": "Malware payload (ConnectWise)", "value": "47ccb2d4ebf50f962d89f7827316a10376377a86ba427279294bcec1326b0918", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810097, "uuid": "28b8fa9b-5959-49d0-8867-eaa2f9abd917", "comment": "Malware payload (ConnectWise)", "value": "03505b53a2cdd60a1c434db1969e4ef54ca9908d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810097, "uuid": "d6941883-aa0b-4d0d-9869-d184306a2c32", "comment": "Malware payload (ConnectWise)", "value": "0c7e6c29303e36ac94eea4b04208553e162758ab80d844e658cfc00cc1d80a0f009676de007036d29e631c5d12674260", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810097, "uuid": "96e5cfee-d4b5-4f24-8518-e12f7fd68d5e", "value": "T1BE46E013B3D995B5C07F0678D87B43A99A74BD048312DBEF53907A293D32BC14A363A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810097, "uuid": "e08055fb-c21e-4482-8bd3-27ed02070805", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810097, "uuid": "f774b594-814c-404f-b233-d100783cd4cf", "value": "49152:sEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqMz:FEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810097, "uuid": "289f27ff-a8d3-41e1-ad75-ce54f542cb8a", "value": 5682424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810097, "uuid": "8dcf6896-a04c-4a28-9e91-170ad7a5dcdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810097, "uuid": "5a633a86-602b-4026-80dd-40a9628d5b59", "value": "AdobeReaderDC.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a503fa57-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855695, "uuid": "e4d9ce89-b466-40fb-8997-56f5e3a1ce6c", "comment": "Malware payload", "value": "b5e70aad2c054854a7bda8623d2ada42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855695, "uuid": "a4ad2b9c-2317-4008-8816-76322e8e0788", "comment": "Malware payload", "value": "47cf97775bc7ed59bc8479eb0f086536cc00def6ede642e5d80701a427c64252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855695, "uuid": "b38bc384-a602-4d14-80e4-e663549b6c68", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855695, "uuid": "616dd7e0-daf3-4b2e-a6d9-f38adf20bb4f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855695, "uuid": "53568f93-6785-4075-8d7d-8ddc6b75de61", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855695, "uuid": "2d2c0ce4-5026-4cf8-83af-647f3bb3b70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855695, "uuid": "23a75382-62c0-410a-b092-9a785472b193", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d952fd-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855696, "uuid": "d3b12fbf-ab0f-41bd-b7fa-fe3bea785747", "comment": "Malware payload", "value": "4e77d7baf8c1edfab4cb04b6f687ea98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855696, "uuid": "36211e7c-98cd-464f-a89e-968cc2860b7b", "comment": "Malware payload", "value": "47db8468f466c940712e997e02d2e96fa679680f2b59af6c92347c76513e0a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855696, "uuid": "e9f8e8aa-eb1b-4845-8897-b69e8cb7aaa4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855696, "uuid": "bb862e88-1172-4ab3-927c-c315c94783f2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855696, "uuid": "4bcb7da5-96ec-4045-a458-b19493b13b2b", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855696, "uuid": "057d5a3b-41d3-4ce3-9a6f-6478fc4749ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855696, "uuid": "68ae799e-cff1-4d43-8f09-f50732d77a86", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b01274-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855698, "uuid": "9c1a35d4-ba1d-4226-9b7a-250e4ae15b0c", "comment": "Malware payload", "value": "d85c1953a1b8e037bcb4621b08ab9eec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855698, "uuid": "e11d37c1-e854-4cb3-8d45-dd0d451f399a", "comment": "Malware payload", "value": "47ff543659b8ccf25fba6bf575b39349c9141a5263da004f8eeb6001ed250612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855698, "uuid": "2d494bf6-7361-43b6-8c93-0ada858c88f7", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855698, "uuid": "3cda40ba-edec-4520-a252-9ba7806df54e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855698, "uuid": "20195287-b8dc-45d7-8563-ed8fbe20c250", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855698, "uuid": "69ca1c84-ab40-4b72-bfcf-efea0e2699bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855698, "uuid": "83888d15-c36d-4dd4-9bc3-1d62435762ab", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7834a4d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855699, "uuid": "364550d8-5e63-4a80-816c-6da085a3e96b", "comment": "Malware payload", "value": "30c11c6a22be406e6dd5c873a972eac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855699, "uuid": "c4c8e344-e286-45ed-9603-4c2c8132937c", "comment": "Malware payload", "value": "4865bb5123711bd00c2a9dde78527ceedd2d5c069c699b5740922e5344b1a659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855699, "uuid": "9283882f-1966-4958-82ee-9117acf04add", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855699, "uuid": "e06c38b2-4163-4ebc-a360-af61e528b288", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855699, "uuid": "5f526874-020e-45aa-b376-379ae9e1c2b3", "value": 481312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855699, "uuid": "4650dc81-adb1-4227-963a-89d50da3c7f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855699, "uuid": "ba3aafba-98dd-4fd9-a6b5-77218b04d95a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87fcc97-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855701, "uuid": "2cc90330-1a45-4f61-9ca1-68f4a46ad6d5", "comment": "Malware payload", "value": "87ad575369445b18bf10530ad7b6b7cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855701, "uuid": "01e5c173-4567-4d3f-bcb9-cdfed30f1cc8", "comment": "Malware payload", "value": "48662679cb5ba49b6fc502ed069fdb9eef700c5d2aea58d98074dfa4d17e7c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855701, "uuid": "980e2317-6f68-4fc7-afad-b81460c6d3e0", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855701, "uuid": "9b9f896b-d93d-4fd3-8e70-fb7a6bd37bbc", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855701, "uuid": "a0954039-3801-455e-941e-98259e61ecd8", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855701, "uuid": "6b821886-d4cf-4177-832c-42b64c4dcd8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855701, "uuid": "c4546fd2-3d79-4d62-9819-e7bc77320d48", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b681305-c789-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763805347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763805347, "uuid": "30e8c740-7969-4eef-970b-ac95937d90a7", "comment": "Malware payload (Mirai)", "value": "383202739aa908b3a52d9f2186b351d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763805347, "uuid": "a25c0dfd-4a76-48d7-8c17-0eeb622e76f9", "comment": "Malware payload (Mirai)", "value": "493b84a1f016972afabb32695bbe869635a74a3323f983250ac3e1084ec98c59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763805347, "uuid": "d3f632ef-9093-4e78-ba31-4f7d639c5bd0", "comment": "Malware payload (Mirai)", "value": "732cc19530ac410012d0a178da9ef2aad5814c04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763805347, "uuid": "d1947935-91b6-4626-8274-a9cebc122c50", "comment": "Malware payload (Mirai)", "value": "d409c2a7e98ab9d4004c7395109a58b0ca2cd0aa5a1e0b8a4afad18db468881c7b76c1f4d54cc4777a40ae7e9e75e05b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763805347, "uuid": "26e86652-0946-49ba-ad4d-e239140c094d", "value": "T1F9C3C61D7E215F7DF3A8823443B78F29AB9823C626E1D685E6ACF5141E6034D181FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763805347, "uuid": "d2d34a6f-561c-46b7-a137-a8f3844f26a6", "value": "1536:5GA/SmaNo74vq8O4R6rGtQOGA0/V74uTZERIkK+whoehSdSZenKemHBnk:77ovq8O+6uGA0/VxTSIkKTHeMBnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763805347, "uuid": "9740800a-5aad-4e86-9658-c836ea5e6f20", "value": 122912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763805347, "uuid": "5e90d740-f2bc-4783-aa50-a16bd879a4c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763805347, "uuid": "b7b49e99-147b-4fa2-b587-855b05d2dd71", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a966a004-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855702, "uuid": "934aba03-18f5-4af5-b1df-796a433b59bd", "comment": "Malware payload", "value": "68b33fb9a1cfb776ba3c12185ad75ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855702, "uuid": "2ecafca8-798e-4b9a-b76d-dadb34f8ac5c", "comment": "Malware payload", "value": "4996f3da497dd085f155cd14e0485c421cb6f983b0590b355a92153855b474b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855702, "uuid": "121ec592-b6a2-4d1e-8010-d37703f0493e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855702, "uuid": "ba553e8a-ebc1-471e-937d-38e675d594d7", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855702, "uuid": "8cb8e736-c676-44c8-8ce4-f26c974a6e2f", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855702, "uuid": "3b01776d-11e0-43ee-a424-2d4e1baf92c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855702, "uuid": "96195efe-f7b0-4fc4-b8b7-b059cab5e31c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a8d8e-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855704, "uuid": "06c534f6-e215-4183-b974-796235e8e1ba", "comment": "Malware payload", "value": "ef928fefa9dd2134bc05d2b32e2c6e35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855704, "uuid": "ed1abc87-9656-47a9-8177-1b45690397c0", "comment": "Malware payload", "value": "499cdc3e64e3b6328f6947e9482e1030f93dbb748a1e68e36b64dce03a821a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855704, "uuid": "8135046b-21e2-4c0e-bfe8-306e8b69470b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855704, "uuid": "a2a9b45d-08d5-4f17-aa87-322a3db1895b", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855704, "uuid": "a38bf963-aadf-453c-baf3-a857b7b6a3a6", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855704, "uuid": "631e7f3a-19ff-45c2-92f5-0bdba99f6a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855704, "uuid": "39bcf682-ef2a-407b-ba51-9659764ccab7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab41661c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855705, "uuid": "ed42c03a-197e-4998-adef-ae0499234774", "comment": "Malware payload", "value": "d63973feeed4a462be8dfbc08ad38959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855705, "uuid": "fc9d8483-9ad6-4de6-825b-c9ae04c53690", "comment": "Malware payload", "value": "49e1d1b21e7c51ca2790496b6eabb0cf562e37f12f9794682360031d6cca0c8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855705, "uuid": "ae8aa287-65b3-4380-981f-b3208af744ed", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855705, "uuid": "24b8b9b9-c046-4e01-bcfb-9ff97dad26fe", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855705, "uuid": "89b29921-12a6-49d1-b064-3848d1f6e8c9", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855705, "uuid": "1089899f-fd0f-4bee-8daf-e796ff999185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855705, "uuid": "0a7425a6-3567-4f40-a1f5-fb748b8419ae", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cc0cf6-c7e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763845019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845019, "uuid": "053827e5-4140-4261-ad6b-32a16cd44760", "comment": "Malware payload (Mirai)", "value": "7e28c4927c5406e1d02f53e1fcf6b6d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845019, "uuid": "2c8f4d93-2627-4237-aecb-17deb25c7dbe", "comment": "Malware payload (Mirai)", "value": "49e46469add46dacbf4d09f6f2a080f0ebf0beb5ffc7d1903e8043db67b27d25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845019, "uuid": "f9032250-f710-4d88-8da2-f23e5ccb50c2", "comment": "Malware payload (Mirai)", "value": "0c36a8cd60e513049620aa15b31ab0f22f9ba564", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845019, "uuid": "d0a147fe-5478-428f-b851-4bdafc0e49f2", "comment": "Malware payload (Mirai)", "value": "05d250afb7d3239f44b6a05297083b9877e140fd2a84b127ff5c01c25d1606c0c69f45e8935cf1f23b0826f4c1b6ef20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845019, "uuid": "456278f4-ea93-4068-b175-df1217bc5225", "value": "T15C63026B9036DBEDC8EFA2BD9229C150F7EB8D50D9A14B3BA5D048AF056EED71F10410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845019, "uuid": "0eff521e-24b5-401e-bb6f-876428d0740d", "value": "1536:kiyrQ7XUNElA5qwxzIe5/7muj0e2Yj357sCcc2Edn:LScS5qiUe5/7Rjp2Yjp7CUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763845019, "uuid": "1875f816-3730-4f88-908e-5d1ca45d8ceb", "value": 69332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763845019, "uuid": "b7286573-10cc-4cd8-b2ff-3b3329197db3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845019, "uuid": "3573a2a2-ee94-4628-a70d-42dce8d3e005", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2a4dad-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855707, "uuid": "06f0a79c-f3e7-4aa5-b27c-98ac6075b100", "comment": "Malware payload", "value": "a9c16362db9fe2f11b8e6c0a73085cb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855707, "uuid": "960fa727-652e-4641-b01e-ab1c1c6fbc15", "comment": "Malware payload", "value": "49eb22e60d58039ce63f9e5b9b9b936e8c1d587aef71c51bed077bc0cb8ad232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855707, "uuid": "449535f8-dcf5-47fb-8b01-e1e91d0e0ffe", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855707, "uuid": "f88078d2-19c7-433f-bcb7-fab1edaa6514", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855707, "uuid": "c54dd824-9de7-4c76-810c-c6bfdc6a3c84", "value": 3281408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855707, "uuid": "5d8baf6d-bf8a-4d32-b695-4513eb6a5334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855707, "uuid": "43cbabe9-42f5-4b41-aea5-e3c475152c48", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0720a3a7-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763853282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853282, "uuid": "c669dbf9-cce9-4077-97df-9f1ea33319d7", "comment": "Malware payload (Mirai)", "value": "1386964d326157af5d0152cd536e49bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853282, "uuid": "31f97889-e7ca-40c1-94ba-a4962605af7b", "comment": "Malware payload (Mirai)", "value": "4a1ff518144fb833042d07a70c66cf7badb9c9f44a81e50e05fcb6923b8d6b81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853282, "uuid": "8d299594-545e-487c-bba1-cee567882523", "comment": "Malware payload (Mirai)", "value": "2bbea7c46c49b9c9808d07c8c73f288591b31cd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853282, "uuid": "cf54b333-5d11-45e3-9b4a-3a8db5d11499", "comment": "Malware payload (Mirai)", "value": "fda5438195a42c4a09ba90d6b0e97cc17418ff1b330408ceb98c1013a67e10de4adcf2bb7d21f690d2810ee7b8c8b77e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853282, "uuid": "68531e64-9611-4c12-bfb0-cac6d6d8e26e", "value": "T15EA302EF868940CFEC4D2A71A23F46CD73D13DD238BD4769B5888BD2564DF022584A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853282, "uuid": "95ca80f2-724c-4c25-b71b-e9608a603488", "value": "1536:jKUbFl1w8IvmaaG0ekeqjhl31T+PxIGMTVfAqMjFt+a:zFl1w8hBjhl3QGfAxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853282, "uuid": "1557db15-6695-4949-8fe9-35d62a7b7a92", "value": 101660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853282, "uuid": "2c52146a-f8b5-4dee-bb4e-462f798376c6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853282, "uuid": "09abac30-a0ee-4e65-9d4d-e2eca4bd47aa", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0406bb-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855708, "uuid": "7cbc3ebc-19fd-43a5-a581-3784bbd992fc", "comment": "Malware payload", "value": "ad906985e746f92d0d4358893da01dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855708, "uuid": "0c3d96a7-48e4-427f-93f8-bb8c6700cd94", "comment": "Malware payload", "value": "4a49ed6fe17ab2aea1c427bba88e30add57d618b313d675cefaae8e69583d65e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855708, "uuid": "50195d06-2031-4895-b670-cbf2f4b2231d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855708, "uuid": "7818f1e6-7b09-4a7a-b693-bc6a88b04354", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855708, "uuid": "d5901dbc-20a7-4d33-b73c-d3e67a551b0c", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855708, "uuid": "eed9983d-4330-40cd-b09f-9a1ac0697325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855708, "uuid": "f89a09eb-a3fe-4418-96e3-c436110e0d1c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcaf1ff-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855709, "uuid": "173279b1-3162-4c81-a2f7-27b54f626459", "comment": "Malware payload", "value": "a2a8aa15b64fb31b165896ae978185b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855709, "uuid": "72485879-4ab4-4b25-8860-31748b5406d6", "comment": "Malware payload", "value": "4ab9cd12039cb73cb62cabf819b39166f96c3864fb8daf2595fb41ff82b62334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855709, "uuid": "b36b56f7-ca6c-4bad-96fa-f2d5b10dd245", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855709, "uuid": "f141e024-d226-4280-82e8-798d72039ba9", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855709, "uuid": "848b64ee-5241-445c-9b4c-ed062cfe7ffe", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855709, "uuid": "d9e79aed-bb14-4812-8607-6e1353040ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855709, "uuid": "f18fe8dd-50ee-4a0e-b2c2-02cd5aa7519c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeab556c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855711, "uuid": "88fcf27e-4d04-4ffb-b1d9-d86b019bb872", "comment": "Malware payload", "value": "ce2c7e8fd6d4ea0bfebf8fd0d1f9754e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855711, "uuid": "f9b16b10-cdaa-4e3b-82d3-aabca8cc3424", "comment": "Malware payload", "value": "4b0d5d9036d455de21e0137177fa25192b0276f9df6fe7e6361b723fea14dde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855711, "uuid": "2df9fc47-5469-45e5-a584-cb1798107b17", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855711, "uuid": "dfd28304-2dc9-4117-9d2e-6c40acf3b2e7", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855711, "uuid": "7fe99fe2-2b08-4131-a72d-a9f0b9232e4e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855711, "uuid": "f0610371-57c2-47b1-aef1-a6d96819a51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855711, "uuid": "ada6e6af-4b46-48aa-b1aa-fceb080a4517", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfaf767-c79c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763813696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763813696, "uuid": "b1fffedc-2090-4ebc-8dd3-9f892236ed0a", "comment": "Malware payload", "value": "e421cd973072440a230d9a259b184e75", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763813696, "uuid": "9e16921d-b378-422b-b1e3-a1796c0f7a9f", "comment": "Malware payload", "value": "4b60235adbed0380f8d11f1b5c13eec42a2e8fcf42f75d0d802eefe273e2f717", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763813696, "uuid": "19f2ce6f-c8f1-4526-992d-cda9e42be223", "comment": "Malware payload", "value": "07737dce04d7f61ca0169961cd6bcde5e69a155c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763813696, "uuid": "f658788b-585e-49cc-b590-d74589d0caca", "comment": "Malware payload", "value": "2e93242e2a20eba29a39401384f527416069fc3ad3b0edbee14f96a702dfab478c73f8785acadcee3bb0fec84cdf56b2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763813696, "uuid": "70285c0c-0206-4fe5-a215-05ee72a93fe9", "value": "T1CA01DBC842615673D34CDE1FB693807E422AF2CC50261BD4F9A746798680BC5F518A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763813696, "uuid": "40e94bb1-7c6b-484f-b47c-379d034ead6a", "value": "12:KhI5W3CtI1/TbN/pBwBt/G1npLOhc/U26/AliAE//hqlHW/zoJi5/I3bQW/5ecr:KOQyS1bbjB/1npLOZEliAuqlOoJFbCcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763813696, "uuid": "4acb5fde-a1f1-4fe5-a90a-d508b7c57587", "value": 790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763813696, "uuid": "8d5d7ed5-4ab8-469d-815b-49f0f059fd79", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763813696, "uuid": "6553dec8-4e5c-4b03-a127-af96c7d70199", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8ab8a8-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855712, "uuid": "aa588fdb-104a-4b36-be0a-1b799847512b", "comment": "Malware payload", "value": "069f1c44ddbf4e2f2c1b8cdc12928bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855712, "uuid": "5acc57b1-b6c7-459b-a098-351dcf06e2ba", "comment": "Malware payload", "value": "4ba0c4cacb23a87130a08032a01631e9e75bad817f8a03707675f31fa3455d15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855712, "uuid": "17a78780-5717-47aa-9732-ae8410485143", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855712, "uuid": "3c4adba2-3c49-42f9-8c9f-b2e37dc6cb54", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855712, "uuid": "ee2007ab-c5dc-4ab6-a65d-de21dccac67f", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855712, "uuid": "3e046e2b-855d-489c-a810-6c11fca06fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855712, "uuid": "df584f14-c4e8-4ed1-887a-8c7efdd75451", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b059aea6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855714, "uuid": "346c64b3-ccb3-412e-8aab-de8df713353e", "comment": "Malware payload", "value": "b95ec858ecd1472e8a402bf4fcf62695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855714, "uuid": "7fb2c778-261b-44dc-a437-20fe731112f6", "comment": "Malware payload", "value": "4bd52874e4a97ada95a857b5c060adc1b1941cabddb307822c95dddeeb76e712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855714, "uuid": "8f22a8f9-bb85-43a7-8366-e255073aa2a5", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855714, "uuid": "1b2e6b87-7604-4839-8f9d-feefa5f8fb15", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855714, "uuid": "7338d3e2-77b0-4489-ab91-50092f702a60", "value": 143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855714, "uuid": "81ba5e4b-8426-45c6-9e07-de551ed3f92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855714, "uuid": "506f44db-850b-4771-a4cd-cfbc23214883", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b124952c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855715, "uuid": "926925b3-3c8a-4f49-b0f4-e22c4f687f81", "comment": "Malware payload", "value": "38b0cac13a7230fd691e6bf5834ff088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855715, "uuid": "b9d9a90e-3aa8-4c00-ae87-0469a37bf92a", "comment": "Malware payload", "value": "4be78a16f07bc263ac6732014134b840e91c1bdc14d36d6650226000583e8aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855715, "uuid": "e1c8f27a-96f5-4f33-91f7-52b75fbe58ef", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855715, "uuid": "e88ebee6-dde8-4a44-b85c-5cbe95e17c21", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855715, "uuid": "6c6c9b23-7e18-4694-9800-daed32c1f3a4", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855715, "uuid": "4367c467-745a-4daf-ad41-c1e6d18cbcfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855715, "uuid": "b186fcc5-3e9f-400f-8ade-9fd41350f9a2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21be585-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855717, "uuid": "01741bf6-0698-487e-99eb-b8e089ee849a", "comment": "Malware payload", "value": "f7eb850bd10db190aa727edb1cea68f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855717, "uuid": "946a8848-de66-4579-8934-5d4b6cf2f5d5", "comment": "Malware payload", "value": "4c0f41430ae374c9b9ddb77835ee6f254b0456c4350afe4022ffcd9df5b8a05c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855717, "uuid": "2b6874ae-3714-4beb-8559-38ad6fef3a04", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855717, "uuid": "0081ae7e-ac94-44cd-aa49-b691fbe47fe5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855717, "uuid": "79c278e5-09d7-4249-abc4-0d57ea366fa3", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855717, "uuid": "7ceba052-f9fd-4b3b-b3d5-e9dc30ef8127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855717, "uuid": "39b27847-a318-4ebf-8bd9-5b78e2db427a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f9cc7a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855718, "uuid": "5558ca19-5e22-432c-931d-3ebf0ac8c74f", "comment": "Malware payload", "value": "5c6b4c155214f586253cd53782275500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855718, "uuid": "f8776437-4911-4c3d-885f-27a1b46d3d8d", "comment": "Malware payload", "value": "4ca7e9a5b36b2694bb54c542e82d4a67deefccdd8baacc72d520b026c5ddf96e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855718, "uuid": "eeb89ddb-b93e-4adc-bbdc-fef392ce3a5b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855718, "uuid": "38be78db-b4e8-4f47-ab23-01a4c7d7806c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855718, "uuid": "c836d7ea-a321-40a4-8595-94c982ce0fdb", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855718, "uuid": "1f348a8e-3dc5-4704-80c1-50d4662c78bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855718, "uuid": "ed4b38e5-7fb1-48f0-9fd8-3c5457540314", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ded912-c7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1763816964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816964, "uuid": "1fec6cac-b8b5-4fb4-935f-52ba57387ef6", "comment": "Malware payload (Efimer)", "value": "963782a9916e2255bd065f6482ce3278", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816964, "uuid": "e42003cb-3600-43ea-8f1f-eec6c694b405", "comment": "Malware payload (Efimer)", "value": "4cf52772ab3399f201289e6a83af771daf98473a50ecf832adfad56a367d20b4", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816964, "uuid": "863af2c4-b314-4e73-a855-6c59893a317d", "comment": "Malware payload (Efimer)", "value": "df0d11f3f699a5cc1af0dfe986b058ca023371b7", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816964, "uuid": "35db5421-9b3c-4db3-873e-b8c8788129b3", "comment": "Malware payload (Efimer)", "value": "371ae70f6bc73184037f051598c279932c810b7345a8cbc9204236478d80d79ed1f721ffab2766fff26bb93a6d660e81", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816964, "uuid": "9e72ce00-0162-4896-aecc-30918e314eaa", "value": "T15BD6339469D021FEE9B35079EDE2B981FAD478760731C5EF02A842A1BE632D00D3E717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816964, "uuid": "c7681149-512a-44f7-81f0-25ba023f1163", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816964, "uuid": "0e4dad36-0485-40cb-83f1-2c05b2bbe4b3", "value": "393216:hfbya3UWe4AsK1VFxUlXMCHWUjAcuI3/PjuUwR:h2mW4AsK19UlXMb8VH/rAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763816964, "uuid": "1272c73d-7fb2-4e89-bd0a-77014f31bada", "value": 12623075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763816964, "uuid": "ced67c14-8e91-4ca2-99b6-8e2f0fcb53b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816964, "uuid": "2596a81c-97b1-4182-9323-7e513119124f", "value": "a\ud835\udc53\ud835\udc61e\ud835\udc5f_e\ud835\udc1ff\ud835\udc52c\ud835\udc2ds_\ud835\udc2f\ud835\udfdf\ud835\udfce\ud835\udfde4_\ud835\udc54e\ud835\udc4f_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b758b041-c795-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763810628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810628, "uuid": "b722376a-2639-4b4d-ad1a-0f20b2d80b1c", "comment": "Malware payload (Mirai)", "value": "05400feac87220b82f7a84c573ad4bce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810628, "uuid": "028a651e-6111-4b11-807a-c940d148580c", "comment": "Malware payload (Mirai)", "value": "4d0b6e8b3fb554b2075b0c7e17e74502edf96952f5a52d775a88f5ade59bf086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810628, "uuid": "5fb73d56-4f52-40c4-8a01-94db45e114e0", "comment": "Malware payload (Mirai)", "value": "c9fa0dc622b2cacd73ec8e8910e22ed311b827f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810628, "uuid": "ee6a5306-7653-4ba8-bf5f-292888ddff72", "comment": "Malware payload (Mirai)", "value": "ec3236798bb826731eeca4282d148fef8f2edf669895bf4fa49c5192e28db7c8ec0cca38070d275f321efd5e2866f641", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810628, "uuid": "e7c4c1bd-e584-4490-81ca-9ee17ba68807", "value": "T197B35C16FD919B11D5C056BAFA1E418E331347B8D3EF72125E206F25638BA6B0F3E906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810628, "uuid": "9397af28-d4ad-4990-a5f9-8898524cca1d", "value": "1536:PJnHcH3hVqWKuiZ8nbXeGDOgFPe55WdWLGa4W0ah2dLidCA2DAT7wlYm1emW:5U3hYu3buB5wdWLGa4ECA2DATElw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810628, "uuid": "0e3b31ab-427d-48bb-981f-d25db47e4f6f", "value": 107732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810628, "uuid": "e9e0ebfe-fccc-4aa5-bd00-139cfbe41548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810628, "uuid": "2f37c82b-a047-483a-a081-f3dbdcc3e530", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bfcebf-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855719, "uuid": "a0a192e0-650b-4951-b9a9-a661b18c138a", "comment": "Malware payload", "value": "cc91dab1f9313e694198b3d7f3c704df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855719, "uuid": "1474c3b0-6ef8-4aa6-9084-0906c94b748e", "comment": "Malware payload", "value": "4d0cc6010a58a2aa9cab880c750180424f45ed8c678d973b220e7517e7f2fa67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855719, "uuid": "a62c2b3b-ad16-47b9-9f7b-33e36c1b2401", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855719, "uuid": "19fecca3-9ea9-4a23-8cb1-dd3c7ff0476b", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855719, "uuid": "9f0a4084-268d-4400-a2de-397907be6214", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855719, "uuid": "382bd535-1fb9-4a91-a646-56026f57a741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855719, "uuid": "28cdb28b-bbd3-4fd1-98cf-d9c9d6670f39", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4557c49d-c75f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763787244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787244, "uuid": "b82d2909-60e1-47da-971f-d16e21a8df9a", "comment": "Malware payload (Mirai)", "value": "6934f5b85eb8d47156e9b116993776be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787244, "uuid": "5634c8a7-bf2c-4f31-b4e7-776467a75365", "comment": "Malware payload (Mirai)", "value": "4e2a7d8ff0fd193a59efb1530c21b8280de20f2ae6580ccd9a376ee040b5e18b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787244, "uuid": "0fae5a70-e321-4b3e-9136-329e08087360", "comment": "Malware payload (Mirai)", "value": "58ada8cf65164dee4ea1907774d21207f429334d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763787244, "uuid": "ac3a7830-fdbf-4d73-b1ca-ff8eba243a76", "comment": "Malware payload (Mirai)", "value": "7e702ec8aefb6c7e1e52decbbb561a01854093e3a5d0cee8fff9c756a949d4179a9448551d56e4e030574e5e9306046f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787244, "uuid": "63bb6bc2-5280-4b5c-8604-ec7920818ec4", "value": "T1C1F3282F358591F0FA411B74ABCBD3A76C790BBF1099909F6B416329B6E0B77A02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787244, "uuid": "689a8c28-ba46-4e96-a4bc-ae6c9fdd056c", "value": "3072:vtkEH5BkBG6AHQICYM7s2K1bZk7GqUkkV86DEObNqRzYFNerPYfn558nUXu:veKn6Oj6iqpwjBeMne0fn5GUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763787244, "uuid": "e16781fb-d386-4ca8-9bee-bc5c12eadaf5", "value": 172660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763787244, "uuid": "730f484c-7ee1-4593-b4f6-bd45579d3270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763787244, "uuid": "6ace5826-876c-4169-a904-6e56e8a8d4af", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4959825-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855721, "uuid": "b4ba0a76-dee6-4adf-9a56-1c17bae7ad84", "comment": "Malware payload", "value": "581f1fcc683cd8f8894d9d78d48015b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855721, "uuid": "3e16077c-d329-4e2c-a49d-2ba45d5c80ee", "comment": "Malware payload", "value": "4e2ecf06d3e9ccf97e5e0544d9a97014c90478651826e07ed2c708d2328713e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855721, "uuid": "1a687f0e-234c-4add-8f34-b9395d82b64c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855721, "uuid": "d533219e-d757-47eb-9fe7-765fee365b37", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855721, "uuid": "a64cc980-8edb-43f2-9219-b87b23ae300e", "value": 3241472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855721, "uuid": "5068d379-07e0-413e-b70d-5e40f946587b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855721, "uuid": "0b908a6e-4782-40c8-a2ec-3d562fa81daa", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55d3306-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855722, "uuid": "b33efebb-2637-46d1-b7e6-ed2b500fb346", "comment": "Malware payload", "value": "d1da11624ddd46562ab3c839fc728900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855722, "uuid": "089dd0ae-07a1-469c-bbf3-9da37ab4ebba", "comment": "Malware payload", "value": "4e33b114d72d0a03d3c457637a7f1e2f037d2f0a33f9cfedd3f1c34553362f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855722, "uuid": "367810d6-d78e-4f36-a92e-eab3cab93251", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855722, "uuid": "110c90a2-7f73-4d94-ad07-db00591d7218", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855722, "uuid": "9ae232c5-8401-4b4c-8054-b65d6aed28cd", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855722, "uuid": "a6c4e8e7-a07a-4963-86ca-68ad503fedb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855722, "uuid": "336912ef-14f1-4169-b56f-059dc61e8da4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43ef2d9-c7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763817173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763817173, "uuid": "f6c896a5-f158-402a-a2e8-2e693c7dd319", "comment": "Malware payload (ACRStealer)", "value": "ac11a35113c44827c4c5d16c2acf0d83", "object_relation": "md5", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763817173, "uuid": "e76c2271-7126-465b-a7ca-1c05cb753b57", "comment": "Malware payload (ACRStealer)", "value": "4e40b1bff6dc6bcbd0dffc32f09b9dcdde01127df39fce5e54f8437dc080dc65", "object_relation": "sha256", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763817173, "uuid": "f507e3c5-10dd-4000-9103-907d3e4b9e55", "comment": "Malware payload (ACRStealer)", "value": "c8762f026e7c3bfe63acb327906ec3af8e9a6049", "object_relation": "sha1", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763817173, "uuid": "9e5bce9a-9cd8-4708-afc9-9fddc3d888ec", "comment": "Malware payload (ACRStealer)", "value": "3a037438ef2c939861f787d4d7ba27a488d207f90c33b40adcbfdd8d527e907e5a9fc01ac4d90aff3571c59d5ae4b49d", "object_relation": "sha3-384", "Tag": [ { "name": "157-180-40-106", "colour": "#50AB40", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763817173, "uuid": "21cc0d98-46de-4638-b473-755617a5ea44", "value": "T1CD4733F4CA49B633C9665F3C291012C63C9446CED71EA30EEBA4544778DEFB3E9A8254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763817173, "uuid": "69a69bd7-e483-4dae-883b-cdf4fd10723b", "value": "393216:YvgOBaqP3RIljmvz3e4XklFXgpOnUJIu0Z0m3F/cIepsaUwv8qv8HlgYJrQ9pGGB:YvgrqP6ljmbDQZihI+sKUHKYhOV8z2hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763817173, "uuid": "e44e5546-f62a-4127-a863-307aeca8d2ab", "value": 24609364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763817173, "uuid": "b61486eb-1a4b-4aaf-8282-3982b1b07838", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763817173, "uuid": "fb7e4734-874d-4636-8b53-06a9241ae405", "value": "set_up.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a207357-c794-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810150, "uuid": "03592f3f-a5c6-4413-8b20-f3834158c7b9", "comment": "Malware payload", "value": "832c9f281a935b6e10d6707fa71db2a3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810150, "uuid": "30e45329-a974-4c66-bd1b-4cfd9b695e62", "comment": "Malware payload", "value": "4e4d388ead0fc2a60aff7dcf7cc391c124e0b1d2cf7bd9950bde26b8b0715815", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810150, "uuid": "38cf800c-f7f3-49ab-a44e-a8880b30f6c5", "comment": "Malware payload", "value": "3c1f51f08b094fc0d548779bc0f6757b178f7c1e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810150, "uuid": "f03a7282-5f2f-42c5-9844-f3b1979ee84e", "comment": "Malware payload", "value": "1fb5ca7d90b6b7f7730d006bb6c9ca336fa70ba2b909ba42b73a1e4207f41b654100ba4d9543ff25fd52dddef71d5c3b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810150, "uuid": "2b1863f8-a3cc-4779-8860-9091dbb5eb52", "value": "T16CD52243F775996FC836C1726946173621164D28C646FF8AA8843BBE38BB9EC0F487D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810150, "uuid": "e016debd-f1ef-410d-bef5-97fec1e2351f", "value": "49152:MtG3k5gssA/c6brwJ/6fLvxNrngtqkMcctoXcDAmom0eQTjkyNGLeb:MtSk6IdwJiDZNr2cmX/momPiARLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810150, "uuid": "ddf2b713-6c7f-4c87-b110-5121a849a72b", "value": 2745080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810150, "uuid": "4d92442b-8b07-4b4a-92cb-764ba4107770", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810150, "uuid": "e7b68317-761e-4418-b35d-e3ad9dd97191", "value": "k1_351.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce931ad-c7e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763843602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763843602, "uuid": "c95d9859-958b-4e0a-974d-fabe08d0f465", "comment": "Malware payload", "value": "3d98bb682cb93456d69c356bd86369e0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763843602, "uuid": "a657c732-c088-4811-9a45-a26f13f2dd57", "comment": "Malware payload", "value": "4e67e4de54c5c7cd45ed85d4069ce384b0533950755b0924ec37463180947019", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763843602, "uuid": "a2472cec-7bc4-445e-bce8-3f885668bb2c", "comment": "Malware payload", "value": "cec063cb22672d46f59b9e1c2b66be45089aceea", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763843602, "uuid": "6e64ca3f-d15e-4072-9991-c868e1e32f47", "comment": "Malware payload", "value": "94feb9de4956bbb4f177ae0fea79c513cc30d6f65682f58e54050ca26788efb4a56d448dde908150f9ea12da2f64a906", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763843602, "uuid": "65f95a24-8ad5-484f-95fc-d104307e868a", "value": "T19744F79463F84600F6FF2FB9A9B141214A77B853AD3AD70E0989548E1F73B81D861B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763843602, "uuid": "9e870790-e046-429a-81ca-e9f517635323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763843602, "uuid": "0f985c81-ae90-47c4-b8c7-3e2f3b126d7e", "value": "3072:H7P9Z57qvGZMt9zkxt0ptGNbHmooG3vsp/rsMvP2mfRfLw+WjJf3h5be0alFZUaT:DZwGBHmonfsptJRfdmJf3rbSss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763843602, "uuid": "459855b5-bf8f-4f13-bbac-f55b84eb4d93", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763843602, "uuid": "10a18e13-4d97-4048-8be2-3b0140406f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763843602, "uuid": "de86530d-25df-45bc-8ba7-c2a99795e72f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d674ddc2-c7cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Kamasers)", "timestamp": 1763835591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763835591, "uuid": "1af24b45-d4c9-47fb-9a4d-83f0b815b331", "comment": "Malware payload (Kamasers)", "value": "ee6e30f6c6c5308e96adf32fa676e4c3", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763835591, "uuid": "1b38c349-4985-4004-9800-f3edc8f28c7d", "comment": "Malware payload (Kamasers)", "value": "4eac03e26bebde5dda5879a105f3f8b3d8b8f46d5f47a0f3d631d41239ef3dbf", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763835591, "uuid": "35f92ddf-24de-4fb2-abb4-ffb79cffaee3", "comment": "Malware payload (Kamasers)", "value": "5bcf1d05fcdc39f73132eeb160a07d4e07a0588a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763835591, "uuid": "704722ec-6ca0-45b6-90b6-92a8feb3597f", "comment": "Malware payload (Kamasers)", "value": "63e94a2f35150eee2292c81fbd8006a17e25abd0fb9f812cba0fc61cd57e7417c9b1359f43a9b2eec4677841613da9ec", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763835591, "uuid": "3251c18b-9e12-4baa-acd6-83fcfde8793d", "value": "T1A075238657D43022D4A923B648F386974F31FC416BBAA2EF27C2D12D5DB3ED09471B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763835591, "uuid": "10105f71-785c-46bb-88c1-9ebc8cf826eb", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763835591, "uuid": "d857390d-6d9f-4ed7-bc5f-33d5d83eefb5", "value": "49152:ajv0ubaAeql4gxmwWw1XDggbgahLa5HP/yJB5:JubDl4gQTrLahLC6D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763835591, "uuid": "bb208473-bb55-4bce-9354-43d45616a5e0", "value": 1634304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763835591, "uuid": "0aa77255-94ea-4ca4-92fe-29d48325492d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763835591, "uuid": "60c5e152-9ddd-4c58-9971-f5fefe23292d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43086333-c7bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763827613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827613, "uuid": "cd16b37a-dd5c-40e3-ad8b-4baf0eaaddbd", "comment": "Malware payload (Mirai)", "value": "5af740321c661fe9467b9ea2e5533651", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827613, "uuid": "0fb3c2a8-5f5b-4621-977c-a999d50666d8", "comment": "Malware payload (Mirai)", "value": "4ef65aae2ff6c97894ab45f0ab3045d59ec407738490017f43e5650741461d67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827613, "uuid": "620da717-1320-47ec-912e-8ddab70bba32", "comment": "Malware payload (Mirai)", "value": "2c309f79ea93ca442118147a775a77171564904f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827613, "uuid": "414d7dfd-e353-440d-97be-2ac9b248f08c", "comment": "Malware payload (Mirai)", "value": "70086df5a1fd72a558c8b1aaf5daa567423c709fb79ca2b3e8df6cdc9cbeea86e80d670d82995942b1f4cfcd5fb2581d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827613, "uuid": "aa591446-df3b-4aab-b7ca-274008d916ee", "value": "T173149220FA0663B1CC720A3897956E5A6E7B04559FEB26312D1F633DDE628509F30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827613, "uuid": "99c04a1e-aabe-48bd-ad07-3017aa4345cf", "value": "3072:lPrToLY5HFoT4QwwnKWVoCBSRlf4RB8p6xnUKc:1r6IHUZwW9qeRQIUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763827613, "uuid": "101cd47a-fb2f-482c-9bbb-8ab364a1fecc", "value": 197268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763827613, "uuid": "5bb2bc5f-25aa-47aa-b8f8-1ae6fac6fa62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827613, "uuid": "d36da8ba-c57c-46a5-a5d3-a4eef8514e0c", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7107845-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855725, "uuid": "aefc2ec4-78de-4f7b-9c60-5b6444d2555a", "comment": "Malware payload", "value": "408671dadea67c02802f71649b5e5c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855725, "uuid": "6d785214-e62e-497c-851e-51afba55499d", "comment": "Malware payload", "value": "4f5f502d6702fa49440fa89ae93c729125629f2162f2d860a484a7fac0d82ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855725, "uuid": "c58b2f6e-d72f-431c-9a4d-b2244d88d29e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855725, "uuid": "e71adf1f-c1f2-46f7-87f8-88f537dcd568", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855725, "uuid": "ced243b8-92e2-4fd0-b1e4-69407e6bf84a", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855725, "uuid": "8efde1ff-15c0-4914-ae94-799bf1f2e70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855725, "uuid": "eaeabbf5-60d0-4d24-91db-b93c5830a883", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80235bc-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855727, "uuid": "bebdcae7-1024-4dfc-af6b-67493dceddf3", "comment": "Malware payload", "value": "b1de80c43d7da5347a2eea66debcb5ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855727, "uuid": "57288ce4-a51d-409a-942c-40f3162ac6fe", "comment": "Malware payload", "value": "4fbd1f7271a1dbf638601dbb1911c093f84f91ea81d54e6f038386730b60d7b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855727, "uuid": "bef9e785-e4af-4dd9-9928-91717e8ac828", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855727, "uuid": "6cab8296-2267-4b0c-845c-f60a2da57e79", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855727, "uuid": "12c6cc80-7ae7-4a9d-84cc-8af05250d852", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855727, "uuid": "d2c05974-5e8a-4427-8086-885280e3dda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855727, "uuid": "5ac58a83-4511-4b24-bb08-825232d11631", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e90429-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829420, "uuid": "54734c12-288f-4028-b8c2-d3ef24ffde07", "comment": "Malware payload (Mirai)", "value": "098a5dc0bfcb030d0c84af85a600201e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829420, "uuid": "88667d62-32e7-4d71-bc23-9048def1d00a", "comment": "Malware payload (Mirai)", "value": "4fe7c8ec1c0bc38038cd295f0e86e4ee82a6acfacf078216dca3ec934b9a9419", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829420, "uuid": "d5167343-66e2-4a63-b14a-ddc5ca88a078", "comment": "Malware payload (Mirai)", "value": "a7ab5c66b246cc7105143a8a3f5c0f67255217d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829420, "uuid": "ae6b1eee-13cd-45d3-9e20-a891d4626e6b", "comment": "Malware payload (Mirai)", "value": "2b28363d4726b93d80ea22a3c33f2c16053c4b4880a960f58b1332326b91df4977212674e9b2bfe26bb2e5476c4acf7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829420, "uuid": "7ce3704f-cdd3-4d42-89d2-d86078cc3ff7", "value": "T1F98302C013A990B74F905E3AE0984D67E23B9B64233E953701DAC3295FF75824F3B669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829420, "uuid": "e69fc73e-192e-4def-acc9-e71188eb2246", "value": "1536:Ct8FuQdhY9pEbuXBe7qB4SujgNM0iNLLYgis15kLjIry7tFp5oE:1hYSuXc7Q4SEC/yL51jryhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829420, "uuid": "2000430a-f470-455a-98e4-390e40014bc2", "value": 87176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829420, "uuid": "50a384ce-cd54-450e-bb82-55d363f098ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829420, "uuid": "5f13ed9f-afeb-43fc-9803-788491a0352e", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d16f22-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855728, "uuid": "261e4495-227e-4ca8-a045-f92692091f05", "comment": "Malware payload", "value": "e140866fa78dea4e5e1e97a6fcaa728c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855728, "uuid": "a6964a05-5d7b-4ec7-9549-226338c933a8", "comment": "Malware payload", "value": "4fed3089faefe4c9f193a07991409117de4c0832765b9b94a486502f1742b7fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855728, "uuid": "67c9001b-6159-4a40-8797-1ca14a6e73f5", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855728, "uuid": "27b22fe8-6680-45b5-a42e-de0e718d7863", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855728, "uuid": "3156999f-d5f2-45fd-b53a-456557e892b2", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855728, "uuid": "2e66bbe1-09f0-431b-a6d6-4b407d809aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855728, "uuid": "76553373-e7eb-4bb6-88da-766a92c01fd0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99a31cf-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855729, "uuid": "6828ef40-f674-494c-b515-99f66e887d76", "comment": "Malware payload", "value": "828bdb65b18cf74a3f2024bd32e93f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855729, "uuid": "e3cfa3e5-b9d9-46f0-ba37-d8aaf24e6ae8", "comment": "Malware payload", "value": "50565d809026e4ae802d9fefeec9b29a68bbe4f2a9d81e881948b58e5c42bbbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855729, "uuid": "6871736c-533c-4777-98e7-c2abc4c54df1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855729, "uuid": "bfef6eb4-4007-4662-8cf8-c1507aa1b2c7", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855729, "uuid": "352408cf-cf4c-4c4b-ac00-176c40001dfe", "value": 2190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855729, "uuid": "b16f81aa-6cac-4301-979f-f91cb894e6c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855729, "uuid": "93f2b374-b873-4e4a-a22b-e5a148b2018f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a309042-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853288, "uuid": "321fcb81-d1de-4fff-8373-c5edea461f23", "comment": "Malware payload", "value": "23628611015d69c6f45b395c19a6cff1", "object_relation": "md5", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853288, "uuid": "039baf74-2315-4491-9d05-9bad485b8f86", "comment": "Malware payload", "value": "50740b44961a3cef4874c163cca492e1fb68802bd0873d97b1b162db871dd423", "object_relation": "sha256", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853288, "uuid": "fdbb6101-6824-46a2-993e-4b0767f15b96", "comment": "Malware payload", "value": "94aa2f29afa006e5fe5accfc7da58696ccc1c0e1", "object_relation": "sha1", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853288, "uuid": "c7e1c4d7-4d36-498a-be8c-4a8dfa1c35d5", "comment": "Malware payload", "value": "88ff77ceab7546480a032aafd9be8b548797cce194cd5e4b27e6ecc20fa39aecc3c87a7b1911ce9db4c4c4d477c3202b", "object_relation": "sha3-384", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853288, "uuid": "5d5a35bb-ac77-4ca3-a19b-cc2e0f3ba5da", "value": "T1092100011B020A998AC1D254A4D5B220A06B45EBB73C24E8F3FEF0411F19A70A3711FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853288, "uuid": "7e11ba68-186b-462d-9b59-b294d4e5a5cf", "value": "24:tDdXPdX2dX6fZr1944ZHv8mDo2mIgx+Tg+y1W830Sf:ZN8gr1944HxVgxGg+y1n30Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853288, "uuid": "edfd25ba-c55b-4183-ae9f-8ed709c1df14", "value": 1195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853288, "uuid": "c72e84f6-1bd8-4895-8f8d-6fc3aca0d8e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853288, "uuid": "9d507415-bad3-4e21-a4ff-4aee69b5e7a5", "value": "Invoke-BypassII.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6f81c9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855731, "uuid": "a4bff61e-6505-42cf-b7f1-15442f172d4a", "comment": "Malware payload", "value": "6a809860c4708c7c7aad2fa0b4a7eac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855731, "uuid": "45433a5f-5677-4d4a-8c95-2535aaae742d", "comment": "Malware payload", "value": "50a6915e6bc15f11b5f7a5ff8a6dc3dce2863baba6a64482dc2c477041479789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855731, "uuid": "c553126a-4e62-42ed-adc0-d29593b872cd", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855731, "uuid": "2c2a815d-07a3-46e5-94ed-b4ba2cb4f768", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855731, "uuid": "5a4393fe-43b3-43cc-b76d-bcd035115db9", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855731, "uuid": "a22bd3c0-d699-471c-a1c2-d658cde6beed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855731, "uuid": "84088672-44a6-411a-9b30-f15459c87b61", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bf2d15-c7ae-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763821276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821276, "uuid": "9cc1b721-41f2-4695-b3e7-394ede46f016", "comment": "Malware payload (LummaStealer)", "value": "25f48ab0c3e22b8405f490b774ba8bb4", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821276, "uuid": "9501ab2f-0400-4116-a526-21168b61f6dc", "comment": "Malware payload (LummaStealer)", "value": "50ae958eeea4e1df1618d0739c93a1c5b7b56946da6d8e8ce3aed17abf3be548", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821276, "uuid": "37d8b3d5-8c73-463e-9b90-3b659a337fe9", "comment": "Malware payload (LummaStealer)", "value": "07ce336b9bb6dc1a1d07859be4864411b5f3dbee", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821276, "uuid": "cd78854b-a6c3-4e1e-9ad0-9eac800edcd3", "comment": "Malware payload (LummaStealer)", "value": "ad8b18d400c0983a3e789ac2bbcbe4bb1723d5da1a88d6f2d2a8ce19089ccd49dfbb557ae469c62216606c2078e7c56c", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821276, "uuid": "a360ea3f-c60a-42d6-b441-01c1a11ff4f1", "value": "T19765230669D870EAD4F1977664F28253A9B338708BA5CAFF52C186394E333C4E172B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821276, "uuid": "075464a3-43ac-4520-a4d5-7de6fbd2d749", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821276, "uuid": "cfb55b8a-07e4-4b20-a24f-7063e03270d5", "value": "24576:iiyk7q5y2ZMUWAjkzKHOl9GZU2x5+76rwHxatd8ZkrrKLlHVdOOrsvz4puFjNVU0:4k72y2ZMTnlX2E6rMac/LlrskpUjNK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763821276, "uuid": "bc9e1367-c531-4555-a038-01f2b2d8f1ba", "value": 1439152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763821276, "uuid": "13c29bac-48f1-4b71-aefe-5a3dbcc8321f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821276, "uuid": "8ee2335e-20c4-48ff-9bc1-aa210cdb7652", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3c3da3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855732, "uuid": "c3d39506-642d-48df-b143-bcc67fd06403", "comment": "Malware payload", "value": "3d179f5a47238956c34c21dae73af66a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855732, "uuid": "0780508a-35fa-4137-9e68-1430b89d6650", "comment": "Malware payload", "value": "50c0e0884b7f6a58289e9b07da99bc3ae37ef56a82c302f27dd1d781ffc8fcd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855732, "uuid": "701816dc-f500-4713-b8b8-a23108e1c2ac", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855732, "uuid": "25d876cd-4234-4c63-8483-1b63b6e72771", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855732, "uuid": "8a2b65bc-a430-45f7-9060-6daf9802bb90", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855732, "uuid": "6f3f607f-2487-4989-a83e-ef66feab94a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855732, "uuid": "2ea044c2-658f-4eda-98f1-329033b5e23c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aac71c9-c7cd-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763834417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834417, "uuid": "14de5728-c368-4c64-aec7-4d9b6513a67a", "comment": "Malware payload (QuasarRAT)", "value": "3455c7d385c241c62995d9101039e811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834417, "uuid": "d03e6e1e-fb1c-400b-887a-a51c60cd13df", "comment": "Malware payload (QuasarRAT)", "value": "511ace09e2e37545e0f12232fb3ad7da230f0c55ea803fa14ae84530257069b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834417, "uuid": "83516490-ffc6-4688-8730-f0283b0338de", "comment": "Malware payload (QuasarRAT)", "value": "1ce474480af6607221a3ec4e0a167f03b8148872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834417, "uuid": "d5f22275-eae7-4fdb-9355-fb0a0fb8174e", "comment": "Malware payload (QuasarRAT)", "value": "3193d4bea730b98b7944f7e4150d569118ad8f72f52d8cb3cfeef5cf30fbb84834152d7369ba309b40f80d69d4d7b278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834417, "uuid": "f2366609-c752-4b97-b9ee-b7d985ef64d3", "value": "T1FAF523DD7120B1EFC817E5B58AA12D749621AC7B47179203A8233DCBBA3D0D79F148B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834417, "uuid": "86dc3a43-d7de-42d3-ae85-40a7ec5c9b01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834417, "uuid": "b16573a7-1258-41ab-a730-f2d44b85cf49", "value": "49152:z+DP6joVqq/KRTSQ9lhp+GMPUdvxzcpNGq3bV0VWiCqU9Xg6YrsoJMdkQNQYx8ch:qDFu19doGMcJzr9IqDeRDNMeBOc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763834417, "uuid": "05f22f90-8ac4-4ad3-afe7-bc2baf29c092", "value": 3420672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763834417, "uuid": "c7297e67-b0ec-4752-a5df-eb7990011893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834417, "uuid": "1a99a5ec-b4aa-4a9e-9c8a-2ff727d6f135", "value": "rTransfer_Receipt_11202025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94184db-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853662, "uuid": "c2bd7d84-5a2d-4576-97cf-53cf8873bc18", "comment": "Malware payload", "value": "3d333e1b4e67bf6e9fc6bdf25634e74c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853662, "uuid": "7cea76e5-9593-4156-8165-44aa331c4f3e", "comment": "Malware payload", "value": "51f8684e02f739efddb89f5eae4e3b1556d0255e3b2942b292732c8cf92f25e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853662, "uuid": "d302ca05-b0d2-4e3f-9174-1420506cb2a4", "comment": "Malware payload", "value": "511078b29cafac728719bcb88984f95aaa8e6442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853662, "uuid": "fa611921-b350-43cd-84bf-26ae55a2b41f", "comment": "Malware payload", "value": "dd2ea0f0691c25416a9019efd185a22b8022212fbea2af23e0598ca2b89dbcc6c699279899613e71c7bf32db858e48e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853662, "uuid": "9f4eb506-d1bf-49b6-b41f-067128e8cbc0", "value": "T11932091F97F88675DC7B4B350EB353C10BB4B3018A46DAE92DCE6C999D52320163279B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853662, "uuid": "29dc2c26-0665-4286-a147-8952781ee9d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853662, "uuid": "e0ddd76b-89b0-43fe-a3be-68e7bdf1f831", "value": "192:3YgPXDjwqxI6+vLiR5LSR0eOLkbLKLsEMjPVKcGqKpJ8vDr9Fz:ogPTEq2BvLkLM0eOAbLKLsEMjPVKvHcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853662, "uuid": "f0077a6f-e8d8-49f3-b23f-481ea17d64e2", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853662, "uuid": "2e53ccf8-aa13-4659-9539-32860e000231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853662, "uuid": "2a334464-3e31-4e3b-b8b1-c2338a5dbec4", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf3aee9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855733, "uuid": "8c3026d9-1220-4366-bc67-55b7b391f921", "comment": "Malware payload", "value": "6c0f826fffb98ddd5ae729dad40953a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855733, "uuid": "91bc00f2-0682-4b9a-b6d5-3430b7c2cbb1", "comment": "Malware payload", "value": "52ba7297d4c62f6a29f941933294f00fca387575e1e4ab258ba208e8b2f9f1c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855733, "uuid": "66f0a6b7-1403-44e7-ab68-fa72ed136518", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855733, "uuid": "e22f76c0-8794-4f9d-9fe8-4cbdeb674788", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855733, "uuid": "238c15b9-c095-45a9-865d-9973080521c5", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855733, "uuid": "cfa8d4d8-cb8f-436a-9bd1-370441f60c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855733, "uuid": "e91ca53d-49dc-4345-acd2-df6a56effe30", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40b41b2-c7e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763845519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845519, "uuid": "57e7dfb9-fd87-4665-ab49-038b4988c326", "comment": "Malware payload (Stealc)", "value": "8a36a0d18a0f23e6a295f9e876ada0c8", "object_relation": "md5", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845519, "uuid": "c702a7d7-2c3d-4e07-8b85-fc4e6815c744", "comment": "Malware payload (Stealc)", "value": "52e05be590754a97574ee5f762fab4b1f84273cbeebf146ce9621071e4d16ff6", "object_relation": "sha256", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845519, "uuid": "e0635912-5903-47a6-9458-b2e8c95cad93", "comment": "Malware payload (Stealc)", "value": "77c46242fd39681eabe9c4b5f315b49b18c2fbc3", "object_relation": "sha1", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845519, "uuid": "fcd12517-812e-417a-b4ca-4e9837c075ee", "comment": "Malware payload (Stealc)", "value": "bc76d72c9d83ec35f824c3db2796fbe0f588b78ba6251ad6be7b91db3c27b67f02519ffa137ccb37e186e03bb6d11812", "object_relation": "sha3-384", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845519, "uuid": "41bc92e2-ec25-4602-8e39-e7bc3ea2ee63", "value": "T186F48D1FF3E501F8C4BB8178C9625956E77A74565370A68F03E009A63F2B650AF7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845519, "uuid": "a53b8cea-60d6-48aa-8e87-a66416e18fee", "value": "112f19f28f55f461c3d7ad7d3898dd7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845519, "uuid": "9bc9e6fa-ef21-4313-a56b-401740b21cf1", "value": "12288:bwVOm41h6aMIChNqge8bNqDVqlPjzad0HC2Wv3YZtF15kjHx:b2eMBThN9eiyVqlPjzU0iH3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763845519, "uuid": "33263e94-6b75-40c2-94d2-48496021f1f7", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763845519, "uuid": "89258e57-f48c-4f73-b09e-af070342e950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845519, "uuid": "54ce9ec2-5452-482c-8a00-d4d8735a4a59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd425ef-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855735, "uuid": "0a2a3908-db0b-4bcc-896a-ac6e052ccca0", "comment": "Malware payload", "value": "44c9e9ef0035569fb25e4e81b69ce7cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855735, "uuid": "597c6160-41cf-4ff1-9b37-918554929cc4", "comment": "Malware payload", "value": "5312ac0e30b9551f52f92d12c4bf9c5c0eb11ff1492fb9bf1a14e4a26def806e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855735, "uuid": "6d071cb9-991a-4a2f-a2a4-7393bdce57de", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855735, "uuid": "d255ffdc-bce7-474a-ae03-26e980425854", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855735, "uuid": "6571c2f3-2932-4dec-b7ee-66643c02008e", "value": 3383308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855735, "uuid": "a66a00db-4b40-4700-a9ef-ae77c9e59f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855735, "uuid": "daf4ae92-7d16-4274-95c3-7dc7616e0a87", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b953279-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850767, "uuid": "d428379d-4fe1-42d4-9059-070719fb905c", "comment": "Malware payload (Gafgyt)", "value": "390561bb126bcfc4c08ca5d5039f6761", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850767, "uuid": "8c484b5a-1e69-4a38-94de-e7ac39880783", "comment": "Malware payload (Gafgyt)", "value": "53570716fb183b4106fb6ffec04596f55358a14e234819013a425d49e4f296d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850767, "uuid": "97f1f1da-4804-4b4c-bade-4c0e0b21269a", "comment": "Malware payload (Gafgyt)", "value": "67efc6ebce4d9f3d9fb8b570a480768d3a7f74f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850767, "uuid": "3ef09698-e786-493f-bd4b-80081e90105c", "comment": "Malware payload (Gafgyt)", "value": "c5d081b4891e1bce3eb4e17d8b49b618b9ff903ad877bd36247061ab8075dca159a75c70ff65b38da0c33a54f4d3f182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850767, "uuid": "c7e73d3d-304c-47d1-b0a9-bbfb899ea584", "value": "T114C31901E4508767C1D3177AB79F864D77232BA897DB33129A246FB42FC279E1E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850767, "uuid": "e03c1286-92a9-44ad-8552-64028f6cce18", "value": "3072:QNJj9a3bj1UxsYA0ay5h1b6FNYqmEQ92tX8Q8:49a3bjCay5h1b6IqmEQ92x8Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850767, "uuid": "775155d8-6142-413b-94a1-51408fa31909", "value": 124474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850767, "uuid": "abc9f9de-6fea-4763-b92b-0da18c5965eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850767, "uuid": "0b46cf26-f0e9-4f22-b77b-6f1bd9c17b43", "value": "Ayedz.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbb72ae-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855736, "uuid": "26c4ae56-7473-4b80-9448-b8cbc57d0fcf", "comment": "Malware payload", "value": "3d76597b755f1b64de16e7bd37ee49c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855736, "uuid": "c8c969c3-1f12-45ab-9df6-79628566945a", "comment": "Malware payload", "value": "53dfb37ef5facf7652ad61994fd7f505f9ae8cec4a26d754ed1ea82143a025bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855736, "uuid": "49d10466-a3f3-46fa-ad03-cf2d7f634096", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855736, "uuid": "44f30b14-2a39-44fb-ac9d-2d1645ac645c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855736, "uuid": "c4f4db58-fdbb-4d1b-a6a7-4c741eeee94e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855736, "uuid": "47725101-0900-4cf2-bec4-780014b92728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855736, "uuid": "43ba0652-8b7a-409e-8a71-dddc24727b92", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be770cc1-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855737, "uuid": "2657e626-d9d3-4e31-84ba-0e3eaca5c7a2", "comment": "Malware payload", "value": "03d04628b43536be46c0446f07f97873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855737, "uuid": "f84e8700-dd14-48fb-b41e-9706a48749ed", "comment": "Malware payload", "value": "54178c49c5beed83b42d5d4f75ed5f6eb56275361d8f5d72a3d5a7489d8d3e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855737, "uuid": "f0eff24a-ac21-4cb5-8360-ed4006379b68", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855737, "uuid": "87264004-91bc-46b5-b72e-8ca4a1ce0c03", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855737, "uuid": "3af5b7db-8b22-494f-a5c2-c5a1f172a6a5", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855737, "uuid": "d3d10ac3-dfa6-470b-9228-61bb6c4240fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855737, "uuid": "ee030c23-62af-45fa-9876-76657aeab6ea", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf85b8e8-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855739, "uuid": "abe3eb74-f868-4a31-9e35-c279921bd715", "comment": "Malware payload", "value": "13c96a366c76d55fd2da84991920ec4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855739, "uuid": "a9c0aa42-666b-401e-9e7a-24f1fc4ed2ad", "comment": "Malware payload", "value": "541d17ad88c1db2e336ced9dd1596abf0ec8ca391d4ec0c4c99b139729a6f817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855739, "uuid": "e7b80d80-f8d4-46dd-afc9-8e40b9312b77", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855739, "uuid": "a7a1875b-67b3-4e7a-a6d4-708772fdf72c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855739, "uuid": "6eb1c878-cc20-43ad-a692-b68713989a55", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855739, "uuid": "a5fba400-4811-4ae7-bb08-b3a6523a0a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855739, "uuid": "42752a02-d8d4-485c-b216-4780b9ceadbe", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc67db8-c7cf-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1763835580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763835580, "uuid": "f096e21d-fe2a-4c37-94b5-0c66d17c819d", "comment": "Malware payload (GCleaner)", "value": "6db0d6ff5b70d61b7dbfe69c2ad637b9", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763835580, "uuid": "e9ed9053-d64a-4b06-9e20-b33d4b91be37", "comment": "Malware payload (GCleaner)", "value": "5431bcc1eaae4d02a3ab680ce495d0dfec24752073ce51fac52587c09357b07d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763835580, "uuid": "6dc572eb-2cc7-47a0-88e1-92884bc4166c", "comment": "Malware payload (GCleaner)", "value": "18cb0d04e61846bc0417ee9ffd98d9bbf477597c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763835580, "uuid": "3be53699-4347-44bc-8536-f56e4bfac1a3", "comment": "Malware payload (GCleaner)", "value": "3c717c72357c1f8a9728e02c6d67f80634d1c6077510f5a85016157dc76646b60bc3ea8076b97c1def24e2438f698ba3", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763835580, "uuid": "969bee0c-3f29-4437-9b6c-cc49ded4706d", "value": "T15AE39E2275C1C8B1E27606315DF8FAB29BBEF4240F515EAB6394067F1F241D096339AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763835580, "uuid": "23d4e48f-b254-49cd-a126-9b559638e794", "value": "f6ce76d7a7ae3c6ce9b592aad4fc4a7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763835580, "uuid": "98108cd9-a99a-42ca-a5c3-9daad68a20e3", "value": "3072:NaLwLdBLuUYAn/6jMkZxaHfv+RNsqeRHBQVybayaIsXSA4MJAUUMP:iUbu/S/6XRuqeBBQyaoATenMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763835580, "uuid": "1afd91c8-86e1-4b19-b1e1-435cdcec19f8", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763835580, "uuid": "b7a88eb4-eef8-4d49-a06d-fbbaf37655b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763835580, "uuid": "cc664064-7fbb-4ea2-b122-519444ff702d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05deca8-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855741, "uuid": "af900899-16c2-4661-96a8-8a765c32a0ea", "comment": "Malware payload", "value": "f8e2111423f741adb38b9a277c60dbaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855741, "uuid": "a7771629-a5aa-4ce2-aaea-70a33c346c14", "comment": "Malware payload", "value": "5442ee2c54decc56299a64e641c5ac4d458b16037b2a1dcc063ec80a095617d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855741, "uuid": "5b77f9dd-ba58-4f1d-bf15-95caabe3bf49", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855741, "uuid": "3ba2febf-c730-4ac4-a27f-904879d143fc", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855741, "uuid": "8c1de66a-f134-4960-b58a-f4fdf84e46b6", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855741, "uuid": "9569bec0-1be2-4bfa-9de7-43442fbdf860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855741, "uuid": "ba1af0fc-a419-4550-b406-9d9ddbcbaaaf", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1424fbf-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855742, "uuid": "e830b4ed-8d46-4cab-9187-ed30b71b84bd", "comment": "Malware payload", "value": "fdc684635ad1588db0cfdf6417fdd565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855742, "uuid": "f4ae482b-562b-41f1-b80c-4bf4c28f510e", "comment": "Malware payload", "value": "5484987250baed8622605cf2a12734de92adf9b6a596d033b1daa68e72471879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855742, "uuid": "1d616ee6-d408-4f10-b4b5-35b84f45cfdb", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855742, "uuid": "d9b523ac-aff2-45cc-a222-277f7a038b70", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855742, "uuid": "7cdad479-ad94-4dc8-8989-31b4410ba037", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855742, "uuid": "4e54a174-b2a5-417c-a664-a02a973f9846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855742, "uuid": "47d9d9a5-ae7c-47a2-8b2c-f50b831c61a7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c207cada-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855743, "uuid": "38eae990-d4aa-4db9-8d6c-31c4e89c121f", "comment": "Malware payload", "value": "7638308e889f7ed26bb40f9d61f5b62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855743, "uuid": "d44f0e59-61ff-425d-a2d3-bd71d8cf9fab", "comment": "Malware payload", "value": "54ef94c10fd1f2e65e1bbd27dd1d3e38a76c433b52a7bec928923446e613a089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855743, "uuid": "5d808bd4-5ec2-4e1e-a32b-68ce6df3d543", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855743, "uuid": "5c852f29-d643-42ba-87f7-62e1491aed13", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855743, "uuid": "0ddcab29-17e1-4fcf-ab52-fb1c86ea908c", "value": 532492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855743, "uuid": "6ff4000a-dcde-4c37-8301-fe881adbd254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855743, "uuid": "bd26f592-d4f5-44a7-a2f6-cc9409b3c4e0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c942bb-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855745, "uuid": "505b281b-d4a5-4522-b613-9468c94d5a13", "comment": "Malware payload", "value": "003c9eb33ac3a304f896cdd6c4d89baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855745, "uuid": "5546e107-823c-4772-8afb-2e449e1efa72", "comment": "Malware payload", "value": "552505ec536dbee00b19f2a8f64e5859dbbeaff5200528c2610596b025588662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855745, "uuid": "e230cd9e-c5f3-4e24-a1e5-07d0228d4ffa", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855745, "uuid": "2a86ddcc-aa6d-4d7a-a51b-04d51369a13e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855745, "uuid": "99ce38fa-2b3a-4044-956d-8a2617ebc361", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855745, "uuid": "036d0375-3843-4852-a84a-4b84985ed31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855745, "uuid": "a43fd769-993e-45b6-b0fc-ec53ad63e75b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39fb470-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855746, "uuid": "3268cfac-3d9a-402a-a699-23d5a8660d6d", "comment": "Malware payload", "value": "dfda624dbb4dfe6284e5989ef7b95d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855746, "uuid": "704db92e-5b5b-4fe5-9784-50efdc75f4a0", "comment": "Malware payload", "value": "559164218e7e6bf6877acff977241ade9b13820abb9db6b471b14621234024eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855746, "uuid": "0ad50fab-32a4-4de2-9248-1bccaa64045d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855746, "uuid": "a9362103-540a-4bed-a9cc-b239b0e65c65", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855746, "uuid": "ed01a0af-50cf-44ef-b347-2a814641c574", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855746, "uuid": "2947df82-8ae7-428e-b46a-532939ed4406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855746, "uuid": "45a0752a-13f7-4fed-9db2-2fb7466c8e6a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46408a7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855747, "uuid": "a60f4eda-5a38-47cb-b941-dff54217569e", "comment": "Malware payload", "value": "b7b776fd87c2db1ad06b563d17f342a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855747, "uuid": "7339384e-3439-4e5a-b554-2a6c474905a1", "comment": "Malware payload", "value": "55c366bc4ac031056645838ce5a23f176894c3f7a783512afd4f876f739778aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855747, "uuid": "d0c9c494-a929-47c2-bd89-0c5ff5aef274", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855747, "uuid": "c634a171-1da3-47cf-bff7-6c0806d74407", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855747, "uuid": "747106bc-2e2a-445e-97ca-7f8b3319e859", "value": 296335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855747, "uuid": "ae75c4de-a3ab-49c7-97fa-10b3dc246f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855747, "uuid": "17280aaa-0980-44d8-aa13-8bdce086df96", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c525772e-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855749, "uuid": "1bee2f85-bf63-4e4a-baf8-509fa2783f09", "comment": "Malware payload", "value": "851fed2e3e6b2bcb6d6eda04838b3e43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855749, "uuid": "9fcece20-32b6-4e13-8c5f-1df0b7231917", "comment": "Malware payload", "value": "55c7743ac5fffc207a682d83b8f27d5c3a11aacf81df00b20c64f4b65a14895f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855749, "uuid": "1ed57b96-a3e9-47bb-bc8a-42e7ea731149", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855749, "uuid": "d6a45c26-3926-43f0-81c1-88d680d53bbb", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855749, "uuid": "6485dd93-4bf3-4f20-84cd-ea958375410a", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855749, "uuid": "3b4c6d17-87aa-43f2-b35e-94aed43b5328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855749, "uuid": "6e073648-1b43-4751-8553-6650ce834f54", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e083ac-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855750, "uuid": "877b2a14-ce3c-4a5b-8aaa-0581dd661eb6", "comment": "Malware payload", "value": "5361adad51117dab0e9804b7ae4bbac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855750, "uuid": "ad94c378-8557-4fe6-956e-5072927075b5", "comment": "Malware payload", "value": "55ca745d647519433dd7e075d48cff33bd44baaaa1f6096dcb4f105c300e1c4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855750, "uuid": "dcf6a1b6-4593-49a9-acd2-fa3689fa9bbd", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855750, "uuid": "84744398-9719-4fe0-86cf-5b622e1169eb", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855750, "uuid": "b8bbca28-d4af-4144-864f-cf1154632e19", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855750, "uuid": "e11c0dee-4286-4507-84c4-bb09899a8ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855750, "uuid": "c081f591-6849-4aeb-a9b6-f6e2bcd897a3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db30e8d-c762-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763788574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788574, "uuid": "74dddb48-0452-4f0e-b0f6-39d2c836eed9", "comment": "Malware payload", "value": "8a6e899f2b074fb4431ac2d202af840f", "object_relation": "md5", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788574, "uuid": "49e50190-b53c-4704-964e-89ebec023d2e", "comment": "Malware payload", "value": "55cb8cda5e4adbe6f2c9d3f85ca302636e558591f0436a0b0c394ad40123fb5e", "object_relation": "sha256", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788574, "uuid": "f040fdfe-7386-47b7-ae87-03e3c80adca1", "comment": "Malware payload", "value": "b0d61edcb70b23454f69a0362ef0f80c6dacd9a4", "object_relation": "sha1", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788574, "uuid": "0ad5e1da-6ca4-424f-b962-d1cdb3f67758", "comment": "Malware payload", "value": "e068851e3f50f8bcfe76130a53a1e09084e48ec8916d0b98c24e8cbb88d98ee4bc7c3e45205bbe16c822577f32a8c431", "object_relation": "sha3-384", "Tag": [ { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788574, "uuid": "68aa9982-65b7-447e-83ed-f1b5f93b8c57", "value": "T1FDE42940B685DEA9E9170270886AD2F31914BCB9C651614F39D8FF3FFA73648102DE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788574, "uuid": "fd639483-df24-426d-8f43-a6e931a07ed9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788574, "uuid": "f875dee9-0388-4a1b-b6c2-450a811a664d", "value": "6144:wahOKKe5v0bURyWKV0VC3QZd05Pp9HfZu5PIImWy4iF:wiINbURpKVuC3SdgpRBuuW2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763788574, "uuid": "de122f91-c102-4d2e-ae8e-583e29c5e0a5", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763788574, "uuid": "b88ab5d5-f227-48ad-a95e-9c88e71c6786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788574, "uuid": "7cbdd8ad-2a0e-4bce-ad92-84e07cb8e3c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a7d68a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855751, "uuid": "d3ce0cfd-3430-4e14-be7a-6c749d582068", "comment": "Malware payload", "value": "fdb44eda601be596993cf6b460a366ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855751, "uuid": "f159fc29-96d7-4081-af5e-cc6b22133b9c", "comment": "Malware payload", "value": "5616be5a3262b29dda301ce1f40866a9723784c0a6b10efb62b7d2a1e7251949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855751, "uuid": "13778944-9d39-4614-bd33-8624ea2426e8", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855751, "uuid": "f575a2e6-daf5-4643-a51d-5417317ac912", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855751, "uuid": "b513a286-c711-4006-af7b-b9f7ad1d511e", "value": 1868288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855751, "uuid": "4eaf6e31-86da-40fa-a310-f559dac30de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855751, "uuid": "9c3e1dbd-1a32-4742-bc1f-10da9592c57a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7852455-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855753, "uuid": "f1166e3d-3a87-4c3c-b3e8-7e89579b20f5", "comment": "Malware payload", "value": "a4fe2344d75821b87c08b602083e08f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855753, "uuid": "696a0cb2-58ac-4e30-b55a-75e11d650626", "comment": "Malware payload", "value": "562dc102174bc43c6b943412e4f301b89886a830e680fbe6b9c66bc8751d0a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855753, "uuid": "9b762d54-0495-44ae-841d-488ac6451bd7", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855753, "uuid": "f86caa5d-c7a7-4c03-8548-19beb10669f4", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855753, "uuid": "72cb212e-f8bd-4941-8b51-b6652181d344", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855753, "uuid": "958630ed-6d8e-4a77-b3b8-d27f93e30126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855753, "uuid": "8b236e87-0521-41a0-84dd-52aa127c9f1f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8571487-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855754, "uuid": "28621cde-1c25-4168-980d-dcb014fcccc9", "comment": "Malware payload", "value": "96f6e1a9a19a65140a2fa910aca08063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855754, "uuid": "f95725a6-7c65-4949-94d1-bb6733a2912b", "comment": "Malware payload", "value": "56369dae581ba124d39a0b7ef820be02f85abeab7848bb5442cb1ec6fe10e4e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855754, "uuid": "9f099308-a384-4545-a5ab-7e2134d5fbdf", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855754, "uuid": "46ed2c4a-550a-4677-a784-a887d50a23a8", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855754, "uuid": "34f6cd1e-5c78-4cd4-b72a-90da4e01ed98", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855754, "uuid": "dfe01884-e6e7-4773-b2a1-0d26085c831d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855754, "uuid": "ba256b7f-8ec1-400e-827b-8a26387a5aeb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92e7ffd-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855755, "uuid": "8bc215ea-a26a-4065-b388-ba26c39a424f", "comment": "Malware payload", "value": "3b31bc76dac242ea2a8a84541008b1af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855755, "uuid": "c68a0a99-fc50-42fe-8c4f-fbb1d28d10ec", "comment": "Malware payload", "value": "5653abc99fa05225e48df552fe88ff63450d446341fcc0501e0e5fee2e6721d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855755, "uuid": "2872335c-b55b-44cf-a6be-30aa374f6767", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855755, "uuid": "883020f9-f961-4ead-af15-17bd57127bbf", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855755, "uuid": "7b9ec46a-017f-49d4-b6cc-84b8cfa5ba78", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855755, "uuid": "effa9379-55b5-4fce-b706-29a85e1fc1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855755, "uuid": "1d91c2a6-a916-4d1c-a53d-72c19934e87c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9eb0825-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855757, "uuid": "046fd6d2-0eaa-4812-b2b8-a47b269cd643", "comment": "Malware payload", "value": "2ada51cd951b376c00aa6a04e9e235e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855757, "uuid": "1cba82f0-4b95-4e1a-8751-7fa3744fa643", "comment": "Malware payload", "value": "56a559138d702c729ae3f18b1708fb3686d859ec1252aed66eb14ab3530a2e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855757, "uuid": "2e80fe57-825f-42ef-be15-9a46d44156a8", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855757, "uuid": "6044ae44-fd98-403d-a1b4-c0831523834a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855757, "uuid": "59b1c176-fa17-4409-ab11-630aeee51f01", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855757, "uuid": "f550c5b9-0842-4fdd-b2d1-e0a971137b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855757, "uuid": "896453c3-6a3b-4c26-9d05-74f9e3ddc9dc", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cada9ec6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855758, "uuid": "d09f98c2-f07e-4766-a6a3-b2ca18a5736e", "comment": "Malware payload", "value": "a962bcf8b19bc8d0cbf3ab55eefc2b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855758, "uuid": "3eec7573-70ab-41da-934e-6cd1c47502f8", "comment": "Malware payload", "value": "56a7fa9893b8000cae1ece77000ea9fbac1b6d620805d20544e8ed5d14b65ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855758, "uuid": "d90c568f-f317-4a15-b0db-41bd3663f89c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855758, "uuid": "0665bf62-8a7b-4832-ae7f-da09baef8076", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855758, "uuid": "3869a8fc-e7b5-4141-8146-7ea04d6f6e5c", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855758, "uuid": "dce6e6ae-ffdc-4d99-ac84-fca3389b266c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855758, "uuid": "d30e2eb8-25e1-49ea-8a08-0ec02ff2a520", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbc5ca7-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855760, "uuid": "26e8c0ac-4fd9-422a-a6e5-6fa81fb68b74", "comment": "Malware payload", "value": "a365797ee5d4fa97b93a0971e905adb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855760, "uuid": "e6cbe369-27a9-4e3c-aedd-029d756a543c", "comment": "Malware payload", "value": "56b5a46530644f459dc8826ee21fa19cea0c4e58917610d13fbdfc605df4dc66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855760, "uuid": "c1ffdc8e-1ce9-4386-b7e7-d9764dd9844b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855760, "uuid": "76b82269-5b05-4a06-bc74-d64fc64ee706", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855760, "uuid": "54a9dec8-f88b-43e0-88e7-2d200ed1c9d1", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855760, "uuid": "59879774-056d-4b8e-a8f1-209040e14c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855760, "uuid": "6cd7aa1a-6f79-474e-bdf1-8c86335beb7b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe71289-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855391, "uuid": "f899b4e3-c14e-42ee-bddd-95562e78da30", "comment": "Malware payload (Mirai)", "value": "b14a9f1b3713c5cde60616dbe351b538", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855391, "uuid": "8ffcc4f0-0c63-4f0d-8d86-55fd276b42fc", "comment": "Malware payload (Mirai)", "value": "56d5961a1948d1e708da640839ef112d897f258799241207801fc677d20f0580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855391, "uuid": "901197f1-5a29-4f2b-be92-895a27bab38a", "comment": "Malware payload (Mirai)", "value": "a180fd9cf25312a7f1dc3442c2649de2681c1e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855391, "uuid": "e0e40a96-3d0b-4c19-8c51-fe5243d18421", "comment": "Malware payload (Mirai)", "value": "301d53991bebd6e06d5765956b1e009cc09f0cb26914d98a17089b6586e60533e07cb93b6f1904577473018541e702c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855391, "uuid": "ee6091ac-5da8-409b-9486-fbb46dd5fe17", "value": "T1C3736CC2B743D0F1E92606322177FB324673E13E0069DA43D7A9D876EC52A41E6663DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855391, "uuid": "79f8405c-d360-42f9-8dea-025dda546179", "value": "1536:YeWiaOh1gL4rLIGY/6OzdkU6o5oG3fs8kZ2rEZsS4W0STALvBx:BNsL4rMH68768oG3ELZKgt8LvBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855391, "uuid": "f0e85370-9b4d-4eee-bc3d-fe343406455b", "value": 80208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855391, "uuid": "f6c650f0-76c8-4506-8afb-c464b58359d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855391, "uuid": "16265bab-5bfb-493a-8a0d-fa0d7292c322", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc96aca3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855761, "uuid": "e5857d8c-50e2-4c2f-9eb7-07f4e983b020", "comment": "Malware payload", "value": "fe258421e3546c4d13123533e5f3cd3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855761, "uuid": "7d2efff5-9f8c-4ad9-a150-15de0fc2668f", "comment": "Malware payload", "value": "56f29b736001b3427984ca8a7e4d63b5570fc515a7f75540600c1bc9aafbd798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855761, "uuid": "d149a659-3c1e-4874-9a37-52353bace974", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855761, "uuid": "2782b617-7454-4aba-b001-60c38930ffb6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855761, "uuid": "131ea643-07ec-4215-9ac7-5a2d0762eb33", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855761, "uuid": "5c8b410a-18a9-4986-ad8a-5f848b737e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855761, "uuid": "f9239db7-c23b-4ec0-b5ff-cd7978787ad2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5a90b4-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855762, "uuid": "993859e2-7862-4cd2-8752-80833e69e5b6", "comment": "Malware payload", "value": "2e4ecead6a5091b349f7ffffe8419b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855762, "uuid": "c3c83eea-44cd-41a5-a77f-74a25ccddce8", "comment": "Malware payload", "value": "5702ee9d9da939057abdb9b38a6402a0ab279df1910b3fbeaf8f547532f271f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855762, "uuid": "9deda39d-d417-40a6-bafd-c69a8b2d3046", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855762, "uuid": "073b8abd-be9e-4680-b76d-cee8214d0ed8", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855762, "uuid": "1799acd3-63e9-4f8e-b5be-761ea547b04e", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855762, "uuid": "b39b7105-85b0-4220-8634-147b9bfa63ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855762, "uuid": "c788dfc4-4214-4be7-a5c5-b7c6138a307a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56047ae1-c758-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763784266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784266, "uuid": "9a1d14ac-d813-49dd-8337-057285196d94", "comment": "Malware payload (Mirai)", "value": "96b6ffaaa128f06b909051f81813c57c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784266, "uuid": "c3319cf9-71e7-44dd-bfb5-3de0642043f7", "comment": "Malware payload (Mirai)", "value": "5764f28547ee99ba33852316a7733097ac5d085cf6c46b33859d0865afebc89a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784266, "uuid": "cf19c96d-6fcf-4265-8f0b-59c6c4d519f9", "comment": "Malware payload (Mirai)", "value": "eb5036694a1dddaadd3fed1ab28103234b96f401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784266, "uuid": "982504e1-8adf-4950-981a-cbb6a87581d1", "comment": "Malware payload (Mirai)", "value": "8468d18d0348830039fc216564b65704746519858a1913b2698dc58ef5afc9a22cb925ef0d0158d3708c9fb7356ec9c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784266, "uuid": "382e2360-d08c-4ed4-ba0f-080e916ec26d", "value": "T184C3D70D3E325FADF3A8823447B78F35A75823C626E1D685E26CD5145E7034E582FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784266, "uuid": "928490cd-87b5-4f79-b0e3-a86ebaafbc4a", "value": "1536:lWuSeWNnX9/se5pes00eMo+qnPMrZUqLy4poesH4ntdKemHqoi:NjY/r5pDeMo+q0r+qLy4Xtefi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763784266, "uuid": "eb99f00b-074f-405b-a764-b1c20c4b7663", "value": 119852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763784266, "uuid": "802a2f85-2936-4c87-bc80-3f1ec2ae209e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784266, "uuid": "5f1ce604-a2ef-469b-a869-a17adecd9272", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee3414f-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853537, "uuid": "327bec5c-a285-44e8-b5dd-19e5303035ec", "comment": "Malware payload", "value": "f300e0e371e2550daff3c9d36481af31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853537, "uuid": "1ffc8740-08df-4521-8de5-0102eec8e8b7", "comment": "Malware payload", "value": "579cd96e56de32cf25796c1726c9c7cb6e69d283be67ca6c95a17708bdd1694d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853537, "uuid": "1793b7ac-c6f1-4b42-b899-e8f48d1c273b", "comment": "Malware payload", "value": "622672a95bfa3a120a71606e3fe5767b7fed8a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853537, "uuid": "e8683049-f266-49b5-a376-162b7b88f74f", "comment": "Malware payload", "value": "9638805465547c06b78e5b1bc0a33bdd63d30e9e23125b5c728baad2aa36c3db886c7ce7cf57d75ca69b53fecda5b99c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853537, "uuid": "b1264317-3391-4a05-a589-2eb7267da56c", "value": "T15632EA1FA3BC8673DD7B0A310DA392D20B74A6054917EF95298B34999E523201331BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853537, "uuid": "ebc6200c-9edf-410c-8105-2d8b8f4c10c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853537, "uuid": "feeebe16-3694-4fad-a9da-013703723648", "value": "192:AdxHlSozWaiGxDcIWOL0O5LSZecLkbLKLsEMePVK3ISq4pJ8RLfr9kz:CxFSBaHxd1L06LiecAbLKLsEMePVK4/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853537, "uuid": "f3d18c5d-c5c6-482a-aee7-27b7dca70113", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853537, "uuid": "6abfdcdb-43d2-4f91-9242-0978e5450510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853537, "uuid": "82ed81a3-fe2b-4765-9baf-99b5b07a6ede", "value": "ZAGRUZKA.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce205176-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855764, "uuid": "70be53b3-11ef-40ea-b4e7-39082ecbf00e", "comment": "Malware payload", "value": "24ba930e538a7a98bea076d0d46d3c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855764, "uuid": "8a2f0aa9-1ffc-4c48-ab69-927aa8c12082", "comment": "Malware payload", "value": "57a641a458a73df906b2531b6a003e282b48d1e71285a969ed98f6eb3411de69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855764, "uuid": "d69a73ba-3861-43da-bc0c-284ba068905e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855764, "uuid": "f6fff135-34a9-4943-a104-79cf23167ef8", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855764, "uuid": "1c89730b-7080-4924-837a-31086e46f203", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855764, "uuid": "4340ae7a-5e75-438d-9914-1a94850ad3d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855764, "uuid": "2a41360e-e42a-48d0-a8f1-c256a1afe4b4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee45150-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855765, "uuid": "36cde600-8c3f-4260-9c35-5c538762170b", "comment": "Malware payload", "value": "cbf4c1f75f88f11d25f32745dab71e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855765, "uuid": "cc46682d-e596-477a-a386-c5ccea4b98b6", "comment": "Malware payload", "value": "57b0c0390e087337e25126c0bb5631d8a64c4718cc0a11e601a15f17c9c702b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855765, "uuid": "6a0ddfdf-1ece-4370-9b41-1fb852d85e93", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855765, "uuid": "48d71e93-b09c-45f6-a0f1-73209c57c276", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855765, "uuid": "e0f4f7f0-c33b-4c06-aa7f-549091b0c060", "value": 1835520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855765, "uuid": "9432dc94-1bb8-4194-b1d8-d685f23a003e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855765, "uuid": "9193ad57-72da-4275-a4e9-780ac57210c4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9cbe10-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855766, "uuid": "48aa3193-8975-4b08-b7b7-ebea6dbf3969", "comment": "Malware payload", "value": "84a86a04edbbd6cffb2361613dd65769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855766, "uuid": "edf197fd-78aa-4ee3-bbe4-a0a32ac8cf78", "comment": "Malware payload", "value": "581a16fa43c9a55f6f6b8cca8ab8f0297cfe6460b7f5f82116caea22626a6484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855766, "uuid": "cfbe7b06-5a95-41a5-a440-83810ecdc732", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855766, "uuid": "7da79d46-d732-4a8a-bad7-b4107647bcd0", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855766, "uuid": "560ecc5d-3ed3-4c52-8b7a-7ac3c36456fd", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855766, "uuid": "7238fe73-4ade-4597-bf14-51b6bc3d25dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855766, "uuid": "bbd3132f-a657-4d13-a3f4-64fff0b84404", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710cd704-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829408, "uuid": "8ae7440d-571b-45aa-bb84-1b02e8e56e17", "comment": "Malware payload (Mirai)", "value": "d3e3e93f6b5823bb2abccec775b40088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829408, "uuid": "86909b51-5b0b-44f4-b2d3-b68f6fb7804c", "comment": "Malware payload (Mirai)", "value": "583901d5241b61add64f1c5a4b0db6f208e1966b59f875c6b752c9ba1a97f2aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829408, "uuid": "0f2bef9d-e0ba-473c-9b4f-81778d47cb3c", "comment": "Malware payload (Mirai)", "value": "499a3535a3d2c48dfaa44312f6eb751e04a14b3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829408, "uuid": "ec0d1263-16bd-4256-a671-761d3e4e482a", "comment": "Malware payload (Mirai)", "value": "4caaeb502f8208c8a6a0e62ad7e4fede774869bc8e057f5c0eddee29e274dfb51f05d885b1a75ddd3e8dae685f8bdbc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829408, "uuid": "bb5ba2b3-79be-4d9d-a881-75e34796e7d2", "value": "T1795302D61669B7B6C69284B9CF08C6C3411B91FEE7487012777B24AA9D4000B477BEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829408, "uuid": "bc8a4075-2e4c-4d2a-bb19-b8204ab56aa8", "value": "1536:f+PD4gpTkuptPVk3bYO2wcAfzQmS8etoc1WntmQNz1i:f+0gJ9jWbf2wtfKo0WntRNBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829408, "uuid": "e0163c4f-0b42-429c-8dbf-60777faba33d", "value": 62796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829408, "uuid": "dfd73a13-0555-4692-8577-36f6b16477f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829408, "uuid": "fdb7ee89-5969-4080-9f2a-40267ff04d97", "value": "Polar.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0636e21-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855768, "uuid": "182c18de-1ba0-4c0a-961c-d9ddf0636046", "comment": "Malware payload", "value": "1f442a3084db442eda9db8a6a039fd22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855768, "uuid": "68e7018c-0b23-42b4-9f67-b1f8c10f6d66", "comment": "Malware payload", "value": "5844a0afc8903e86917d1dd7df15406d115d25487d1f3191127a3a754c3ff212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855768, "uuid": "02398cb8-102d-4119-b0b6-595bb28ab407", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855768, "uuid": "d9f45f87-70e8-4276-abdc-11a1cbd68662", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855768, "uuid": "e0de611d-c7ac-47a7-a0a6-d7a548fd9b01", "value": 1836544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855768, "uuid": "7c2ec9de-150c-4d1c-9df0-f8e37e9d6a90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855768, "uuid": "788797af-543f-47f2-b52a-d25848b8616a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53f9791-c7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852367, "uuid": "1fa55c51-9977-4944-a1b5-4b87b37c39de", "comment": "Malware payload", "value": "3853fcac0879de7e851f1852cad5dc1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852367, "uuid": "02542448-fb5f-41c0-8329-b41b6ddf6e06", "comment": "Malware payload", "value": "585ad403c58d3bc36d1e6cdf00261832170862636de3607d9171c2c26379167a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852367, "uuid": "7fa26208-72e7-4a9f-b920-2693edf824e0", "comment": "Malware payload", "value": "d3174eb130aa144d8267a22596febbae8f619f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852367, "uuid": "1029dd91-ec46-420b-805f-3bc32c6e67e1", "comment": "Malware payload", "value": "575c4138d148da99d5fcc7894ba2ae7a5400cc2d9af57800bb460ea1595140b39e9b021ed096a63f238dffeeafa448b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852367, "uuid": "6248abb9-4f24-49e1-8a5c-d8e205d79cf6", "value": "T101927D0AAB748C03DF578FB6B0E68A1246B1F7435DE885DB814EC15A4A013902FDA67D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852367, "uuid": "b86d00dd-6c6f-462e-b39d-4f5222ae9661", "value": "384:7Kql6Ruv9Cu7E740VA+R/uo6ki2o6jicekdSJIVE8E9VF0Nyz8t:uOLNALOXr2kcU2EC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852367, "uuid": "ba91a47b-a45e-49d9-81d4-61091da1f0e0", "value": 20696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852367, "uuid": "f548404b-1fd2-4ee9-8d05-07c3b3f8a0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852367, "uuid": "f4ace531-a8a7-4a3b-9610-30514ca8be20", "value": "PDFSkills.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13dda40-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855769, "uuid": "b1f21e68-d9cd-465a-9ba1-e69347668f67", "comment": "Malware payload", "value": "7fefc00d94d5a1893257004b2fee3128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855769, "uuid": "9db9dd20-8230-4508-a93b-916875ca25ac", "comment": "Malware payload", "value": "588c4ab8d2b9b47d824391368ce022b7f904ec3c32a6fd26679880d446bc389d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855769, "uuid": "4e63f6e6-271a-4d45-99ea-759169409de4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855769, "uuid": "9adfc115-9e53-4d8a-ba10-fb2794cee60e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855769, "uuid": "7c1c0017-2349-40ae-a7ff-1eeb29985e0a", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855769, "uuid": "5294a19c-fc78-42a3-bbb7-c7fc204907c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855769, "uuid": "f08be93f-5288-43e6-8d6a-7f75172513b6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c994786-c7c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829777, "uuid": "c5c7664e-a09d-423d-922e-d74210110505", "comment": "Malware payload (Mirai)", "value": "e85dc4873212f02fd5c2c3e2d80f0607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829777, "uuid": "62a3945d-663b-4366-a36c-b0dc6b5868ed", "comment": "Malware payload (Mirai)", "value": "58c1c25104bfda841e39b52cba4d0f7999922fe3b66580a3bdee5601caac0ca6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829777, "uuid": "e06285e4-ce1f-4194-bf99-0ce9b87fbf30", "comment": "Malware payload (Mirai)", "value": "022bd6974e4193e4f93cd4023f0ff3deb9d33873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829777, "uuid": "0ce680f2-286e-45e5-a46a-0e317e545848", "comment": "Malware payload (Mirai)", "value": "569eb716457325478c0ef09f6856739c4ad7ea33d75b49558ca5c0458f689c5341b37f5374a84df8fdfc3a17404aa644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829777, "uuid": "afb3dcc6-f7f5-4b59-9607-92c304d41bec", "value": "T129C312C548945D7AF699A73CF3143EA2F331A1DC26BD3B061FC1FD896A926A107E181C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829777, "uuid": "7b8548e3-76c4-495f-a6ae-35a39e9c16b1", "value": "3072:Ko5uGVIr3AGZRHtEd2rpl0X+k4PUsiLU2Li3p3vrqC09439xU:jusIDZHed2rA+k48siNC339a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829777, "uuid": "b0e1956e-3280-4e0c-b6b0-c0088df23874", "value": 129660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829777, "uuid": "81dae81b-a4ac-423b-af9b-35b29681ac67", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829777, "uuid": "99f62fa9-0a86-464b-bdd2-ca3a12ec88e4", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ff9c15-c7c8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763832264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763832264, "uuid": "0a2ee93f-38ba-42e7-ada1-ed80484aadb4", "comment": "Malware payload", "value": "c2bad09959f8b19de45ece883972c9d0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763832264, "uuid": "a26d1fa0-d308-44aa-900b-b62447c96deb", "comment": "Malware payload", "value": "58d59d18ba7aa2eb23992f575b3a7fac4474524ebd4d2a6ce3416191d8582ae1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763832264, "uuid": "7fcea491-ec4d-40ea-9bf3-60e8e9396777", "comment": "Malware payload", "value": "0d601376d6a1f994e1748234d900ac87b281202e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763832264, "uuid": "99c38af7-15e5-4065-9bb0-d9d2987706ec", "comment": "Malware payload", "value": "186533a0a5113c20c8db76e6e906f14fe383073b052708ac208e9338a9b9198af9618260f35938dbfb985a0080023b79", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763832264, "uuid": "3751ae50-2377-43a9-8064-79e6755eb384", "value": "T1BAD5332932D02166EC3897B134E656974E30756287B640DF52D5BBBBCF332C5AA31B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763832264, "uuid": "3646bd98-cc62-4752-ab3d-d589b36e7a58", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763832264, "uuid": "8175c978-bb9a-47a5-995e-683f0a1a6df3", "value": "49152:GBjVJSCNSrz9De9767gF3w0kXx0PTtMO/1scqjDwz0T1yJJqvSYmi7Yxg47BJnI5:sSCN8zc9Ce3wbB0PTGg5q3w4T1GJp+sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763832264, "uuid": "7edfb856-e15f-440a-87a0-f068e06d3bb3", "value": 2830768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763832264, "uuid": "5c1c0357-5a96-4f20-a156-5f766a01a825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763832264, "uuid": "1180041c-839b-4a23-95a2-28414555e868", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20eddea-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855770, "uuid": "9492b2e3-ac0f-452a-bbac-8e3d8cddc663", "comment": "Malware payload", "value": "a534a3d4aa218545b901f19788dfd1ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855770, "uuid": "e3e67fc2-dea8-463e-93ca-40181d2234d2", "comment": "Malware payload", "value": "58f9a553a4458fbcc3ab0632bd59518eaf9d3b029635dbb7ccb20527e96fab06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855770, "uuid": "c69cc891-0f36-43ef-8354-fcdc85cbbb36", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855770, "uuid": "93efd52f-50ea-46f3-8640-37a935be13ce", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855770, "uuid": "6881e03e-fe8f-4455-bbe1-0ec7572f122d", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855770, "uuid": "98f3aa4b-d48f-4cdd-98ae-0880f48b57b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855770, "uuid": "581df4d1-80ba-4210-bf1f-8345b5c00632", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2dcb50f-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855772, "uuid": "4537d9fa-d251-4af6-8fc9-bc0ec703844e", "comment": "Malware payload", "value": "5ff655616d9f03160320eee47e2fa2b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855772, "uuid": "4eba6f9e-16da-4f43-b1fb-0cc5f9338fae", "comment": "Malware payload", "value": "592e6130d83e7bfebc0c6ced47f594404f65679c48f5a5cd56b0434d9b114b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855772, "uuid": "e3f726b4-59e2-4364-86f4-59a05c02df1d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855772, "uuid": "300f88a1-9398-4a33-84c3-31baa52ee4ec", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855772, "uuid": "42750f22-6d46-433d-a96c-1366aaca8352", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855772, "uuid": "c0bfa2b0-cf20-4bcb-bbae-4c284c94c0af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855772, "uuid": "c592d90c-a5aa-4bd2-92ae-98ac8c04835e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd968e0-c78c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763806885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763806885, "uuid": "7a78c9b5-3b73-440d-a47e-1d53b83a129c", "comment": "Malware payload (RemcosRAT)", "value": "0959bd684b84df8cc8ae0475e1c4f5b6", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763806885, "uuid": "54eb782a-f368-4b17-a5ee-4200b1ac0fae", "comment": "Malware payload (RemcosRAT)", "value": "593d3c1395948d8ae574ff75eff843a2cdf8234bf2395739fb1b58d93687cbfc", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763806885, "uuid": "46ebbcf1-d0c5-4e91-8132-b46e56d46ab3", "comment": "Malware payload (RemcosRAT)", "value": "119a96b7b0d09e1609a7041830d732b4aa807e17", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763806885, "uuid": "557e904a-a3b3-49ce-8e61-473404e6376a", "comment": "Malware payload (RemcosRAT)", "value": "9d69c73e5bccf433cbf1d2c2a32cf9d218921da323c504ba8fe4f85cfa740edd45af9abd7df84a2c4083bb631bea1f1c", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763806885, "uuid": "e1631efc-3c68-4dca-bdcb-c0423adbda5b", "value": "T1F7731264E6E6FBC4F0E299BACDB4DB405384BD217A4C80A04BD3988C139E4555BFBD6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763806885, "uuid": "928fa810-c429-452c-bab5-26a16a8a78ed", "value": "1536:voC0tshH1lEBukV9zNzDfVBadJqKRDflSAzuZDuwerphy1lyB2t:A1oHvEBuqttE/RDBUeVhy1lyB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763806885, "uuid": "dd832c1f-22c6-4df1-b3bf-fae5979c18e1", "value": 77151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763806885, "uuid": "acdb61e4-7473-427e-a29d-c91dc4c48fb0", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763806885, "uuid": "d1c511dc-479d-465c-8ffc-2b7907705176", "value": "Transfer_Notification0010291000192010.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ac66a8-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855773, "uuid": "c997523e-3bb9-4016-b59d-a99c542121f7", "comment": "Malware payload", "value": "242fbc678e685cbfeaf5d99cdf1fe33f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855773, "uuid": "bd2f2fdf-ec95-47d9-ad5b-80df4b230bc4", "comment": "Malware payload", "value": "595bdf38a9d74ef01166da36911888cf662025bc74765493db01e6071eaa10a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855773, "uuid": "37aea75a-4e75-4489-979a-5c10c5b83ace", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855773, "uuid": "d4f776dc-68e5-43e5-93c4-1721928e9d4c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855773, "uuid": "59cf3b0a-7092-4708-a952-7601898ccb35", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855773, "uuid": "fca82d82-f5d9-4f05-b332-817f7ca6d6bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855773, "uuid": "834ee998-9988-4b2a-b0e8-5e40ca025c05", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726b61c2-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829411, "uuid": "a47037fa-d5fe-4422-a67f-f89305c92607", "comment": "Malware payload (Mirai)", "value": "a67e4aba736512730ed9e7ed1347d680", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829411, "uuid": "d5ebd919-1629-4acd-adc5-bfcb61d69f66", "comment": "Malware payload (Mirai)", "value": "59c55501918e0f7c6c0fbdfb9582b3bd2cb851d56608bbe4cfd76eb5225bed7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829411, "uuid": "fb1f6049-0cf0-49ed-b8b7-8c6db9b606b0", "comment": "Malware payload (Mirai)", "value": "fd7b136f86b032102c3c9fea4fc1ca0e34f6422c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829411, "uuid": "edd4c70e-68bc-42dc-a3c5-d5baf91d5f3d", "comment": "Malware payload (Mirai)", "value": "20640bf08581af8ff20e4b51ba5040233d93dea921736319a4d0b145018837fd0bb155bfaddb5c26e0b9ae2ecfbf9442", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829411, "uuid": "a1a1f1c9-8c3c-4fc7-94b7-5f23f592e3b3", "value": "T1D163029D87BF1CCAD3E7E9B506721F808D2E0C14ECC297A87904D6B79BFA1D965026C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829411, "uuid": "405f87bd-3a04-48dc-8ddc-c3fa4ffaa6ea", "value": "1536:6wy4v0V6j+PZAZFxSTiDYyOk8oR67kuEWtUVJuo:6zwCZAZbDz39dVQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829411, "uuid": "4d0e40ac-1594-41c4-81a9-ca257d1c8bff", "value": 67868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829411, "uuid": "75ac7215-8ca2-41d7-8a17-c7eb1b9b5303", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829411, "uuid": "f7bac033-561a-4cb0-bc07-a05f50ecf6e8", "value": "Polar.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4774e2f-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855774, "uuid": "9076892b-fa41-43f9-8842-ed80b5e8aab2", "comment": "Malware payload", "value": "563a4a266ce32f5a353c3bb2064299af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855774, "uuid": "38bd361e-87b6-433a-bee6-a2fa5a540575", "comment": "Malware payload", "value": "59c9f16489895602ce1348d233ee0d8f2706d86b5583af7fffa0cf0d9ca7a87b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855774, "uuid": "c4f202e6-6dee-451d-af23-4db5443ab141", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855774, "uuid": "0962029e-becb-48aa-9704-2dfe2a663c2f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855774, "uuid": "fe59544d-0d3a-4bb3-a20e-8f42d476c38f", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855774, "uuid": "c504b3e4-ab8f-4b2d-aab8-fcdc4b116f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855774, "uuid": "1b6701fd-bca8-4e71-b90b-3813f76191c7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53c34fa-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855776, "uuid": "1771ac30-08b8-4290-8097-3ab98ad8e6d2", "comment": "Malware payload", "value": "fe6f79ceee97e096c4d761d7bbb5d968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855776, "uuid": "95042fc3-56b2-4b54-9678-5246e9ed1093", "comment": "Malware payload", "value": "5a161dfe565c83eac801b0b0159fe867705f4b13674ba8ccb872e7b9f9f414ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855776, "uuid": "5e9e5030-aef1-435f-bf3a-6cffe250a9fa", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855776, "uuid": "fc81f595-be18-4084-80db-46b7b5f1e207", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855776, "uuid": "423eef66-1ea7-4f5e-8424-ead665b4d409", "value": 1883150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855776, "uuid": "583b3065-387e-4f3f-b817-becf2da6ed2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855776, "uuid": "3f91ac24-fa6d-4659-a76a-5c62e415e7f5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60e4f00-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855777, "uuid": "f6c197a4-bed1-4203-8416-591cd27b77e7", "comment": "Malware payload", "value": "35c15dcccda2f3c480a5993bcfa906a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855777, "uuid": "a05ce00e-89f8-4236-b962-5e5ca7691f62", "comment": "Malware payload", "value": "5a2e661b3afd7c871fd7aec27663139274bd07c01f0753c29809964f0eee08e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855777, "uuid": "74830a4c-4138-4632-9c4a-dc9fc0f608ab", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855777, "uuid": "77acaa7b-e529-4113-9873-f37828df32ea", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855777, "uuid": "c2eb0f87-52f9-4208-8dda-4879d44aef06", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855777, "uuid": "2d2fc834-eabb-458c-97af-585e61fbea9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855777, "uuid": "08cfe4b4-bc68-4861-830f-456774bd3e02", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d43066-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855778, "uuid": "a200623e-ce08-4943-9a40-1d4ea1957e19", "comment": "Malware payload", "value": "ca44df942cd6d19b5c91a61a1043a0e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855778, "uuid": "663f899f-1eec-4b07-9e5b-348cd4fb7e76", "comment": "Malware payload", "value": "5aa42451a5ac1ef0da91a240389b95cf535f34931f50540e4b3d6c38c9b68067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855778, "uuid": "ca50fca0-860b-47a0-bb18-5979846c2d2f", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855778, "uuid": "44ef61b0-1805-4c2c-a407-8a01f3ab7fa3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855778, "uuid": "79135768-bd99-4730-82bd-9186a81039cf", "value": 1942016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855778, "uuid": "3f75e030-c209-40c6-a0fb-05363bbe3d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855778, "uuid": "78405b42-4ac3-4fd2-a3a1-ac4a7357c06a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d74cae-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852938, "uuid": "4584280c-d97c-4812-a867-c208ca670aec", "comment": "Malware payload", "value": "8e96ceb9844f0ebc28780901aa3af9fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852938, "uuid": "c43ffd21-430c-4321-9724-300b62fdd228", "comment": "Malware payload", "value": "5ac2041454d46f138c2aa75a15f43372600143bf952ac656aa96288442a56946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852938, "uuid": "8d59c764-914c-4b2c-95d9-6978147cd4d3", "comment": "Malware payload", "value": "0d02ece3e63702cf54d5865503372f72ef7957fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852938, "uuid": "32fc6c78-2baa-4781-94e1-1ff409aab9ed", "comment": "Malware payload", "value": "6bd7004b4d856714eb166d60927b5b8e7c2f852f940b70c980fabaa1ab924a8e064ee2f8ef8867456ae2dc9a455c0818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852938, "uuid": "265d938a-0527-4ea7-bf7f-a0dfd21a68d1", "value": "T14976BF02BF948F83C5DF2FB610751285F770E603D766A7CB5100A2F8ACB63C45D5AA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852938, "uuid": "bec876e8-e20a-41fe-be8d-2060198a3e79", "value": "98304:aEe84UE0yq6XDe8i31du14rMTQektKgUOX32yn1lrZitM3:7oUESldfeOUg35rkq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852938, "uuid": "ec2f71e4-bde8-4847-8370-f634da33df65", "value": 7814440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852938, "uuid": "767fa081-d12b-4a9c-88a9-882d2558ea43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852938, "uuid": "ce837dae-8019-4e5e-a01a-068a0c6eb920", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a00e29-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855780, "uuid": "a1d147ca-6a54-4d1a-977c-c7ab2ae52ecc", "comment": "Malware payload", "value": "1f6bede88eebdb3d26d908ff3a417329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855780, "uuid": "fb6ef952-e20e-4bab-aa84-24fb27079616", "comment": "Malware payload", "value": "5ad822340ce7cadae2f0616bbc18aa28197b067932bedd5e0b0b18d638e67655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855780, "uuid": "75886c2e-e22f-493e-a71e-d50047a709a2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855780, "uuid": "a969ae20-42ae-4e77-b05f-db30fd22df83", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855780, "uuid": "47c975e6-34ef-461b-beaf-54e28876e29b", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855780, "uuid": "8e25152b-b6b8-4928-b706-3fe19bcd7549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855780, "uuid": "f6fd1386-8c96-4f3c-8b0a-317f358c3a94", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b24943e-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852940, "uuid": "a0c7c819-a11f-466d-b2d1-3909f4b7c502", "comment": "Malware payload", "value": "e95f5a59a48eaa53b31772e41126c881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852940, "uuid": "7a148ee8-6407-4bed-b850-46f8c5c11992", "comment": "Malware payload", "value": "5ae866358a4d24c8f3b81bf6790af2f90401bc07e0b07494f9867d95fb4b48f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852940, "uuid": "0c27af59-cf58-404e-b9c3-754a8c89f817", "comment": "Malware payload", "value": "7f293cfa9fecc9077410ed86346a85fcf1de4b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852940, "uuid": "eb81c773-3b6c-4d62-b7e9-25f23a76a1b5", "comment": "Malware payload", "value": "4ba54b5f96c568b346dbeb9bee73c6616e7a6f623a762f0ac275451f5c20172ae17328efd304b6b78fc139c7982263e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852940, "uuid": "f9101525-6b74-4c30-b345-88d2696e1635", "value": "T1AB76BF12FB948F83C8DF2FBA10751385F774D116D352A7CB6114A2F8ACB23C50D5AA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852940, "uuid": "66d11df9-ff7a-4a55-9b7d-ee89f96a31bc", "value": "98304:Ape84UE0yq6XDe8iNdu14rMTQektKgUOX32yn1lrKt:ApoUESNdfeOUg35rKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852940, "uuid": "873887fa-5e43-42ca-adae-925ee385c014", "value": 7811368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852940, "uuid": "444b0e2c-9592-4e0a-b92a-9df691f653d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852940, "uuid": "3d8a86a3-3787-49eb-929f-ecbb5ae51ec4", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85bcf37-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855781, "uuid": "aeef18c9-f9b3-494d-be03-226875b86c57", "comment": "Malware payload", "value": "37530a5f60a84ed57746a93b153f0618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855781, "uuid": "d7e753d4-91a4-4d05-b3af-06db49bb7359", "comment": "Malware payload", "value": "5b8b78b57e4a59162989c4c12e5f1dac3f6679961b393a9b3fc3598879b1a4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855781, "uuid": "aefba9f1-063e-48e4-b3f1-6b6e824e4fb9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855781, "uuid": "e3e13bc8-3867-4d1d-ba52-415fa6183d92", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855781, "uuid": "f98e1f4e-e713-41f3-8701-605fd09989c1", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855781, "uuid": "6dc47b16-3f8a-47ea-a589-b411793bf8eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855781, "uuid": "a5cce30d-c607-44c6-bb01-c3b7623838e8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93715fc-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855782, "uuid": "1527a486-1a93-49f4-a5d6-384842257180", "comment": "Malware payload", "value": "6251d7072d3b393139c363f9567b68c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855782, "uuid": "66b92685-e647-40c9-ab75-574e4c651aa5", "comment": "Malware payload", "value": "5bbae858e7e2cceef3752d2eb0a4db0b46a15d63a2f346dfee835564aeb78ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855782, "uuid": "ae5eadf8-d9cf-4c4b-b7fb-f39b7ff91b1d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855782, "uuid": "2d9a77f5-3221-4506-9f60-6c93458b2083", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855782, "uuid": "969b50b3-c986-49c9-ace4-fdc999dc5328", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855782, "uuid": "9c9f5b7a-70b3-404a-b3e9-f8e52023f122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855782, "uuid": "01f4dac1-ec47-45a4-8e74-aa2656d7b1ca", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da118e04-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855784, "uuid": "a799f08f-65a6-4877-93ff-bf1012a99fc7", "comment": "Malware payload", "value": "d550efcce73258ec2d4abbb5b6ac8a99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855784, "uuid": "959ca4ca-c57f-4f50-8877-acd5a6e7973a", "comment": "Malware payload", "value": "5bddc00db0418d861de135887b86407945ccff98b49e5e05668695d252d683f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855784, "uuid": "0e65a918-0f27-46be-b1a5-b7d94344eda6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855784, "uuid": "6b60293e-8016-4d05-bdc8-84482ef0f0bb", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855784, "uuid": "126f7bf6-4b48-4e45-a50b-c61bc4a56fce", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855784, "uuid": "b999d068-e3a0-4998-8ac5-86b9fb4e29d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855784, "uuid": "5b02d72a-4571-47ea-8121-fcd9d917bf6f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e57bc62-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850771, "uuid": "3413539c-94c5-4105-ae3d-b194ea794c12", "comment": "Malware payload (Gafgyt)", "value": "34e416f576089bde5c5ddca12bd81e67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850771, "uuid": "8d512d4e-80e1-4c42-81ba-6a129349c5d0", "comment": "Malware payload (Gafgyt)", "value": "5c379f6b5529402e8a796385a99a8df3515952c9830a4708bc9c7c1057efdeee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850771, "uuid": "befeeb4c-c97c-4e6e-8ea8-1b408837a02f", "comment": "Malware payload (Gafgyt)", "value": "00416c1b8538b9f058adbd82db3f229c242ea102", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850771, "uuid": "b6c9d81a-5608-4ad6-a87d-fbdfde80fd8f", "comment": "Malware payload (Gafgyt)", "value": "6102831f9ed39ff4e251d1ee633fdfe3a770d736273e43279f0c8d38ae592d88b5d4311201da3f1bb5b7f8748c5cd09e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850771, "uuid": "0c50e660-d0b7-4261-a598-457b70530108", "value": "T17FC3A72A7E12ABFFE168863107F35F70979521E227919382F26CDB581E7128D1C5FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850771, "uuid": "76607891-b1b4-47df-850f-75830f582ce2", "value": "1536:s7jx1Txaq+rgIyl2rKepS/czO5eXeyyL2b5hJdddddhXotdwmeFfkq+QCyRnVgj:Av2jzO5e4yb5hBXoDwmeRkq+QXnVgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850771, "uuid": "53020519-2d28-440d-bdf7-ce700132b736", "value": 126905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850771, "uuid": "4cc54c06-d7eb-434b-a63d-29702169775f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850771, "uuid": "e8ace63a-2201-49dc-a402-97c6b3cc6aec", "value": "Ayedz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad75537-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855785, "uuid": "fb91d5db-644a-4311-8e30-d7e00c74863d", "comment": "Malware payload", "value": "94fe3a8d3da7787acaa8c4d23f73def2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855785, "uuid": "4e9e9f8e-7c4a-4359-b866-63d74e3272aa", "comment": "Malware payload", "value": "5c402af0de0884c1301a3977002e70d0d6275953906de23e5b7489c661ac8965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855785, "uuid": "fc90aaaa-166e-4778-b597-425c247ed68e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855785, "uuid": "1ad4dbd9-4e03-476d-b0b6-d76c1f0e0a55", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855785, "uuid": "94fd5a7a-558b-416d-acc0-7335308be59f", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855785, "uuid": "2c8453f3-5d66-48cd-bff8-552a1d08680c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855785, "uuid": "35bc830c-6511-480c-94d7-07a40e704cc8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb29a7b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855787, "uuid": "8e75023c-c7d5-4c2a-aac4-f1ff0c2c54f9", "comment": "Malware payload", "value": "c3799bd66bafc9374592fcdf78e53fbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855787, "uuid": "8b042219-4e1e-4c05-811a-1bfc27bd1907", "comment": "Malware payload", "value": "5c4c1acbf68da3339d49b855aff31b564faadfaa93fb923fc0ac88ccf2afdea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855787, "uuid": "8ac6859d-2fb6-4fa1-8dba-8f86dd8dc937", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855787, "uuid": "1658d5df-0c9f-44da-90cb-73253bcbc9d7", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855787, "uuid": "63e93f25-21aa-4db1-989f-419f6eb2b9fc", "value": 2281472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855787, "uuid": "43676188-9b7d-417e-8e3e-3d436aff8977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855787, "uuid": "5625baa0-331d-49cc-8428-6dee5527417f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9637cd-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855788, "uuid": "7d6be49f-1101-4254-98a8-8d643b3c85de", "comment": "Malware payload", "value": "eccb7ab37e8082772acf7cb11e0305c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855788, "uuid": "317b149e-8de3-4a16-bac9-90db44a2e95f", "comment": "Malware payload", "value": "5c9099e6b0ab7c80e057597797bd73165a20b82fa478b9426480189611763abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855788, "uuid": "4b51cb83-2335-4769-94c0-ecf6f71ca5be", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855788, "uuid": "f0c355c4-4d7b-4570-b9f2-b73b6d0b88b2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855788, "uuid": "ff4fb8fe-da21-41c2-b6e7-ce74d125c645", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855788, "uuid": "b7c51cf2-6186-440c-ae18-bacd479dd288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855788, "uuid": "e40dd4a8-b4eb-49d3-8473-75fff6f3a6fc", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5f2b1a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855789, "uuid": "1b4203f6-6f9c-4674-b045-ef29247165cb", "comment": "Malware payload", "value": "8c4258581bfa5b3edf988febb3f40297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855789, "uuid": "28514f3b-dd6e-4683-898a-7ea22729404e", "comment": "Malware payload", "value": "5c961dc29682ce1fdd10b8f2ceede920450223a111c4e8b9d49cc608e3896881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855789, "uuid": "806a3771-17e6-452d-9c84-9e39f291b4c7", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855789, "uuid": "4e58780c-6336-4d84-9c61-4ec089ed5600", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855789, "uuid": "d3da77ad-8f20-42db-92cc-12102be0d402", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855789, "uuid": "fd85f9dc-19c6-4f17-b24d-f9a2e9c32fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855789, "uuid": "4a3089c8-1b24-4c6e-8234-aae300696088", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4ab042-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855791, "uuid": "15557af6-b17b-42ea-8a66-a0c019e74be3", "comment": "Malware payload", "value": "90324590e99dfb587c2edb7b6b487420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855791, "uuid": "1d693fd0-9dcc-49ac-a1ec-5116739b2415", "comment": "Malware payload", "value": "5ca9ac645cd9d1b7972ae402c7013458f9835593047738b388a026a5c61bc8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855791, "uuid": "dfe854c3-1437-438d-98ff-7eca49aab9b8", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855791, "uuid": "6aea28f6-7500-4808-9ae8-b2d13634f645", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855791, "uuid": "ae19fc0b-de90-46b9-bf29-47adb33499b9", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855791, "uuid": "38837f9b-26ee-4078-b403-42d23c0ca917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855791, "uuid": "7156f3fb-ba7c-43e0-9734-4282fc05de95", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0b5969-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855792, "uuid": "08b119a5-7db7-48ed-b72b-d225b4d25b86", "comment": "Malware payload", "value": "13117893a8bb4b9d3a45bc3af9ac0d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855792, "uuid": "25c255b4-bc12-468e-bf4e-3e2c04d20088", "comment": "Malware payload", "value": "5cc50991b81d0f6812fd523434cb5f3910e201e67bc1cdeaeed85450b20c97a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855792, "uuid": "9213edd4-70dd-40ad-92e0-98ee5acb65db", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855792, "uuid": "5634fd4a-928e-4c72-b545-61b108e1199f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855792, "uuid": "dd9ba8be-d650-4229-a247-ed3e287ed5c8", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855792, "uuid": "ba650bc2-03f6-4986-b076-21604b9f7cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855792, "uuid": "48eb7ca8-65d6-48b6-b171-b6277b1a89f0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617314c6-c7c2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829812, "uuid": "e7509579-71b3-4ee7-805e-2257b0ab4f1a", "comment": "Malware payload (Mirai)", "value": "c05e3b15e31f12c15ab0b4b24f81c920", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829812, "uuid": "ffcc9422-82de-47ca-a2dc-9c609099d5e1", "comment": "Malware payload (Mirai)", "value": "5ccf216c20a7a2990b30c15b9d1318f338befa151d31f075a1b16e0a6badf6e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829812, "uuid": "440ededc-f0d3-41e7-89dc-1b42e196d9f1", "comment": "Malware payload (Mirai)", "value": "7ff9fec3325656059b331c7a06666d6e1e6e90e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829812, "uuid": "329e3c2a-9b25-45e2-a2f9-047dd9388a75", "comment": "Malware payload (Mirai)", "value": "5afa0dde758b981922d39d6be186a081abc5adb4bfd2f1e6dbda4d5be0cc953f9826b21515fb422693bcc9f30d1f2cb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829812, "uuid": "33766a9f-2938-42b2-8ebb-0fcb023cf72b", "value": "T107647D88BB0DEF42C18093BBAD6B0623A37974507B8BD7637915612DEDD378C9C5318A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829812, "uuid": "48dd00a3-1311-4cc6-8006-76bb24abd636", "value": "6144:ehsJueIlo8UNBTivKpHBQW+mLohjE0fCHgw52rlTO:Y3vOimhQW+eohDrhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829812, "uuid": "67a9ce3a-0b08-4956-a43d-fca2a04421ea", "value": 309272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829812, "uuid": "9f706d51-8a6b-4282-81f8-1139c0f98ef5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829812, "uuid": "708a4795-8461-47c1-99ef-5378b4a6388b", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc215e6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855793, "uuid": "4b889cdb-a126-4088-8a3a-4288807b4052", "comment": "Malware payload", "value": "5077f10dcc14b8b80cb2661042968cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855793, "uuid": "5739248d-fb78-4e91-8868-4dced85972e5", "comment": "Malware payload", "value": "5cf7ddfa23907ed2b33c3dd5942345c9be45faf5dd2df832dbcf31a0eaeaad02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855793, "uuid": "717803d8-71c4-4b2e-9a00-3d515ff5438c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855793, "uuid": "2c51f2ae-837c-4636-91f2-9cf2341eebb6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855793, "uuid": "892890cc-5e8f-4be9-8e94-88f7bc155296", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855793, "uuid": "48cf4ffe-4d75-4da8-8b20-22a04be7f15c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855793, "uuid": "1f327c34-066c-480d-b5c4-b3c7d0ae9cde", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08a6421-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855795, "uuid": "d9248305-256c-402c-905a-564ee6115032", "comment": "Malware payload", "value": "0d13126536de017094a9b1e22c15a561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855795, "uuid": "e2e741e8-513a-44ac-9f1c-d6ab9f0a0dc2", "comment": "Malware payload", "value": "5d178afd73e7ec067b5298bf1eb95f7b2070fb579c65a0fcece2335dcf84c54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855795, "uuid": "5cbcbe32-e185-4a5d-a574-990c37791557", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855795, "uuid": "ef808e59-1337-49cd-86db-cafbffced927", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855795, "uuid": "02ef13de-4f43-487d-9b68-341f6242c998", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855795, "uuid": "1db8be5a-75b1-4544-8dec-c4319e828eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855795, "uuid": "e973462a-2ff7-4177-bfd2-094643912ee5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb14237-c79a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763812790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763812790, "uuid": "73fece9e-3642-47a9-8033-0ae803c8b614", "comment": "Malware payload", "value": "0a0c2d1c273467e5ecccbe1222a5756e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763812790, "uuid": "49cd7a48-4c56-4d4d-a797-f40123f6da7f", "comment": "Malware payload", "value": "5d4c3f536405ae040761820b7ec39761cc425eea952a683de55c8bb8846f8ce2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763812790, "uuid": "666b84b3-7c39-4e22-ae79-81a342b58a55", "comment": "Malware payload", "value": "c8b7d753132894ddb922a99e97149eb6bd50cae8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763812790, "uuid": "20837444-796a-4937-8db8-1e4316ec75bb", "comment": "Malware payload", "value": "4ade3cfb3276b30db87ebd0ea3e0d5857659693bdf9aa517b715b1088f8e929bc8cd4bbb62259da35c4fcf1b273d57dc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763812790, "uuid": "ae6859cc-ecb6-4926-b998-7cf7f84948bb", "value": "T17A01F5DD4B17BAB32A2DFD2EB6618A4D0050D28C5A3E13C1BC600C6CCCD1A4231A872A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763812790, "uuid": "4bb7a484-9d12-4446-bdf1-c3a821b54475", "value": "12:3J3LVqEKwpLVa9ohLVEFUILVTQUqLnTCUbSLFp1Lhr4LPwtEOXj:3J3kP3NQzTCsS1ywrXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763812790, "uuid": "e7fb1a2b-ce3e-49b6-81aa-7acdfde1cbf0", "value": 676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763812790, "uuid": "14aacbaf-901e-4542-b70c-78bb19e843a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763812790, "uuid": "a124ae5d-38a3-4909-a0a7-bf20ea02248d", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dc79bd-c7de-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763841771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841771, "uuid": "0808fa64-c2ed-47cb-81a4-9c1944ab7c00", "comment": "Malware payload", "value": "889957b2c81a7a577a18223d58c52d8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841771, "uuid": "99c3d6d3-dcea-4bb9-b97d-a0ee67570945", "comment": "Malware payload", "value": "5d599bd71f9fc3ed8fb117dad0af6ff00c502560ef61dd35aa5dd70b204e903f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841771, "uuid": "a5e96414-ce34-4c9f-8d6c-557f9f472dc2", "comment": "Malware payload", "value": "ca36d6d80c39ed7edda5c264dfac3c020337ce38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841771, "uuid": "2b2cd7a9-254f-4b29-b939-d63462d4a0cf", "comment": "Malware payload", "value": "86806e5d8adb795450a5bbfac15d0ca818476324002a27dc7db107709ff3c77d544b00b1a2040ade2597ab8e01d0eaa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841771, "uuid": "b22a5eae-a6d4-4101-93cc-c5cde5263198", "value": "T13CB31856FC819B06D5D622BAFE1E118E331327B8E3EE7112DD205F2537CA95B0B7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841771, "uuid": "78517b64-4e18-435b-8315-6ed93254c4ec", "value": "3072:Trsn1dJzft3/nt2uLRs3l6eTazddtEEDEKBMGqsG:Trsn/Jzftvnt2uLu3UeTazddtEEQMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763841771, "uuid": "da8a2143-b373-4a04-ab45-d3350a2935ff", "value": 112564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763841771, "uuid": "79b9049c-9675-4954-8e9d-8fb1a79ca825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841771, "uuid": "a3dacbdb-ca98-497c-818b-d3763a0de17e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1466c07-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855796, "uuid": "413c5566-d16f-4625-8518-622d749bd1bf", "comment": "Malware payload", "value": "f6a75a1b8bf8df20fd53d7d80b421881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855796, "uuid": "b26a05ad-0d13-4a03-b0d5-c46f79714dce", "comment": "Malware payload", "value": "5d5ca00a6798d7183127db8eb8ef1d230b7cd2fd41002de4beea0c650e9bb714", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855796, "uuid": "cedde6f2-0c3f-466b-baac-0dea39595a5a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855796, "uuid": "3595f2bf-effe-4874-9f12-228abec5a719", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855796, "uuid": "10f9cd11-edb8-446c-bf0e-e75a969b89b5", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855796, "uuid": "a73f0e12-7972-4e84-befd-41e39c35a213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855796, "uuid": "c47d611c-d22b-4249-a0c8-28af07827aa7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bab30d8-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829480, "uuid": "61438afc-b474-4dfd-ad79-5a8b21ba83f2", "comment": "Malware payload (Mirai)", "value": "71a21ca7cb1473382ef3e4bacdc7d133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829480, "uuid": "4fee04b3-a967-465f-b2ae-d0c50e06d7d3", "comment": "Malware payload (Mirai)", "value": "5d821b677a08f9e5862563b2c183ba4bc8db67e5b6de59888c5aa65a566eca54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829480, "uuid": "35f4696f-bbee-4208-9110-23443b475a8e", "comment": "Malware payload (Mirai)", "value": "142a136acb2af52ac4fcd67ba97efc0783e8d11d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829480, "uuid": "cb63ea11-ab34-4a3d-8d30-569f77623b66", "comment": "Malware payload (Mirai)", "value": "6b8850e790b98c201100f8e5b57e48c40a4ad435dd9c7407f5b6517493065c6df027d8125234d3ca0961e7126adbc13a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829480, "uuid": "fdbef186-3434-4f11-9209-f7d5a8abda55", "value": "T13EC35DC4E64FD0F9E85615702036BB369B73FD3A113EEA43D3A89A369CA3580D51A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829480, "uuid": "5c68098e-7c44-4e8d-85d1-e3b6a9b0c4ac", "value": "3072:0TZbTo9L4FrpABvfG2xJ33p3scGDQloUpd:cZvo9L4OG2l5UKrpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829480, "uuid": "be7a934c-bac9-47bb-b513-fdf7d79a8d5a", "value": 127980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829480, "uuid": "becc272d-b7fe-414a-8792-f8656a310288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829480, "uuid": "d3e6f282-194d-463b-bf47-8d05771afb3a", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e218b7d9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855797, "uuid": "fc0434c3-aeab-475f-a8c0-fe1752547b7a", "comment": "Malware payload", "value": "8e0b6523436010c995c5de3bda98d214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855797, "uuid": "2ba460ff-d8c7-4e14-abe1-5eab3398fc96", "comment": "Malware payload", "value": "5dc41a1c42fe49c465092b40d1251495b7851c4983090faa75e5099d72bb78eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855797, "uuid": "83920589-1693-432b-930e-590438c004f5", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855797, "uuid": "3ddae99d-c1c8-498d-aa28-4b252668c40d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855797, "uuid": "17ca64d0-3bd2-4335-9ea2-b978184e173e", "value": 3072012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855797, "uuid": "7b0dcb1e-ef47-47ef-922b-36f1bf164192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855797, "uuid": "994a5642-e78f-4c81-9b16-5311c5ddc73d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8cd1bb-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853484, "uuid": "22773eb9-1904-4290-b5a4-32c534c2e270", "comment": "Malware payload", "value": "2419ccbc40cdae26c2f23fee5c7977c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853484, "uuid": "a24a1be0-f96f-43a1-9531-0b722746b434", "comment": "Malware payload", "value": "5e14b7c839e869a9ec34d847f2607f93d05860d0eedf41b61aabb0f74c501bc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853484, "uuid": "0f6c0289-f934-4943-be5a-b8f76555004a", "comment": "Malware payload", "value": "8b2cccd109481da42e2c88f9cb89feff4db99f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853484, "uuid": "b205cbd7-975f-45e5-b294-8b4e07ae53ef", "comment": "Malware payload", "value": "262a89049b912d72447fd123d8d856c6dbe5a5b7fafb05f8defee9939fe1eda7252886a6ae1f331dde9eb5bb7d9f0550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853484, "uuid": "b70e5158-0854-4d76-a25f-d8e3c49cf39e", "value": "T1CCE33B07E6A851BEE1B6C679CD924C41FB7378594B71A7CF07504AB60E73AD0AE39302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853484, "uuid": "acdca87d-c38e-4b21-b936-04b5e2ca99f4", "value": "bb3ac2c21e02c68abcad237dc3fa6d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853484, "uuid": "012f1470-8b7b-4ade-b135-ec39f3486eac", "value": "1536:/9YXnq9YamgiYSoGR6Ok84vKqILjiCBs86QKLRwqzm4X81Y01NT0Z2bo+W26dwII:SqvmgiYSoIk8uIHzlqRwa/fB26dwIgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853484, "uuid": "46296e18-872b-4755-9b5d-63df7ccbf239", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853484, "uuid": "d7fe5ad1-151f-417b-b460-f8f1e141197f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853484, "uuid": "f40a0c6b-c142-4a3b-9cd0-08b6e4a69b7a", "value": "WinFormsApp1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d15749-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855798, "uuid": "24b1e5c7-8a21-4511-b2a3-37750d91d5ef", "comment": "Malware payload", "value": "c10f8f383f6dc04c7f339a487d327471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855798, "uuid": "3a371e23-f5d0-446e-b8b9-1c4f71ffe305", "comment": "Malware payload", "value": "5e18dc3c32de6dcba0a666150f4380d9ff3e06cd2e437f6ee76ca46a826ced34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855798, "uuid": "c4f63d2d-ba4b-44c4-81d4-5454cbdc7d09", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855798, "uuid": "49c9fd8e-fd97-40c0-bffe-ed461cc003d9", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855798, "uuid": "3a38ebe2-61e5-4aab-ad29-0ae9ea99a05c", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855798, "uuid": "38c3211f-7e64-4e05-aabf-8ec6019edcbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855798, "uuid": "10105761-7542-4d10-a588-64a16ccd86cc", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e389ed82-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855800, "uuid": "2f4a0499-bdd1-492d-91d0-30da958b4cc3", "comment": "Malware payload", "value": "02de11373c602982d2e3eac32672515d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855800, "uuid": "1a1c5151-78f0-4a20-98d1-1c422f1d61c9", "comment": "Malware payload", "value": "5e8e57b0ee5752bdd72847473b6854186a54bb7c2c9d181bd4c0c81af873ea3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855800, "uuid": "3f4a8910-c02f-4d36-8a6e-cd9f16c103ba", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855800, "uuid": "7b37da60-978e-4fcc-adac-da55d26ff450", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855800, "uuid": "97a9e366-534e-4006-9604-bc619730cc6d", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855800, "uuid": "595df2fe-ea56-4048-9624-1b315c01e5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855800, "uuid": "4bcef491-f191-47fe-9f62-48bc7c32b857", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4432367-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855801, "uuid": "25ceac77-9c6c-4dfd-80d9-c987062ebe33", "comment": "Malware payload", "value": "627ac11a704289a3f692a8d9189c6650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855801, "uuid": "16d00fdf-7791-47b2-a645-ce449fa0c587", "comment": "Malware payload", "value": "5eb96dc7ffab59359a7d24ad4e2f1e4775756e828df012f3645c5b78e8307ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855801, "uuid": "9ed699b6-20a1-4f4d-b912-077af1f11a5f", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855801, "uuid": "9e4a24a5-5a9d-462f-bc8d-c3a006303ab7", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855801, "uuid": "d3f66102-799f-4c58-ae7c-bd6c5296a959", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855801, "uuid": "b6dc850b-7aa6-49eb-bac3-8d57905df582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855801, "uuid": "3e5565ff-76bb-4eba-abd4-85b9577a6326", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5137a45-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855802, "uuid": "24d77872-ca27-4170-9653-2d7ac16a45ab", "comment": "Malware payload", "value": "8fd742a2feed6ba459f21d1941f9a9fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855802, "uuid": "ec5217a0-d8d4-4474-9612-bdf7fe99acee", "comment": "Malware payload", "value": "5eb98f74e9b7e06d7eba1ee76dfc84e3c9ff5cfe909082d302c742262e1cd4b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855802, "uuid": "a2ae496b-bbf3-4c9b-a1c8-ff49799a99f6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855802, "uuid": "ff4591e0-bafc-4177-b083-cf40bc0f0e75", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855802, "uuid": "d241525b-db1f-4bb0-843d-44d8db2909b0", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855802, "uuid": "262f5744-1fde-4b54-851d-2eaf53e00c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855802, "uuid": "90c305f3-f4a8-4bf5-92c1-79d5c331e3ba", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e12edc-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855804, "uuid": "505d2895-252f-45af-a0c8-e0881f79c635", "comment": "Malware payload", "value": "10de1689b2787a1d79d7769ccc7f4da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855804, "uuid": "7384c8c8-a9af-4066-8b61-2ffeed289e3a", "comment": "Malware payload", "value": "5edb5ef2ee5a628ada20897ad23522dbfe1664383be33358308619937bfc2bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855804, "uuid": "8778c469-3174-485d-bf7a-b30da577b4b2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855804, "uuid": "2f25d051-3ef3-41fe-85d9-6b14b217160d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855804, "uuid": "2fe72957-aa1b-44d3-88bc-271a64823ea3", "value": 3273216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855804, "uuid": "a134e3af-7f9b-44ba-b99e-f99c60be6e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855804, "uuid": "c06fb153-63cd-44ca-b0e4-ab7bf1b03ec8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b3753c-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855805, "uuid": "2e00cc83-bf1e-4e75-a9be-ef484dbe4503", "comment": "Malware payload", "value": "bb13a829c6b7a5f6387ab991685d18be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855805, "uuid": "6a3c82f4-0bd0-4c66-8501-df3b21182f6c", "comment": "Malware payload", "value": "5efb826357b036519a03d73b26fe445b1fcddb2a3a681926bcd0d5907b5aae72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855805, "uuid": "37d2f893-2d90-45a6-a8e9-39c8b456f92a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855805, "uuid": "88fb5614-70b9-40ae-a33b-8da0cbfd91c8", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855805, "uuid": "1693acfa-4674-4b4d-99b2-8be0296e5964", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855805, "uuid": "c36c2b73-af33-46ec-9a39-e2dc285438d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855805, "uuid": "e6568c04-1ef2-4ce5-ba54-824740905c3d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7840b3b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855806, "uuid": "44346a66-f2ce-4ca3-ade8-be7d297e3ded", "comment": "Malware payload", "value": "0f8b2d780442238145adc14b972f2013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855806, "uuid": "44b6bde9-da61-4da6-8208-c34233ee85c0", "comment": "Malware payload", "value": "5f059e8abff7fd8790a9be88092da38b42ee01b2889879c35aaa190b34a8a933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855806, "uuid": "21f149e8-e4ba-43ba-b5b3-cf02e4aecaec", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855806, "uuid": "0aa94271-683f-4477-878f-b432848bd82d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855806, "uuid": "9afd3f1a-b1dc-4c43-91f9-73026ddc545e", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855806, "uuid": "371fe554-ee15-4a8d-9fc7-ce22d302289e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855806, "uuid": "e66d2354-2212-48de-b26e-5bce2180357f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8590d92-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855808, "uuid": "eb735564-ac1d-4958-bc6f-f6e32da13d2d", "comment": "Malware payload", "value": "942f738496b4f529774756e03bd6baa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855808, "uuid": "ea6bf56b-1e45-4d4f-9a0b-3427a9cc4afe", "comment": "Malware payload", "value": "5f41ac1329f24ba1b4b73f37663b574a07a1fb615fcd26d78ba30c7b37f9dd10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855808, "uuid": "84c4e2ce-df78-4852-9727-dfd4b0c33638", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855808, "uuid": "5e4ce7b4-2b4a-4173-ac38-eaa95c77907d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855808, "uuid": "1c75946e-1b86-4066-a427-34ff2397440a", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855808, "uuid": "79aa22d0-94cc-41dd-bded-33ffc7dc14ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855808, "uuid": "7aae5c7a-edb6-4662-b27d-b082279eb15f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e611f2d-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829404, "uuid": "84739075-c929-4299-82e8-e98e2d0c00ea", "comment": "Malware payload (Mirai)", "value": "5e23fe7960bd831eb3345d739ba08f04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829404, "uuid": "5ce062ec-36a1-46f2-8370-219f522b7ceb", "comment": "Malware payload (Mirai)", "value": "5f4e153c8107eba841c35ec284550fef6f37149f5e340f8c93a51de95eeb368f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829404, "uuid": "442ca19e-1b5d-495d-8760-87ec12ead945", "comment": "Malware payload (Mirai)", "value": "8a88f5e46df0176d70026476d6f9ca9852575b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829404, "uuid": "fc6b450d-f5f6-4bb0-83ab-2a51856f53ff", "comment": "Malware payload (Mirai)", "value": "6d750f268b606c3c3f6164d3f3db22e7e647c64b4d1fea1270a597537d89f619d1ac8223eaaa4a951f1fdeeb39fe9141", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829404, "uuid": "c58f8ebc-e9e9-48f0-aa3b-84eb74a47e4c", "value": "T10753F176E8BE0956DEF2A9771D07B89133C0B38AB785CAC065C56F562242B76D810BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829404, "uuid": "8d0205d2-8aa9-44f4-8588-9c8e8fb6a2bb", "value": "1536:kR/iwbxGyyhY1cmvdcTBqUErQUGNfe8ZZ9ZL4u+qgw09I:k8wbQ8d9UE9V8f7L4u+qgw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829404, "uuid": "c8e08961-d97d-423c-8d2d-9c572716401b", "value": 62520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829404, "uuid": "8f84738f-8c2d-43ed-9e89-877bc1886efa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829404, "uuid": "4d1ed9c5-6ca6-4ec4-9593-a85168f8736b", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91d015e-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855809, "uuid": "fd5f923d-745d-4c78-9a31-446de094771a", "comment": "Malware payload", "value": "2872e662801005a47659a9518f64236c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855809, "uuid": "16301bdb-9445-407d-af87-739402c29d54", "comment": "Malware payload", "value": "5fa2b496df919231385927be00a94d6d0aa9b653c31f7720840630c6bd3c0931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855809, "uuid": "b884cbad-4491-4c6c-9b5f-faad9129c272", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855809, "uuid": "d9f9876d-c39f-4ac9-9cd0-5ffc4e7cd908", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855809, "uuid": "2aae0b51-c513-4c1d-8a78-0f1fb372305f", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855809, "uuid": "2bceae71-a086-4770-94ee-56798484957a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855809, "uuid": "da4be350-4ab4-42c0-90ff-1527cc4d00a7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f1eb9d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855810, "uuid": "1db9a1bf-0f8b-4bf5-af64-32a486fd5ee7", "comment": "Malware payload", "value": "694816c9f508f8fa2bfa02c98746e784", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855810, "uuid": "dbb7f321-909d-4fbd-9a3a-933bc6c3c42d", "comment": "Malware payload", "value": "605369605c7caf631dfbdc52e7cced46a425175092d7e593d4a1b799c6ba377d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855810, "uuid": "5fe4f499-db2c-46c1-9d45-c389b2a92ec2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855810, "uuid": "15772573-87b4-4e0e-b3da-bdc2197ee4af", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855810, "uuid": "86a51e15-315b-41c6-a71a-a98b233de302", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855810, "uuid": "1b42429d-4535-41f6-844a-adeb997f6d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855810, "uuid": "8bbfc23d-3f90-4315-8935-235901759065", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be46bef-c7de-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763841774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841774, "uuid": "be932eb1-fb03-432f-a974-f5a044607184", "comment": "Malware payload", "value": "578375a8f1611bafef360d90b473d4c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841774, "uuid": "ef84e659-18ee-4b08-b99c-3d219d71c114", "comment": "Malware payload", "value": "607ba8678ec0bedb0370c99a382fcada0a60080d2258f59d330915f4b0dae33a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841774, "uuid": "b89f2965-bd59-41c5-a352-21175dc6ead8", "comment": "Malware payload", "value": "d97ae64a76742b424a82eeecd25a482e47691dc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841774, "uuid": "b941a8fb-fc87-4f11-bfd4-4548e0854173", "comment": "Malware payload", "value": "c0c35075631373b1b182549d5cb5f8f954c0a4c9e2c33aaeac7aaa1ef577e916692bcb98bdd678de31a274220af5f5f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841774, "uuid": "187f77c2-5a43-4efb-aac4-3718b62b3d64", "value": "T126933855FC829A17CAC0537AFA1E42CD371623E8E2DE3217DE219F22379B55B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841774, "uuid": "ca6df1af-4727-4eef-bfb0-547697e1d51b", "value": "1536:3qHoI5yqOdNtHLPnsnKGe1SrvJIHypQaNn83YCDjwT48dC5EKvYDy6yvvJsg:6I8yqOdnHLPY81AnsGKrXJsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763841774, "uuid": "bcccf844-107e-42b0-bee5-1d1359356291", "value": 92044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763841774, "uuid": "6b66d0cb-7e88-4357-87c5-dc3283e12d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841774, "uuid": "bc3ed8de-68a2-49e0-a453-8fd73699e374", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0325451-c7ec-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1763847956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847956, "uuid": "9d0a23fa-af34-4ec8-9a08-b934dd6ef1de", "comment": "Malware payload (BlankGrabber)", "value": "597a413fc42a9e8cef147d419096f942", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847956, "uuid": "10725257-9dc7-4aeb-9145-9d4f74ae1c53", "comment": "Malware payload (BlankGrabber)", "value": "60e19264a1d3b5e9e0f73a0755572cf20b5a9ced7b863e0793db20ffeb12badb", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847956, "uuid": "8111cf04-16ac-435c-8aca-3b9219768cc2", "comment": "Malware payload (BlankGrabber)", "value": "67bd1a84d30fcb38e901c972083d41374db07d32", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847956, "uuid": "c8a01f4f-add9-44bd-95c8-9c3766135073", "comment": "Malware payload (BlankGrabber)", "value": "f2ffd2fda1f2fe96b7702b9d15ed8f733228f784fd2b919921c82522bcc559bf9bab041caa04debaf4b1caa535284c8a", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847956, "uuid": "fe6e4f68-99ac-478e-a1f9-e32676659f11", "value": "T107B6334517F604FAE9E3897E8EA39876E733F9510B65C6CF01B006291E57AD20A3B731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847956, "uuid": "0a689cef-c159-44cc-a560-f24a508e919c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847956, "uuid": "c6517969-4e0d-4175-acda-cbf37e960de5", "value": "196608:jro9Htxf03/4Rj9fZwQRCgT0E7KEpPx1JmIoy1PZAM9qxgx2IbMyDndkyL:jrkHt903/4xw8ZtJroy1PZ/wKbFkyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763847956, "uuid": "5d0b4c10-61a9-453d-b910-170acd6bd72a", "value": 10642516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763847956, "uuid": "d0cf78da-a49c-4881-93dd-35335c06b718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847956, "uuid": "f1b2ada3-7785-464d-955c-9360b5846217", "value": "kama.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab5d769-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855812, "uuid": "e0b95bde-37da-4dda-aa86-c3fe2d7660ff", "comment": "Malware payload", "value": "dcbab6425d2251467b58f7366d91661f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855812, "uuid": "b556b753-bee6-4098-8967-59497e28ec41", "comment": "Malware payload", "value": "6123c6c12666929b8b06a3b9e62939dc11a9bc5b1a52b6d1cf645c71736aee65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855812, "uuid": "d68f10f0-eb7b-4e20-8b8b-96720b2160f1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855812, "uuid": "59c3fbad-ef80-43e0-ac19-4dd4168a8406", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855812, "uuid": "16ad88d1-d6ca-4f78-b0ff-a451e39199f4", "value": 745484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855812, "uuid": "74907a82-6bba-43aa-85ba-4a3d84242025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855812, "uuid": "730adf87-3a44-4189-9bff-abb41da5e1aa", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb708874-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855813, "uuid": "48974258-d0e4-443b-9dfa-48640981f114", "comment": "Malware payload", "value": "fc21a43b07bcde3cf36f359e3c9ec75f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855813, "uuid": "050b15fb-4c66-4e52-9dc8-d392b624fe61", "comment": "Malware payload", "value": "6124c1432d2bda3d29dfdd3d6957153c660a3bef5079098718b041c0d86d2dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855813, "uuid": "b15aedac-6eca-4f41-87a7-d7f9d4842668", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855813, "uuid": "cf1fea45-07fc-499b-9d00-7ce4a57535bd", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855813, "uuid": "ba9dde24-4495-40f9-a419-8cdc4d83bdbe", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855813, "uuid": "f62744a3-7fda-4bd0-9850-3034b5a42aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855813, "uuid": "0edfa456-336d-4dba-af56-086bbad05ed1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec434bb9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855814, "uuid": "78d4f305-8e99-4b3b-837b-3af29ac4312d", "comment": "Malware payload", "value": "36220cee4ba34126006cefd66275fa7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855814, "uuid": "df059875-b37f-4f0d-8634-129e942e5a0a", "comment": "Malware payload", "value": "6134ef2fe8f9562eefbae2445f708c9e9791c12a63b646722646117acb9e8c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855814, "uuid": "1af55295-37c3-41d2-9e3e-e896ea96969d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855814, "uuid": "e0992fdc-e9c1-446d-a7bc-89ecb1870207", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855814, "uuid": "c5187a68-ab18-4da8-92c4-7f9820a23bcf", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855814, "uuid": "8fbe5752-52a6-49c1-be6b-fb6db06af646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855814, "uuid": "8bfd5620-62ec-4072-967b-135743805cd6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dd6e79-c7bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763827266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827266, "uuid": "441f7eb6-d7d4-4d65-bff3-b47e7ab65b36", "comment": "Malware payload (Mirai)", "value": "cd00fca4d880ed71cd8911917065e383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827266, "uuid": "7addad7a-9782-433e-9c33-232bcf4f796c", "comment": "Malware payload (Mirai)", "value": "61687308b63bcf688a01e15db491c5e0d94bdad5f3b509174f8f3601d9cf7733", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827266, "uuid": "bf3c88db-21ed-4d7e-9b74-7e9230e0f041", "comment": "Malware payload (Mirai)", "value": "c6133e83298c7c517f0515c36d4ca65ce3499d73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827266, "uuid": "46ce6d81-8796-4fc0-8bcd-4c3079743dc2", "comment": "Malware payload (Mirai)", "value": "0c01d646bc2fa3cac9b5fb64bcaa935c68cc94e9613fa6da42debe888c0e4dfdc23e462e1fe690ace5860179887d2865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827266, "uuid": "7c71a742-e314-4273-b73e-d83803e187ff", "value": "T13B6302A929C46FF3CC945930DF93B4F760CBE2E506A4B6E3ACC8C08C6A1155D2D79298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827266, "uuid": "be42aaac-20a2-48e0-bf68-097c9fc73a5b", "value": "1536:b8ucGD33QYjf/St9yPNQH3UkuoXjYJS+M14gcOfZlzefWor5:Au3Ddjf/mmNiUUR94gcM+WS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763827266, "uuid": "d3d82603-ef0a-4ac7-8432-fe49ded0c317", "value": 73228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763827266, "uuid": "23691393-7ae6-4bbe-8b58-84b2efc8616f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827266, "uuid": "0da157b6-1b35-4e23-9919-28957825d50d", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed026f7d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855816, "uuid": "f7607412-f97d-49bd-be41-a6bb183f92f3", "comment": "Malware payload", "value": "c91c07e5d50a384a160a95f405ce31cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855816, "uuid": "578b0a45-bfe1-4f9e-aacf-e2e21f7a5df4", "comment": "Malware payload", "value": "61778564960119b20f4410a2fb4eb71b081bdaef5a812ef53b0e7792ddb86e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855816, "uuid": "ad544bf9-5ea8-4334-a8e3-bbbb54f8e5e7", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855816, "uuid": "830655c9-3270-4b89-a07b-3c9ef9424fbc", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855816, "uuid": "a35b1517-5293-492e-bef6-23fcccde446c", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855816, "uuid": "367b4eae-c3fd-461f-8875-dbb70f9df4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855816, "uuid": "f5124fc4-92dc-4c1b-867b-3dc8f2ae91bb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc59093-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855817, "uuid": "6a556024-8137-4bbc-9cd0-c14799a9f614", "comment": "Malware payload", "value": "b1f038fed201052bf5507c443bcbc772", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855817, "uuid": "8b9f7135-4f25-426f-a898-ab9d0e1354dd", "comment": "Malware payload", "value": "619b4b31f302fd1162d49c3bebdec1a334fbeba8f4dcf6619a26b9c0f91cdeca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855817, "uuid": "4ffaacd3-f914-4aaf-9ea9-911d8d60fd3c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855817, "uuid": "11a142e8-a10d-4a78-bde4-9773cf7ad51e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855817, "uuid": "77b6fb92-81b7-4dea-bc6a-e05204333193", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855817, "uuid": "ff07b5bf-5030-48a8-933b-2bc638efd990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855817, "uuid": "37130aa6-c3d4-4f02-b9d9-dc364935f1b2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9858a3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855818, "uuid": "68628df3-2904-4599-8d77-337d5aca074c", "comment": "Malware payload", "value": "25e5639e595231bdbdbc462335e67d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855818, "uuid": "4ee7d380-93b2-4b1c-8aab-7ccc13b77a3b", "comment": "Malware payload", "value": "61a9aa9fca89633dd821b554897d22e373c338d8b02276f2138df9282248feab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855818, "uuid": "36e51a7b-65c9-4678-b42b-fba7e5e0c314", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855818, "uuid": "5cd70b81-5bee-4b72-b9c6-062b16ed7784", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855818, "uuid": "acee7de9-6995-4073-8165-55bcb053e506", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855818, "uuid": "a693abc9-f0d1-4e93-aa31-3088d9d976d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855818, "uuid": "64f5d11f-5fe2-4a51-8609-7d880188d021", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef706708-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855820, "uuid": "1154c96b-bb91-4e9b-b805-39061701406f", "comment": "Malware payload", "value": "3c39c49386495a327ab87cdf0cf31b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855820, "uuid": "bd467441-52b3-4433-9d7f-7b8663530d34", "comment": "Malware payload", "value": "61b25d12b8bee84dfc7f3d470073d90ba6387e6ca067e549b579fe837c84b55d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855820, "uuid": "d4b5d8cf-9941-4dd6-97c2-817c755086f3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855820, "uuid": "5ddafe59-cfdc-48be-8fbb-03864876c364", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855820, "uuid": "54231b8f-4291-419c-bae6-7b14195659cb", "value": 3054592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855820, "uuid": "51480812-5457-4fea-80af-8e0d8bbff334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855820, "uuid": "bc22d480-1d58-4363-95f2-798c69a8fc55", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03917f0-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855821, "uuid": "444a2732-177b-451c-b9d9-e374fc74e1c1", "comment": "Malware payload", "value": "fb2a0a2da1494ee0a827ba9565db4d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855821, "uuid": "9609c589-0328-44e6-a0cf-eacf3f98d5b1", "comment": "Malware payload", "value": "61dbb9d1a80b215fcda79a2eb307bfbc5a665266b42fce5d129b3c7d75dd623d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855821, "uuid": "33ba6154-660e-410c-a4a8-de2377b99c5e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855821, "uuid": "7bcd601c-8d27-4322-951e-bd34289523cc", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855821, "uuid": "1960d252-b36f-420f-931f-b7bfb82e9e3d", "value": 726017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855821, "uuid": "efc628ed-4ad2-4355-ab70-d02d837cd844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855821, "uuid": "5a02c065-898d-458b-ba27-fa834bdd5549", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12ec3f6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855823, "uuid": "201f3df0-490b-4309-a05e-146ba6dc24a6", "comment": "Malware payload", "value": "90165ab94213c4d3440321ef7704f27e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855823, "uuid": "f2a2239d-fdb1-4067-8183-3b3d782eba5d", "comment": "Malware payload", "value": "61df46722e46c0b27bf4ef7b65159244be35251a24d57a9285910096b78ebedd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855823, "uuid": "53929730-0301-4499-8f3f-a6b81d43c44b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855823, "uuid": "1b57c2ac-8fd0-4e66-bf2b-7496a5958fac", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855823, "uuid": "d7dd6a85-20e3-41fb-9c82-c4aba9a1a680", "value": 8774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855823, "uuid": "35bd9bfc-5507-4475-bf74-c688bbbe1964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855823, "uuid": "662c50ea-951d-4248-8ffd-0247566b145c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20bbb47-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855824, "uuid": "54d6b957-0fb4-439b-8459-4646867fe5b2", "comment": "Malware payload", "value": "74137e6c59fc320bc8a101492c35dc28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855824, "uuid": "8e6d6457-78c8-4ce3-b67f-7249a4464f38", "comment": "Malware payload", "value": "61edb0e38121fb1eccae6cac742104181a363d4cea537e657d3d4ad3015cc4bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855824, "uuid": "1a6e0ad0-416f-4b86-86c5-10ad3277b0c2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855824, "uuid": "14b8e34f-0096-430a-a0c2-128391a3c5e6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855824, "uuid": "19991791-59a7-4943-a86f-da58255820ae", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855824, "uuid": "b5c0cf68-8503-45f8-8691-570734a638e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855824, "uuid": "a0612082-1398-4a63-9640-a1b97355ed05", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c13189-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855825, "uuid": "361da548-7f67-479c-8554-e1605f016a89", "comment": "Malware payload", "value": "e1775439504ab760275097fdfa780dc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855825, "uuid": "fbbe554b-2c2a-43c9-b220-b0bdc0ace0a4", "comment": "Malware payload", "value": "61f5af286edc8f5caa5ad1aa1dd2fa308d70be2d449ed2e18d63c79beafa0fc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855825, "uuid": "b91669d8-0c2f-42ae-9c41-b64ba4ab1c24", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855825, "uuid": "daeb4c41-c06d-442e-9844-c8418b6da9b8", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855825, "uuid": "48621cae-4d15-4d9c-a053-b575053ebe29", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855825, "uuid": "f775c825-8f73-46ce-b91f-177c51d1efda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855825, "uuid": "b963e36d-618f-4a5c-bfd0-6ca56f384375", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38050a3-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855826, "uuid": "f996978e-2712-4c9c-a40d-4919c49e120c", "comment": "Malware payload", "value": "1865a4f15579657b98e0b407293b87de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855826, "uuid": "c8cff955-024b-4b1a-83b5-996041763963", "comment": "Malware payload", "value": "620fd19ec42d326e4473b2795b2321262d18bd22a159f6d086f7d96abba45d8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855826, "uuid": "655d3044-cd46-4619-bf26-a03551342af2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855826, "uuid": "af500fc7-dbfd-4154-9f52-7f9557130c87", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855826, "uuid": "d982f4a1-4f33-4ada-914b-1d2bb3cf0d5b", "value": 1624064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855826, "uuid": "90dea3e1-a972-471d-aa6a-a92654687aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855826, "uuid": "5f7828fe-ea47-48e8-ac33-bf675bddc43c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb8f951-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850774, "uuid": "e5b643c8-d9eb-4673-b5be-7074ddc3cf95", "comment": "Malware payload (Gafgyt)", "value": "861f1cbab0459bb9f29d9d436c4c1e35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850774, "uuid": "d8bab91c-7159-4c3a-a22d-22784913eacc", "comment": "Malware payload (Gafgyt)", "value": "621a229072e7171fa334434eb119abc7af1dbad6e22c2c35685e29c072c24ab8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850774, "uuid": "388ed610-1966-416e-b2b5-9da3e80b23d3", "comment": "Malware payload (Gafgyt)", "value": "d1e1aaa9906906c7bd663c23d6be601519d06aad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850774, "uuid": "e29b33ee-8e5a-4162-b8cf-389b544a72ce", "comment": "Malware payload (Gafgyt)", "value": "bdb91f4d9d646486620961f59a87d99d37f29d0bbc57803a02bf8c1261bdcb42c4517acc16cbb132d3086fea3cad22c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850774, "uuid": "a1090193-997a-4e58-b53e-880c4034329e", "value": "T172934D43A8654FB3C0825AB5256B5E304757E8D20F4B1B96713DAAF4474B9CEB80FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850774, "uuid": "895c8e1b-4f11-4516-ad42-33b5e393ec8e", "value": "1536:U6fTKf2KWX5FkwPIrpm1NCi5hxdddddvBRs6teH/0Om/j10PILDLf3Ij:3f6JWcwPLNT5hXByHMOmb10PIvLf3Ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850774, "uuid": "c5e43682-adaf-4dc5-b2ff-3aa7b8ff4775", "value": 89836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850774, "uuid": "e90f9151-d509-4460-823c-0cb1bcc5bb81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850774, "uuid": "5ccccbe1-0725-4613-ba97-6c5055222cc7", "value": "Ayedz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb93c3bd-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855330, "uuid": "be278f59-7894-4ab5-ba0b-54e08dd9131e", "comment": "Malware payload", "value": "1495535e2ce068b52308ebb4d7570203", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855330, "uuid": "a2982bb5-573c-499d-b647-a4078c6a45ef", "comment": "Malware payload", "value": "627e0a286e2dcce770a2ba52400f521642214674e5091861cecc040a86eefe86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855330, "uuid": "e1f99f7b-ff49-40cf-b458-f6b7440576a6", "comment": "Malware payload", "value": "d300730a50f4b46552927f7e0c4aaaf7ad1bdc9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855330, "uuid": "3f07434a-9783-478a-ae15-2f6d2662d99b", "comment": "Malware payload", "value": "207a6e8e441238756958e68ab9930596cb8a5729b6d2714d4085f84e6471ab3c363de1515b71871717fa61f18a1190ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855330, "uuid": "48c9a1bd-5cdf-4be2-9762-6eebc0b43143", "value": "T140935B22FA79193BC8C4A97662F30762F1F7438724A89A1F7C710D8DAF6465022677F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855330, "uuid": "496c5467-cbb5-4f99-bd0b-910169bec037", "value": "1536:6qKCLw6IMIXR3OCiIp86P1h2VDtoiJq57zAZwralt392BY:MLrOYKGiJ67sKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855330, "uuid": "dd59b1ee-910a-42aa-b9df-d5ff70bf678e", "value": 94944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855330, "uuid": "1ecb16e6-8fb2-4588-9ad7-bd9e1c40ec3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855330, "uuid": "a75811a5-8779-4279-ab33-11f9a5a7623e", "value": "Labelloperc80.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44f3a90-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855828, "uuid": "5ffa6224-8503-419f-80bb-a0a7fa844df4", "comment": "Malware payload", "value": "31af5ce72465b58c5608dfb6a7ab3627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855828, "uuid": "30e1d561-535d-484b-bf24-d006cb79a554", "comment": "Malware payload", "value": "627e55505515cb8543fbe1d371f2e323a99df256f792fcc45b7cd3a2142d76c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855828, "uuid": "da993ba8-0e0e-4304-b1e6-6e2dae55ac04", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855828, "uuid": "86411e64-dfc8-4f98-b693-aad7c7df3328", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855828, "uuid": "1f9d26cd-ab26-4a41-8d37-13b01a056ca0", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855828, "uuid": "7cebb675-23d5-4da9-b253-25e55e7f3fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855828, "uuid": "48ab5cee-74d6-414d-9dce-8de8263869dd", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52a536e-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855829, "uuid": "13f5dd7b-abc8-4297-97d9-c745ad92a6fc", "comment": "Malware payload", "value": "81eefa20aae1cd775475c1da107b5e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855829, "uuid": "757699f4-a625-4337-8f3c-44ba2c201896", "comment": "Malware payload", "value": "636d692fd06067c7673dc67e7494598e09dc0d516bab9590dd459c8e9603e31d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855829, "uuid": "ac7d68df-c39b-46e1-97bb-1d1bdc482ad4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855829, "uuid": "b6cc6e8a-f514-4185-b03e-ab9cb385f46f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855829, "uuid": "3c521b7f-010c-4dc0-9d39-6df5ed760714", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855829, "uuid": "75262943-8927-42a7-8bc1-13029b033c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855829, "uuid": "cc666cf8-616f-499d-997d-31af5e7f6329", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f7753e-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855831, "uuid": "ecf7722a-b1aa-4a5d-82fe-cbcb278e0d98", "comment": "Malware payload", "value": "316398778a792620ce05d9959294c2be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855831, "uuid": "b8d6190e-a962-4005-a8c3-beb2e55c63bf", "comment": "Malware payload", "value": "63d2adf630a9ad836f0da2d25bf7a34744d225161e28fd9b8ddb93f325be70ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855831, "uuid": "3f9aad85-2c3c-4402-98e5-e386dd4b5be4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855831, "uuid": "007c5ca4-de45-4f65-9784-dd12917284e1", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855831, "uuid": "a2fd06a4-bf2a-472f-8140-820502dfbd1a", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855831, "uuid": "b32f526d-d369-441e-b842-95039cd27c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855831, "uuid": "af28457c-eaa9-422a-9f67-7b33da196d9d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1079c2aa-c743-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763775130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763775130, "uuid": "6aa8a586-5ca5-4f89-83e0-958226b41366", "comment": "Malware payload (Gafgyt)", "value": "fbb72df1437332028fad7d4e2f590cf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763775130, "uuid": "704bbe5d-3042-448e-85d9-84bab7c50e00", "comment": "Malware payload (Gafgyt)", "value": "640038bdadf9079adf1ab02bfaa8956d5e6c9e3ee2acdcfbd831608ed5eb13ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763775130, "uuid": "e2f2ba24-1992-4daa-8319-6e6c39ffe717", "comment": "Malware payload (Gafgyt)", "value": "57fb7b7cca1e3ad4990ebad0ab44a0485e536587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763775130, "uuid": "3e3f3fe3-05c2-4baa-9c06-30f2e01f555b", "comment": "Malware payload (Gafgyt)", "value": "3c5695bfd07ff3a3f614e8d4c58eb935f4655613270e7484bf06cd69ea94fedaed2f94e5022d652ecbb069a335907cc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763775130, "uuid": "a4ef01b9-e08f-4392-a847-3f1615753ef4", "value": "T14C33764A2E229FEDF76DC63087B79A31964933D626E1D684E29CD9001F7034E641F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763775130, "uuid": "b2e1cce7-6d27-4918-bb76-232bcad1019e", "value": "768:d+RHYpovKCE+aQhIiolT0O4t0GM4Y4a4Yp0fKjynOZoH3ynY0O1WDKh/9eMXVKlk:ohIigTiJlzotYYOqW0uchIYmRQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763775130, "uuid": "cbdba201-fb99-4078-83ef-f031659c0693", "value": 53196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763775130, "uuid": "d86c9a58-7f46-46fd-8e33-8b913bc53e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763775130, "uuid": "a1666a2e-7843-4e9c-ab3b-bf04175871af", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d0a65a-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855832, "uuid": "f704381c-92c5-44cd-8178-b8fe3aedc8d7", "comment": "Malware payload", "value": "60d30d3f2f24542a6dd7e5ca8044d907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855832, "uuid": "5d328ca7-5df9-4dba-8376-26fde8698e5b", "comment": "Malware payload", "value": "646c3d1d67a3237bf12bcd38d5948d6e8d64c3d507bfb51b2cfa63dd685f8ac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855832, "uuid": "77184e37-e967-42ce-a980-a808f879e1b2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855832, "uuid": "869d10a1-6a08-452b-a1bf-4829eb6d4b88", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855832, "uuid": "fd869b47-0333-463e-85d1-d9132f378fe5", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855832, "uuid": "f44d61ef-0510-4232-8c5c-523c713aefab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855832, "uuid": "202cf92c-6fc0-4a09-9d3c-1498692f616b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a76ef9-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855833, "uuid": "f4b4af76-97a4-4481-8b93-3ee854c790ae", "comment": "Malware payload", "value": "437f16ad1ffccec3101083acfdc25d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855833, "uuid": "a3714c54-7c3c-43fd-b0f1-b2b984c09971", "comment": "Malware payload", "value": "6472f752076cc6438602235268816776307f33ac530d81100ad88e5769619654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855833, "uuid": "7f66801e-0dbc-49dc-a62d-77bda0af95a0", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855833, "uuid": "666da8fa-7cf1-4dec-ac7e-ecec10213311", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855833, "uuid": "8277bee9-d2ce-425b-8076-badaa391e169", "value": 3330048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855833, "uuid": "31d8482b-4e0c-46f3-b0af-477d0028f761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855833, "uuid": "af5806ed-138d-48f9-969e-c8524b955375", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a0be87-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855835, "uuid": "66cfa278-0de5-4c78-a88a-2c4116bd8989", "comment": "Malware payload", "value": "706f8c3efa57372904da7e17dab2b3fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855835, "uuid": "e3f64f67-1ad5-4af9-8e1e-6ba7130d9d0a", "comment": "Malware payload", "value": "6485b40102e6e31c984a2d6e44967dc849b0e91213bbc001a59a404d21d9dc25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855835, "uuid": "9e8c64d1-5e3a-4552-8b3a-64481d23b05d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855835, "uuid": "ab9fbb12-c0b7-4c77-a051-7779c76325b7", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855835, "uuid": "d7ee3ba1-bad2-4649-a4d7-3d344e864a6f", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855835, "uuid": "bf53ab41-4843-49c2-b064-ecb0e6a920e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855835, "uuid": "6cde40d4-f5c3-48f2-80fb-7bc6fc50c77e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a3958d-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853110, "uuid": "8672c741-1152-4c0b-8fb1-342f210bc8c9", "comment": "Malware payload", "value": "e43948740fcab8fc67eeb2e4b86b575e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853110, "uuid": "76dc8ee2-1ec9-4b90-a501-dc49cb59416e", "comment": "Malware payload", "value": "64954b00681201ce5bbb21bcb22d781076f3abf9211b40aaf717f6dc04e0beeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853110, "uuid": "f03bda87-36b0-46be-86b1-c12aeb4ea3e6", "comment": "Malware payload", "value": "18661a93ca704ee891086c8d2379f89d885909dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853110, "uuid": "0ef3aaf2-a8a0-4458-bbc4-1bae00ffa825", "comment": "Malware payload", "value": "cacf3aff2bde61a861942d026de743d1b805047d4e85aa0a962904e55222a9e519d3835e6d7be984a8bc570f6bf04eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853110, "uuid": "5c932e43-fbee-4a82-8285-31dc00848d26", "value": "T1A9927D579EE08813EE5BCE75F4F6851399B0B3422CF9C5DB618D812A4B413902FD936E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853110, "uuid": "db89d8f0-1982-4871-99da-1dc530a11039", "value": "384:Bpv8lVw9CBEqnOVplV+8H/uo6ki2R5siYlnMUy8RbmL4nNy8U:DEDwEEVF4zr2RBYZ5AL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853110, "uuid": "a756af33-8b18-461b-b099-226ad294b892", "value": 20840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853110, "uuid": "2a19a328-5e65-4f76-9452-7063af0967d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853110, "uuid": "c4aaacf6-ffc9-4080-9d64-cf5ab9076a71", "value": "UpdateRetriever.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6edcf2-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852942, "uuid": "c0edf443-55e9-42ca-9d3b-19ff2231867d", "comment": "Malware payload", "value": "060ea8515b20a724e4ba2002ec94dbda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852942, "uuid": "c597803e-ea9e-4d26-919c-a7503356e341", "comment": "Malware payload", "value": "64aaadd4c13d1b3e0daae138e5cc879c62b9e73787d4271567f46fbf5b5f440f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852942, "uuid": "1f400c37-d23d-4c0a-884e-17c0f6c3b763", "comment": "Malware payload", "value": "08690608fc0cae4e2614ca41e7d998c8973a49ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852942, "uuid": "e09c6715-318c-4c84-a028-c04d4d79f37f", "comment": "Malware payload", "value": "1bbb1357923b10427c60cad1fb4bac5494ddb49719739cd0b1e455bd047a03eeb5ae80efe9b6d3a2cc830b1e67adb2d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852942, "uuid": "26ae2b5c-392c-4e1c-96ce-a06f9d857a95", "value": "T18176BF02BF948F83C5DF2BB210751685FB71E547C366A7CB5104A2F8ACB23C44D5AADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852942, "uuid": "cdb8a1c3-560f-40a8-bcf3-c72c0b639921", "value": "98304:Kde84UEvAPiS3LKTG/JUhdu14rMTQektKgUOX32yn1lriutuI:KdoUWAn7KTG/2hdfeOUg35riutL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852942, "uuid": "d5c1cce8-8f33-43bc-bb68-e9d862fe4fac", "value": 7808360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852942, "uuid": "013fa8f6-3b8d-431a-bfee-3310493dfc59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852942, "uuid": "296a5f54-c540-4516-9e0e-92f9d88d577e", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f958f84b-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855836, "uuid": "3df70a2d-88f4-45b0-bc4d-8d453f042977", "comment": "Malware payload", "value": "10a02de51ae65fd71e4782b0e989c5df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855836, "uuid": "449945fd-42bb-4c02-b0ee-3561f1caccae", "comment": "Malware payload", "value": "64e5ccb33565bc208b7d8da72e90ef2eb29ad6df57a69e9e156ab74eda1a4d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855836, "uuid": "e66c7b95-fbdb-43f3-9cf4-dc0239d91880", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855836, "uuid": "42d07276-bc73-46d9-9b98-906ecf55332a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855836, "uuid": "05454c56-0d9c-4784-8dc8-f53d7483611b", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855836, "uuid": "e4337749-2990-4b37-91eb-7c9cbf493e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855836, "uuid": "a140ea04-d842-40d1-bc53-e22d21395452", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa20c884-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855838, "uuid": "f02cf4d7-cefe-476c-86c7-b2ff22379a17", "comment": "Malware payload", "value": "55dae870597bb7f3ae0eb5cf1f90c602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855838, "uuid": "e0d7f5d8-5b2e-4bd9-acdc-56caa05bd9df", "comment": "Malware payload", "value": "6501bd35902a182b3757b19a2de8be694171d0e6fd9ad4e7cb1c5e80ad5df77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855838, "uuid": "90acfdac-e9eb-49ee-9b35-6149cd06b4d9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855838, "uuid": "9b5e2aa7-1279-4178-ae03-36932d1d8699", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855838, "uuid": "266d9572-a303-4bcc-8d70-0ab2b1d242d2", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855838, "uuid": "69d75141-68f5-4f4d-b026-5caa13487e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855838, "uuid": "a428f4f4-f31f-48f4-9281-c911319c9d35", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e3b332-c7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763848400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763848400, "uuid": "bd186f9e-74fe-4bbf-ad9f-e983e03f2b0c", "comment": "Malware payload (Mirai)", "value": "8d51a68fa24a3370dfab876402357d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763848400, "uuid": "0580f757-ced3-4c18-a1f9-60dc680c782b", "comment": "Malware payload (Mirai)", "value": "6519dbe8e08ce1476e3ced9aaf0d3e0d28569c6ec780e2a056380470394f5d69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763848400, "uuid": "d9d0f373-67c0-40da-9a05-bef7370a547b", "comment": "Malware payload (Mirai)", "value": "303bf3fbd60e56f1a7320f388a844419a576cdf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763848400, "uuid": "5cdcf67d-c1dd-4ce6-84f7-b573a8935fdd", "comment": "Malware payload (Mirai)", "value": "44645dd6799d25678d88146acb0514538f0464f85100af6cae1d3fd8978e5be5bf35103b6f2bc6e43807f028ef24aa50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763848400, "uuid": "7c2113f4-63cb-44a2-83fd-14288cf886ec", "value": "T145142B46F8828F16D5C112FABB6E514D37132F74D2DE32029D20AFB4678B8DA0F7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763848400, "uuid": "25a07e4a-4dfa-4b2b-8057-26735a1bda80", "value": "3072:axymkwTz6XdbMz7X4e22daTzbk/H+SSBjI4i2BKXMD+:axymkxdb+XJ2uan4mSmri2BKXi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763848400, "uuid": "2543105c-5bc8-474d-abe3-74d2677f42db", "value": 209300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763848400, "uuid": "42ae977a-e9cd-4ea0-9a3b-2b3142169ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763848400, "uuid": "1a555ba9-451a-4661-9882-489950c846b7", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae782e1-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855839, "uuid": "2ef37606-b244-4ed6-b9ef-4ca233b0b2b9", "comment": "Malware payload", "value": "551911ea748f14e536ef6f414d61da5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855839, "uuid": "1fa8c091-9774-489b-8a50-dcdf522ff767", "comment": "Malware payload", "value": "652d6a8f453a324daf5f9536196e621265434277f5cd685e281f7414c0168f52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855839, "uuid": "f85f804b-cb31-46a7-b40d-019a37bde7e3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855839, "uuid": "5894bc5a-0445-4d72-add4-24c43350416c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855839, "uuid": "9d7cd85f-b181-441f-9a1b-2006830a31bf", "value": 1884172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855839, "uuid": "c6e70d33-bf3e-4b41-b060-5fc81720b28a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855839, "uuid": "630dec3c-c32b-40a2-90d4-9918c124e499", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbbf636-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855840, "uuid": "83bca167-fa07-42a5-a21b-8414cc51f01f", "comment": "Malware payload", "value": "e8113856b4f6fa34f18f0682e9ca6dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855840, "uuid": "6db68e38-ba95-468e-a7a9-99e93097c62c", "comment": "Malware payload", "value": "65348e42e2663898e3c87af9b103e83567dc8045bdd8a4a95f430b4e99f032b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855840, "uuid": "a42b0661-5425-4851-b722-4ffc758bea36", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855840, "uuid": "fd2a6ab2-fcb1-48b3-bbd2-1f964e5c3ba6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855840, "uuid": "22056082-9818-4ebb-b5fe-756d6fb8f2d2", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855840, "uuid": "347d1489-5fc6-4e28-b140-5b182ef64a02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855840, "uuid": "31e308a5-a876-481b-b394-8757603ee640", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7d0b49-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855842, "uuid": "3ca2c605-0aab-45ec-884c-d1bc0828bff9", "comment": "Malware payload", "value": "eeeb83cef9f3b9c0f9be07f1508e4fc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855842, "uuid": "97f6d25e-7040-4df2-baad-7f3055be5046", "comment": "Malware payload", "value": "655c7c4eb29ecd040c65f2e85416c88c72e077282749d47f65053cc5021326c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855842, "uuid": "061114cc-4cad-49f2-9ba5-ccec776374b3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855842, "uuid": "16680454-96de-4c3a-8069-7cd6eeb38080", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855842, "uuid": "d314df35-6068-4916-90ab-06382ac2a0b4", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855842, "uuid": "c6a65f2b-7a88-4a90-bb73-3b303475232f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855842, "uuid": "529f94f7-0c3b-4eb7-8fff-f1dd1fb4e61d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4bfbe6-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855843, "uuid": "291ddfba-7268-4651-8b9d-341df7c353cc", "comment": "Malware payload", "value": "7eaf8821d9ad184fb10ea43a4424b832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855843, "uuid": "d634f736-a804-4102-953c-a0831ba06490", "comment": "Malware payload", "value": "658903bbeaa8014fcee73cc91426600663b134c647c2f8e015276ac115dc899d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855843, "uuid": "69b01b38-09dd-489e-bd85-4b4c0d5ce7fc", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855843, "uuid": "02f743f2-2d1b-4c1a-8337-fcddac90a8e5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855843, "uuid": "3f47eee6-44c7-472a-8c5a-7bd8a67761f5", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855843, "uuid": "5fde387f-17d6-44a4-842b-c84a8df25502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855843, "uuid": "7032b238-b8ad-405b-8cce-59118715a1f8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2f19c3-c7b5-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1763824109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824109, "uuid": "d56694d0-9e77-4b6b-ae75-8d94055fae11", "comment": "Malware payload (DonutLoader)", "value": "406b19cce1916b77a34537f4cc7cd19c", "object_relation": "md5", "Tag": [ { "name": "149-102-156-62", "colour": "#07086A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824109, "uuid": "a67d80da-df1e-4ed5-b34b-14498773b6a2", "comment": "Malware payload (DonutLoader)", "value": "658d3acfc7e71d6b3451973ab8c207dca57264f9b17fc9e37c8b7a1e46561489", "object_relation": "sha256", "Tag": [ { "name": "149-102-156-62", "colour": "#07086A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824109, "uuid": "829c1188-266e-4139-826d-be2c79e86759", "comment": "Malware payload (DonutLoader)", "value": "1f9e3d5203912defb6bbe9ffc7eacaa8a55fa8d8", "object_relation": "sha1", "Tag": [ { "name": "149-102-156-62", "colour": "#07086A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824109, "uuid": "38df357b-a2ef-4eca-b300-9037f660a619", "comment": "Malware payload (DonutLoader)", "value": "499c7808f4e71a2aaf8a50fee88d22fb1197c020fe2131484310b914a0ed33ee20759afef381ab56c598d7a4cd8ab99f", "object_relation": "sha3-384", "Tag": [ { "name": "149-102-156-62", "colour": "#07086A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824109, "uuid": "ead94b76-f531-4368-84ce-430e178ef6b2", "value": "T13A14BF5B77A431F9E1B78238C8950A45D776B8361761AFEF03A046591F236E0CD3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824109, "uuid": "e497c4b2-c6de-40ed-a6d1-bd2442361e34", "value": "16b044231e4b12a9ad7fc7d47095646f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824109, "uuid": "2ab377dd-8168-4957-a356-8cd358486f60", "value": "3072:Ge3Co6YLc3fyoqvKBZmnn61Vh4pRPjISSU76gtPEzbiV0a8ko61fjAZf:GdYQ3z5BZmqVhiZjugVEsZjAZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763824109, "uuid": "273a447c-d79e-4cc1-b90c-d42eaa5f0337", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763824109, "uuid": "9757e897-219d-4d94-9daf-4ac18c2d075a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824109, "uuid": "b2a607cf-acda-4ef3-ae03-0158d6581c8f", "value": "Maxonic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1c37ef-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855844, "uuid": "f5523f06-8bc3-4a78-aa98-ab9b320f63eb", "comment": "Malware payload", "value": "d31acf58e67965586d32707410636819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855844, "uuid": "d0f9eafd-33df-4b8c-8bf3-9a8b35211e34", "comment": "Malware payload", "value": "65c0e7449c2dddabec1648518b7f75d2fb4615dfd7ca8ac2332ebbadd4d72b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855844, "uuid": "5ac8ce5e-9ef5-4342-8da9-a703966805ab", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855844, "uuid": "9328bb13-6ef1-4ca6-bc8d-6fe262bef265", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855844, "uuid": "6570b49c-388e-467e-86bd-babdc5d796f4", "value": 4762624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855844, "uuid": "690051ec-cd2b-47ee-9183-bfa759f4645b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855844, "uuid": "e8ecfc80-b062-4a63-8cd2-e99d396068d8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee5bd4d-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855846, "uuid": "9d4743bf-7206-4076-877f-ea85a523dead", "comment": "Malware payload", "value": "d50e04d4fce8f2ef37da4ec55bfbe75e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855846, "uuid": "384738b8-4aa2-4993-886b-e1475e819fec", "comment": "Malware payload", "value": "65ca83acc604d16458ed4b357b04426fcaafd18ac5eeae9a560357aeef472ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855846, "uuid": "bd2dbd84-c5f9-4de5-ba56-88b1f74fa453", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855846, "uuid": "3bc05d93-e5f7-4e55-8399-07da12c1326e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855846, "uuid": "0440c5a0-3f70-40cd-940a-fe2ae3b33cc5", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855846, "uuid": "546dc797-e014-4c52-842a-c33dc790bc9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855846, "uuid": "6a29dcaa-b502-4e5c-9b0d-b17eea603290", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffba8ac1-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855847, "uuid": "c8e74500-e634-4dab-a65c-db18732e94fd", "comment": "Malware payload", "value": "de9a976257806f4bb3b8a773d029ce3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855847, "uuid": "b76a53f6-c6a4-4561-8645-951d22a04d52", "comment": "Malware payload", "value": "65d4fb477d90cbd849bf5303eadbaaa46bc1f6a68f116c95484cb558713ae0e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855847, "uuid": "2964bcc8-6be0-4281-8945-76b5c5c47f29", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855847, "uuid": "ececef1f-ba26-4e56-8e5d-18bc5d0856c8", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855847, "uuid": "ac9beb0d-c78d-46c0-87ad-82c57df4979a", "value": 3256320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855847, "uuid": "00fd315a-58d2-4ccd-aeea-6902fa2f6f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855847, "uuid": "1f814098-db50-4bca-9539-beb5941c44d4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0091396e-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855848, "uuid": "d5c1a410-d82c-40c6-81f4-16614ce653e4", "comment": "Malware payload", "value": "3d1a95fca02b609b577513d682e01d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855848, "uuid": "161c09b5-97ac-4502-b2a2-facbdcc7fc4b", "comment": "Malware payload", "value": "660002f21654d4a3e3f44cfd816af6d67c3504e53cb6d08515dd7f54bd2768ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855848, "uuid": "fdc2b903-ad22-43df-929f-c856c3a665ad", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855848, "uuid": "16a4d58c-54df-4e49-85fc-d713f3956cbd", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855848, "uuid": "e009d220-3d25-4571-97d9-faf32ba18af6", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855848, "uuid": "a492afb3-ee2d-467a-812a-ab08e36c2388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855848, "uuid": "8abc9be1-b8f8-4a3c-bc78-228d748dc2ec", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016f4dbf-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855850, "uuid": "3a03b7c5-1e0e-43ae-bde1-0f93f448b1d6", "comment": "Malware payload", "value": "5cf3fdb11954f520793bf1d4774f32ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855850, "uuid": "ad41730b-69ba-4979-8c58-dbe8a82f1909", "comment": "Malware payload", "value": "66375175d17e8f4023f58f326d53433c68c4e5aa55c6d28e7d393fee02b12817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855850, "uuid": "5977d720-e60c-47c5-8334-29822cf9517a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855850, "uuid": "12e339be-12bc-4834-9531-9533d59b3da5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855850, "uuid": "f256372f-43b3-4cee-8ebb-b06239db0af2", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855850, "uuid": "89aa0dc9-3ce1-4cef-8111-a960639b323a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855850, "uuid": "affde4f7-5874-49bd-a7fb-1124a12317a9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025938a4-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855851, "uuid": "af91d5db-aa35-434d-b0cf-6f119fd0741a", "comment": "Malware payload", "value": "9d37e9902be9914c16709704cb6e4efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855851, "uuid": "383a3399-1b4f-4bf4-8d2e-c117c7bd75e7", "comment": "Malware payload", "value": "6655cd01beab1262f237082cd0c2dad668c13593976b78fc9cb20f18cd2122f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855851, "uuid": "bafe6e8a-310d-4aec-b4cc-dcccb3f3dd08", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855851, "uuid": "333c766e-f4c4-4d74-b625-7a594835943d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855851, "uuid": "64fa007c-ad57-4dcc-8dfe-b62c1acc52c9", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855851, "uuid": "c36b3f22-7e6a-4cd6-8879-9ba68693ad0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855851, "uuid": "2e759a58-1ff6-42c8-8ec7-5866eacc4ab2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65d6eac-c7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852368, "uuid": "5ef067ba-88b3-4a2c-85ff-e7c2f1ca249b", "comment": "Malware payload", "value": "d625749a2ac95be10d0bbc0b80053dae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852368, "uuid": "fce717d8-ed1c-40fc-bea8-f6431f61277e", "comment": "Malware payload", "value": "666d8f132048755cc2951437d6e2f66795a3345a070be15dd67098378e919f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852368, "uuid": "43974709-60d0-4145-b806-f5117b8b3d52", "comment": "Malware payload", "value": "ee75606a16ba5af73bea22cfdb0991189a4d71df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852368, "uuid": "aafb19d1-ab9a-47b7-88d1-5a824a0659ad", "comment": "Malware payload", "value": "8d76f4bf9c125b27639d30bd3aec9890d136581fa24e0517b1f4096b01bdb2a31a93a1622255466d52ea962721c05ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852368, "uuid": "410c647b-f175-4ce8-8cf6-68f2e879533c", "value": "T1C8547DE332654852F2AB4EF9D19BBB31473457835163DA8616B1189C0892F41BFD23BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852368, "uuid": "ea5c9171-2207-4b7a-b4f7-1d155a081908", "value": "1536:ER+4SJ8Kv9P5dNJ1yU+VqY9lf2CGID5FBf5UNs1ffmY/Z:lJ8Klmeu5TfpfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852368, "uuid": "979149fb-6609-4e26-aaa0-81d9bc7fc378", "value": 282408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852368, "uuid": "0c508049-4b37-408d-904e-4f6e0e06b738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852368, "uuid": "19029ddd-16f4-4ae7-8d1a-9a77e88e15df", "value": "PDFSkills.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032653b9-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855853, "uuid": "e870e8c0-5d27-459d-855c-3bdf4aec17c6", "comment": "Malware payload", "value": "b6e1340ac9a2d1a94da61d0bf44c9fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855853, "uuid": "7a671f54-1fd1-43a8-8d84-2785450ab28b", "comment": "Malware payload", "value": "66a5133a1fe7c042e01a9bb63cc4b64ed27e29ce631b01934b0254f949f60ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855853, "uuid": "fed7c429-458a-4bb0-99ca-9d114dc0148c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855853, "uuid": "4b0cece8-b8bd-4c4e-8f69-fc4178d4fc75", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855853, "uuid": "09935a33-bb8b-405b-b183-c4b9fb700b6f", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855853, "uuid": "235df989-b191-4dd5-a420-6e2721697f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855853, "uuid": "a7348b97-247f-4146-87a6-0e268261f289", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f6ec4d-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855854, "uuid": "561782fa-3141-430e-9f99-ba36f7a78d5d", "comment": "Malware payload", "value": "fee0fef74ba02edabd3df6fa6e7e8673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855854, "uuid": "c3622967-5fed-496e-9b6e-123d16db94a1", "comment": "Malware payload", "value": "67153d305339f6bac862dafd8d0ee1f1484240008ed1b81c2b3beb2879ffdc19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855854, "uuid": "7f81df14-00ce-42e9-9f0a-ad12ade4f83d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855854, "uuid": "a8da6c6b-f2ee-4acb-ae5a-fad205355094", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855854, "uuid": "fe03335a-9097-493f-b318-e65ab0c07640", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855854, "uuid": "97c1c85b-4e24-4985-90a3-a7995fc93112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855854, "uuid": "70ba798b-fcea-4e5a-96ea-3fe6b19f5358", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c143b3-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855855, "uuid": "a93fddd0-c865-43bd-b1d1-63be827a42de", "comment": "Malware payload", "value": "9378e033b6921f55414b24dafc843362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855855, "uuid": "254493ae-9f3d-4d47-a12b-f2651d1cdf7b", "comment": "Malware payload", "value": "678a9433c29ae0b77834cc0bcbe5cb632be331974ae9b1a08155ab10828137f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855855, "uuid": "bbecd943-cb04-4691-85c6-4b490ac927c3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855855, "uuid": "c6d937a7-bdb5-45f1-a1c0-55a81fde56d3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855855, "uuid": "5bdaac6b-c3f2-4fac-a5b6-c5751832068d", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855855, "uuid": "fb95b372-b744-46a1-b004-dbef3e23d82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855855, "uuid": "91ede42e-8704-4a75-8ffc-5a2561b6aece", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058ba704-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855857, "uuid": "0bc46878-7640-4c74-a3cb-9dda8d8811cc", "comment": "Malware payload", "value": "674e80748b31a92e865bc7f1bc10b503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855857, "uuid": "913eece5-4059-449e-a0aa-cfe66ea60bdf", "comment": "Malware payload", "value": "683dd75d097140b8bcea70e481bf6d316f18efe0a0cfe6daa3a71146aeaee7ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855857, "uuid": "6da226d9-3ef9-45a6-964b-96217efd7ea0", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855857, "uuid": "3b39739d-d342-495e-b5c7-704605a9fa47", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855857, "uuid": "3867370c-6920-4740-8b3d-f3690537c8de", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855857, "uuid": "0cf0cc4c-1dc7-4b09-99b8-2215fb4317aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855857, "uuid": "774bb225-6339-45c8-b10f-0b46767dc93b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069f0797-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855859, "uuid": "c8b9780f-96b1-4f3d-bb10-61d1779584dd", "comment": "Malware payload", "value": "ef5f7ce087072da5228c4fd70f4d861e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855859, "uuid": "30530697-0446-4b4e-b7ee-6d5fe99661e2", "comment": "Malware payload", "value": "6867940287c86577a310e5a91fde03e25a0a938901c384af1c722e4574163f95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855859, "uuid": "32c03be3-2e9a-43a4-a69c-07ef237fba7e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855859, "uuid": "a6416bd9-9e05-4575-b0b9-916f218c18ce", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855859, "uuid": "059d7f5f-bf05-4c03-bc22-567a34fd186e", "value": 1834496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855859, "uuid": "cba2e16e-9b7a-4787-89ac-5754e776b9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855859, "uuid": "36c5769d-f191-4eeb-a87d-0dd2c1e0b5b4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0757b42f-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855860, "uuid": "44fd7b2a-c19a-43ba-9fb4-df9309169982", "comment": "Malware payload", "value": "ed11529dbe0d126cf0b3b1f29eebff17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855860, "uuid": "cde7ec94-30a2-4106-81d4-4f8641d3c630", "comment": "Malware payload", "value": "686ec3e7d369bce0e79a980396eb14ebb2c2f4f60553ef8a84210441f3980ae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855860, "uuid": "2068dcc4-ddb8-422b-bff1-d7fe17a42241", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855860, "uuid": "6c14a3a9-11d9-4f59-a74a-5bee378833bb", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855860, "uuid": "d6a7013e-e87b-4f1d-8cae-b222d1c5aa7d", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855860, "uuid": "1e0e7b8d-4ecf-4cb0-9f31-144800a93bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855860, "uuid": "fe7be779-bb26-43cd-97ce-8b2e79e3f804", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0833d74b-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855861, "uuid": "fb7986c6-1868-4cda-95e9-1217aee617df", "comment": "Malware payload", "value": "6d52f911d99816ad5c750c3f80e8d65c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855861, "uuid": "8f9813d1-fcef-42b2-83d2-957704324f91", "comment": "Malware payload", "value": "687487453cd54afe6ddf8ed5dfaf13b56a2061409962a96af3b3d0b11f70a8b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855861, "uuid": "4da9d600-d61a-4566-8581-488b13992fcf", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855861, "uuid": "66fad0c4-8b9d-46c3-8760-d538dd443932", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855861, "uuid": "d2050982-b552-4002-a7b2-eceafb8eb820", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855861, "uuid": "1fa641d1-b687-4869-8d7f-f4bff03695f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855861, "uuid": "c5ed209b-a936-46a1-9f3f-496f65134193", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83c7f00-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855324, "uuid": "ac588f68-739e-4258-bc20-703ee6309712", "comment": "Malware payload (Mirai)", "value": "0f7a847472f4749aef37c6b560c29679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855324, "uuid": "930c6c60-6dc3-4479-9deb-1ad96a663bbe", "comment": "Malware payload (Mirai)", "value": "687c207fe67928a2b28fd9297b1948a5798cf44fdea2a78b4f37e108bbc6a65b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855324, "uuid": "c05584e4-f1c9-4625-a5c1-5a686642a81a", "comment": "Malware payload (Mirai)", "value": "6e2c2852651e93b9f75d221a7cec2c6a1f638df9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855324, "uuid": "b0fb1912-8984-4baf-9446-3d8b89976fe7", "comment": "Malware payload (Mirai)", "value": "374c994f48a0afec72dae04feda3998e458a77c597dbc24d562111498c51d0b3e46cae69b09795dc43da58f9b080035c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855324, "uuid": "b3f4a13c-8489-4094-b62f-93dcd0bcd6b6", "value": "T18E03E14B939FB9C2F17A877528EB3C4D0828B40A7458605B5FC4260B6FEEB5854393ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855324, "uuid": "3c9e834e-a77c-4999-a1d4-c4af042dfb37", "value": "768:MZuGsWHIjaeldMg1ECrxDeac3mS9FonbcuyD7UtQRjv:M81NjhT9rxP+Wnouy8ty7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855324, "uuid": "ac3d9141-327c-4be7-b6e2-619bda2ecd30", "value": 39332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855324, "uuid": "9cc6695b-738e-4dbf-ae88-f962438b97ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855324, "uuid": "b2ec96b2-8f0a-4e1d-b94e-b509e5c34ddb", "value": "Labelloperc80.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0924e884-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855863, "uuid": "a1f97ca8-ab4a-4487-8663-6df4868aa849", "comment": "Malware payload", "value": "038ca5cbf8887600d3d3efffabab3f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855863, "uuid": "6e394dde-e7cb-4f58-a64e-6430fda595e1", "comment": "Malware payload", "value": "68965260a9228d3b5d2b9f4df229bfa7d23d0f6217aba1b20e22344ccd071050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855863, "uuid": "da60fb85-791b-49ad-84be-124c98b7676f", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855863, "uuid": "13cc070c-e344-4d00-a001-c5557913a57e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855863, "uuid": "0c39b068-f59a-4100-92e2-ce7f80de56c0", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855863, "uuid": "6f2060fe-6edb-4a98-8ff0-d0d21fbb64ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855863, "uuid": "d74f42d5-9515-4358-92f3-34fcbb63d138", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fa2b16-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855864, "uuid": "c5607817-baa7-4e5f-88e8-f67f0c72963c", "comment": "Malware payload", "value": "c39e28a91a8da6a2972be62b26ad3156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855864, "uuid": "083b56db-37f8-4417-af64-7f745a5248ea", "comment": "Malware payload", "value": "68d516d44d6baf80033a66a70512402a5e5071ce3e525e7c2dcf730b13656eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855864, "uuid": "d9ea07e5-dacf-4d96-b8a0-948f62e72ae7", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855864, "uuid": "a0ac8138-8062-4d5a-bf5c-b982264342e2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855864, "uuid": "fb3e8fa4-eb31-49db-b070-b4d74c62fcc8", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855864, "uuid": "ee95de3b-1b0c-4edb-bc26-6d3d49bf3225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855864, "uuid": "6f74bc7c-4f38-47bd-b18c-ed384f3fad72", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad5036f-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855866, "uuid": "04fbd324-dbf0-4a45-962d-b06361db29d1", "comment": "Malware payload", "value": "5205987f9a12f9c1729cd1ff162089fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855866, "uuid": "8f6ce894-0613-4107-ac23-85f5d9ff3f2b", "comment": "Malware payload", "value": "68ef2789043f43e243c67ad669b721ee84f61b1671da5ccf5694a3dde18b7a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855866, "uuid": "95689c83-d204-4b4f-99d7-f55de41c076a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855866, "uuid": "6001839a-f976-40d1-8a3a-b602e2ae2266", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855866, "uuid": "590dcb24-996c-4cae-94cd-fb8387daddb2", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855866, "uuid": "bb120e9e-8fa3-4f36-b80c-3d099aced731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855866, "uuid": "2db9c2db-7cb0-4d2e-b5d2-61ef678d87ca", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba56074-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855867, "uuid": "d7e9ac65-cef5-4e19-a49f-452cd1de1ee2", "comment": "Malware payload", "value": "7117932c1789744424fb2426b93be209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855867, "uuid": "3ae38a48-f2d2-4aac-8b16-06d2cea888c1", "comment": "Malware payload", "value": "68f797c34bbba99ec947d4f6e0b0f155c76b1b59c1f569176e33b8c91f3ac40e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855867, "uuid": "fe82675e-4af0-451c-a300-5be5f20a2089", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855867, "uuid": "6415523d-d1b7-447a-af64-bc6ffa6425f1", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855867, "uuid": "26a49240-486b-4c22-b132-d94bc0604da4", "value": 3272192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855867, "uuid": "1c8598bf-96e7-40dc-b0f8-0dd5d69daa5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855867, "uuid": "d6fcb6e1-da5f-41db-a1d2-0e1d37f5ea00", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbae6b9-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855869, "uuid": "dcf61734-48ad-472c-920a-2c2762ced93b", "comment": "Malware payload", "value": "9745f3c956d6cdd922e98c26e5c26a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855869, "uuid": "ad08ee59-78b7-443f-a25e-1da58fcc37f0", "comment": "Malware payload", "value": "690166d3349d63eb353f88a8d68f94440d2677cdbe80687cf05daac1802e487d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855869, "uuid": "a3740586-1aa1-46a9-bc0a-1cb1dd660ba8", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855869, "uuid": "cf36fd36-b3b2-4c9d-9fb1-b5f03d6149d1", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855869, "uuid": "7ba16f7b-db1f-45ff-865f-71efe81f543f", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855869, "uuid": "5ce2dcb1-fb5e-4537-b70d-5bda11b2fbab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855869, "uuid": "327f9eef-f226-4415-8392-b9629c4ede4b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7d6763-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855870, "uuid": "a3582d2d-a090-4396-9226-d06e810672cf", "comment": "Malware payload", "value": "8c309b6628f2fe754abf2b111de37144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855870, "uuid": "59da7404-b00e-43cb-b8c8-4a45466c0ca6", "comment": "Malware payload", "value": "691a83d02dfe1036616ac644156db3253acd3951614f1849ad73a160ae76a91c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855870, "uuid": "219de3f8-c57b-434d-96f2-62c1de4e77ef", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855870, "uuid": "a6824fbf-9fd1-4a3c-bddc-054728330327", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855870, "uuid": "37533ff1-67db-4f70-88e6-df793e69ee52", "value": 270348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855870, "uuid": "ae39e92e-b396-436a-a672-4ee2f8c8e833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855870, "uuid": "4d2d547b-238c-4464-bed4-a59cbaac6b23", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e450666-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855871, "uuid": "ce9d29f0-9b6b-434c-a4d6-c3d6a1b047f0", "comment": "Malware payload", "value": "bfbae494742f71441e80b179d4d3a5d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855871, "uuid": "ed6c685c-a0c7-41bd-b47b-423bcc236532", "comment": "Malware payload", "value": "6921a6155a93a59d289ccd7caff90844eae0ef397f2021471f539c8e9303ed3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855871, "uuid": "92ca1d51-15fb-48fd-8996-4da312d08010", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855871, "uuid": "22a99a81-7914-4ec9-965b-229f96fafd28", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855871, "uuid": "0014f046-688d-4fa0-b9c8-562152fbf7ec", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855871, "uuid": "46719ac5-20ca-44ae-b897-4d73ea9d5621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855871, "uuid": "8242ffe6-05a1-4ea3-b775-cca37c8d8751", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f124910-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855873, "uuid": "d6990207-e7c2-4c4d-b579-1c6b2e5bcff6", "comment": "Malware payload", "value": "0ca497bfd0555200ab450709d43baaef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855873, "uuid": "6b3ed406-a842-471c-9073-b7ae04813510", "comment": "Malware payload", "value": "6973d47b2cc648d5c25e010c00b692dcefb6444cc326d27a224e717ccd3531f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855873, "uuid": "e7a3c424-c0b0-4c3f-95d8-f1bd597db0d9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855873, "uuid": "21ba688a-dc10-4837-a0d1-f70de0062a47", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855873, "uuid": "ae8ac6c1-c492-42e1-af6d-29f08242d819", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855873, "uuid": "4ee60955-abd8-44a5-85a4-2d69f930d4f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855873, "uuid": "78f2ebc1-ec10-44d8-af9b-7ac0d4599f3b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c4ca13-c75d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763786648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786648, "uuid": "6fc65fbf-97c7-4b77-a19e-04fac31d86aa", "comment": "Malware payload (Mirai)", "value": "c36f021856d8c85b145f481b528b9f07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786648, "uuid": "18c39b92-5833-43f0-a765-00f12ce994dc", "comment": "Malware payload (Mirai)", "value": "69762625d380fb3cb706cbdf559ff2a24077ba3cc2432d91c8ca665815f72883", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786648, "uuid": "11c52822-7703-46cc-926c-410501d00ef2", "comment": "Malware payload (Mirai)", "value": "5e19a004cf00d1b0e0b7e0156f2c95378d77d5ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786648, "uuid": "85ab0c6e-f0fc-4bcb-b038-a393d4300d9d", "comment": "Malware payload (Mirai)", "value": "5707defa2045cfe2d13eb2afc045d269b6faf25d697d2c2d56e83d531d4f037ff16fdd8278f806156cba069e38e15d28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786648, "uuid": "ed6a7bbc-161f-4062-9ab3-c83785a7ad8e", "value": "T1D54302A398703FF7CA66BAB64538C244D462C301D01BD72DA634C5096F1BE7869ED3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786648, "uuid": "96399429-670b-465a-b00c-1159d311e243", "value": "768:+fsoQNoA7jhyzbniI0kzvb18lzHf1gkorNiKFanlOXu39hV2AH05RLJOg4azHzO:yG1enz18lzaZiKFa4X+z/qRLkg4azHzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763786648, "uuid": "5a334638-6672-4410-b3ec-8a9774760479", "value": 59420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763786648, "uuid": "849232b2-afd5-47b0-8cae-b87af33b063b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786648, "uuid": "73e9735c-ab21-41e6-85b5-4913198504dd", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc909cd-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855874, "uuid": "1479ca11-6750-40e2-b491-9dca98a8db4c", "comment": "Malware payload", "value": "8bedb54baac2f9407da955803e78b102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855874, "uuid": "5ce84bbd-19e3-42fb-be6a-ac19f6c8802b", "comment": "Malware payload", "value": "697a55750f5c378a3b2795420b4c8d3fdbf4737a80c5e62485c6db49f1648445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855874, "uuid": "f607f988-067a-40e7-9e87-823cfca8354c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855874, "uuid": "2ed9c452-525c-46a4-9424-48c960300d26", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855874, "uuid": "503e4113-66d3-4f9c-b5bb-ccf9ba0205cc", "value": 270348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855874, "uuid": "ceb3d7df-ecc0-4fd0-ae59-3628520a6389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855874, "uuid": "54740131-29ec-443d-8bf3-607bcb839fe8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10afe902-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855875, "uuid": "983180c4-0ed1-46c5-b9a7-3eea31db8976", "comment": "Malware payload", "value": "bdfd931acfecb34caa1c5d86e0f2bd22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855875, "uuid": "ece4f015-9ebc-4766-b54e-aaa5d5d8a5b1", "comment": "Malware payload", "value": "69b7f76ece81f5df01307d679fb3e803fa897970e5652d5d20959cef836927bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855875, "uuid": "3c87c97e-e6b7-4699-b8bd-94f7ee364226", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855875, "uuid": "8fa38446-4e9e-41e4-9ce5-38c599745251", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855875, "uuid": "1cbaaffd-dd9d-4626-a2f8-56b361a19258", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855875, "uuid": "20e467db-e6c4-4aae-99a7-69a348cae4d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855875, "uuid": "945eb707-67a0-4e8d-95a5-3679a3328d74", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1181c724-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855877, "uuid": "a14099da-f596-489e-aca1-b3a187646746", "comment": "Malware payload", "value": "ac392f0ef3d4e04c951ada8721ed7709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855877, "uuid": "a3b121af-a5be-4930-b212-266ed713c650", "comment": "Malware payload", "value": "69d3e8613330ada8e185e86add8415beb014d6c06ed4112bf41933f0df9b5050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855877, "uuid": "e91c6f5f-a1ac-4b3d-b0d1-32e9cf2f1e0c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855877, "uuid": "1cbd0385-487d-4c93-98ad-49c8784d00b6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855877, "uuid": "f7911baf-959b-45b9-b4c7-51d28ea1f5c7", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855877, "uuid": "a6c9dd96-bc7c-4f52-919e-290630899f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855877, "uuid": "b95f019b-5e71-45f2-bd01-6a82f9b6b77a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125d5cc9-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855878, "uuid": "33531729-a67a-4f9e-a99e-6545032101bf", "comment": "Malware payload", "value": "3bd06a1bcf8e5358957b5ff881eaa536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855878, "uuid": "bee8aa71-c796-4adb-b94a-ab3f63d431dc", "comment": "Malware payload", "value": "6a353baa285e230b7624e524eb5a036d107b0697a316fd70ac5b83dcde52ac63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855878, "uuid": "5c8055e9-10d6-4d67-839d-161cd0c1773e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855878, "uuid": "52c80dca-2acf-460b-a0e3-fb15b69762e3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855878, "uuid": "2e990fbe-085f-43a6-a1b5-75a61d8aa720", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855878, "uuid": "0a8bebed-35fd-4ea4-a916-066d4bd58555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855878, "uuid": "618a15ce-946f-41ac-9a1b-bc6d19529909", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1326c83d-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855880, "uuid": "d391abfe-b27c-497a-bc2a-b14b464e919b", "comment": "Malware payload", "value": "cebefe6da6addf21b53fd1632e6f6207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855880, "uuid": "c22b1537-7529-429e-82fc-508e4a6aff51", "comment": "Malware payload", "value": "6aea1138972235913189de1ae1925f1190e4d400abca5d22ff3d3eb05961ec7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855880, "uuid": "e6c6c8c0-fb2d-4271-9217-bdfdf539e080", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855880, "uuid": "d0715329-c675-439b-b9fb-94c21174c0f3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855880, "uuid": "6dad6963-af12-41a1-9d8a-e34c4c726586", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855880, "uuid": "b75c1491-e872-40c0-a2d3-0a1d162c038c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855880, "uuid": "7d8bbabb-dba4-437a-be49-a5c77f3219b8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88387f1d-c7bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763827300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827300, "uuid": "b761b3b0-12fe-44dd-9e6c-31b0b5dbf03d", "comment": "Malware payload (Mirai)", "value": "8fc6d745fa0f1eb9f2e264fcf4e2033b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827300, "uuid": "3bf80a1e-b352-4616-a926-b2c31766cc75", "comment": "Malware payload (Mirai)", "value": "6aec50d2ea7ae9ef6b50c0a4cbc5582bfa73a7464fe2748f8d7e5f762215da1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827300, "uuid": "0de30420-d169-423d-abc7-01785deee060", "comment": "Malware payload (Mirai)", "value": "24a6097696b6593460fa62731e84b8467d5c0713", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827300, "uuid": "51d00844-66d5-4aad-875e-1fe594ca330d", "comment": "Malware payload (Mirai)", "value": "5982119010ee4aadce0cfb2897ff6f8e71ec1d69e41d2b4d505d40f0c9f2694c87a0a193c96e78073b34f6df99512d21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827300, "uuid": "406d820e-de59-4072-849e-7b7680d5ac44", "value": "T1C6148D69FE8F68D1C2C7E37EED490FE2341778749655C0B24A00929FD5EAED888E0213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827300, "uuid": "30d140f3-cce3-4486-91f7-cfadac4388bf", "value": "3072:ac384wA/hVanTxmS0+/dGcjcfgp91r3QPNNpzPxe:aG48Sz/dGcwfIrgdbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763827300, "uuid": "8bfefd1e-64a8-4e2f-b15a-c9aeb5632093", "value": 197584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763827300, "uuid": "a073fb98-1bcc-4708-a68d-8fdcaa2031a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827300, "uuid": "e4bc0f73-2b40-4998-a497-97bcb1e301f8", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f65287-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855881, "uuid": "62bcd843-9981-44ab-ab76-321fdd5a1af8", "comment": "Malware payload", "value": "649ba7b0affb67e697d719bb208fed30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855881, "uuid": "192d9acd-ab4f-4d3a-8f69-36b31cd88d3d", "comment": "Malware payload", "value": "6b2d3ab7185f69c193d29cf2c2fcee2b0def3d4c49b95816c54957c23a8af84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855881, "uuid": "68a221ee-de39-43b4-af4a-cd955e368453", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855881, "uuid": "edbe03b2-18cd-4354-aa17-944950f164fe", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855881, "uuid": "5bd8e747-3f44-4511-8eb6-9ed6bd16e0dd", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855881, "uuid": "acebb537-0fb8-435a-b527-a0bf0741d1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855881, "uuid": "713a43e4-2da7-426b-959a-5a9fa19e9d44", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b958b5-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855882, "uuid": "a67196b8-8bc8-4391-a6d1-4046ac7c65ea", "comment": "Malware payload", "value": "749ef5ae41e8bb0605f8a1816b99b51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855882, "uuid": "4daaa6e5-8dce-4cdc-807e-549aca18d0f5", "comment": "Malware payload", "value": "6b3ba0c2b8502c31e313cc76b6ac038ce9449b7025226eb59c47debc8bc10f37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855882, "uuid": "d172a31d-6a35-4bc3-b9b5-f38f8f894599", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855882, "uuid": "ed90bee2-f3d9-4ebb-8682-3ca941e92f83", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855882, "uuid": "6650d8aa-2567-410d-a89d-6c361008204f", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855882, "uuid": "d5a8a25c-50d8-4058-b6f6-c6daa5385e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855882, "uuid": "500d8a37-4846-42db-a1d7-615740360bc5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15881392-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855884, "uuid": "0d365f8b-8938-415a-b16c-8428cba6b601", "comment": "Malware payload", "value": "0c7285447845e703cb41fdf133d058ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855884, "uuid": "be47d3e2-7275-41f8-9de9-f52ea7d36466", "comment": "Malware payload", "value": "6b44e4a950b8f05aacc4cd219682ff3c4c5533ce31efc3f3e333bdd802f639c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855884, "uuid": "9498c496-6993-4965-a992-e5e15cb65abe", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855884, "uuid": "cdf4283c-e166-415d-adb2-18ab13e12a80", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855884, "uuid": "db389447-0cef-4228-b3af-9c338312493e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855884, "uuid": "2ca2d3ef-7d72-4b59-b9c6-7324ccceaac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855884, "uuid": "0af3825f-701b-4325-93eb-4f8647fbef11", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16636598-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855885, "uuid": "a48109a2-4bae-4cef-8295-6d0f6f5331fa", "comment": "Malware payload", "value": "a8a9ef11fb2b94a0d5aa0e302c4b8542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855885, "uuid": "481a2731-2df7-43a3-bf2a-effad42730fe", "comment": "Malware payload", "value": "6bbd31320ce134cbf840c1438017ada32dbad8a88bd5f0fc1d3f8164374de60f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855885, "uuid": "44f6acc4-3865-48e6-910e-7669c7061c0e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855885, "uuid": "62d0a077-a0df-417d-8c44-52d4dddbacd3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855885, "uuid": "4b09d3de-2503-4dcb-93eb-d5acfea495df", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855885, "uuid": "2e78b19d-d081-4ab5-8ca9-161d6d19f74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855885, "uuid": "3a248e75-1208-4ecc-9bfa-4a87574245d0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17513b81-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855887, "uuid": "4b48ed5f-a2ad-4ac2-a2a4-6a889ef51fe5", "comment": "Malware payload", "value": "261a6c89736974134e0a452a81f22cb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855887, "uuid": "b4c780c9-d154-4276-aa26-9d6976b32967", "comment": "Malware payload", "value": "6bbdd3bf3bffe1fc737dbc3919cbf9560637a8f40ed07acea860bcb0ac4dbb80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855887, "uuid": "f6d62674-f65d-4edb-9b6e-cdd87af8f83d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855887, "uuid": "137b394d-d77f-49be-b057-b517fe18bc1b", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855887, "uuid": "e0bd61d4-a18c-493a-a927-2197fb075799", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855887, "uuid": "f696df42-7384-4b4f-b1ce-36096618112b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855887, "uuid": "b670a3e5-a6c2-4c82-88cf-62aa697e15bd", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c0d4ab-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853112, "uuid": "6abdd8ab-e13a-44cd-b5d0-ea3312a200a9", "comment": "Malware payload", "value": "fe0f5c9c6aadffefdcd94cb517a95368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853112, "uuid": "512b465f-f52a-448b-a392-8c5bf5fd23fc", "comment": "Malware payload", "value": "6bf2cc4e9d9901541214d7efc8bb8bb24ef5bddc238598333c843e421c042c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853112, "uuid": "e29b8dc7-1be4-4031-bed4-37b046a7cd69", "comment": "Malware payload", "value": "b0301dd7627343b01154d1150c98a0d79b2ebb0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853112, "uuid": "564d805d-b8a1-482b-94e2-d799cd9fbed2", "comment": "Malware payload", "value": "3ab975b2187e41ace9c42bf36ef44a2719ebaf3105193b9413dcf1eaa0f206dca6a7cf1016933ebbe1fd6cfa42cf9735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853112, "uuid": "b05debc7-2a82-4107-b84f-f9dce26f37c6", "value": "T156037D1367284533DC6A9E3FA5F62B115B70F3423893EBAB26485395CD437C01F3626A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853112, "uuid": "2c7fa145-44cd-4284-a387-e41e7672f277", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853112, "uuid": "19920fcb-ee4c-4051-9e38-6912a8ab62b0", "value": "768:+xEogXReQMj7FVKhk3aKpv32I25YwwcPmer2RBYf2E/:+xIeQghVukl2IuwKmugBYfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853112, "uuid": "5a142572-e096-47bc-b5cf-895af61c5ae9", "value": 39720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853112, "uuid": "20dfc1a7-74ea-451e-8ef0-1aa51aaed1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853112, "uuid": "0463cf4a-76e9-4ae7-9759-212c88a570cf", "value": "UpdateRetriever.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a787451c-c747-11f0-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1763777101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763777101, "uuid": "f65f3914-a516-4eb3-b9ce-1979d841f3a5", "comment": "Malware payload (Cobalt Strike)", "value": "346daad4179b54b0db80a7171dc5ef2f", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763777101, "uuid": "8165e251-6def-4e83-ad59-20600d4fc5d6", "comment": "Malware payload (Cobalt Strike)", "value": "6c1b2c606d3d4923bc1366b596bee8ddf28bfd9c6344f287e02a8114e091871e", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763777101, "uuid": "ca3b9fdb-2ca2-4331-b30e-14f00ffbf7b3", "comment": "Malware payload (Cobalt Strike)", "value": "cc905ae4f6bbfe9769739edde652deb2280c9009", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763777101, "uuid": "e92da009-acf2-4577-84bc-452299265faf", "comment": "Malware payload (Cobalt Strike)", "value": "c944a70101f4b324627f2f976a6ca809f527c856b32c0c8fbb1a6d6685e2b0e5892387783d86df711eb8b0f7a0738e24", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763777101, "uuid": "43a14c8b-40a6-4838-a1b3-d1d942bef74a", "value": "T10EF1E842924439F2D87ED375CBFEE639FA71B2480F7532069E70DA522E22934B42C706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763777101, "uuid": "98b0ce12-6ee0-4ba3-8336-f48be0349c74", "value": "a6c514eff21cd106b23f51ec3ee175e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763777101, "uuid": "bf7aaca0-de3a-4931-96ed-7d95e6988b21", "value": "96:EqTknyuabaNFquTj5f0/OSs6BL4sC2nz15MBRzEoS2nNfdUWuth1Y:Eqo2a1j5f0xesCiM5NVtshO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763777101, "uuid": "f44fb9c1-adab-4865-801e-f9132e1224b5", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763777101, "uuid": "a85d5f64-1233-4202-a590-06e03b2ae568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763777101, "uuid": "22130e76-f084-402e-9705-4ae6db2343b2", "value": "s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d88682-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853326, "uuid": "eb0ec39d-0e0b-4e20-801c-ab43a7a3b0a1", "comment": "Malware payload", "value": "d6f8d230dc8389a6b646e08f99e1c4cb", "object_relation": "md5", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853326, "uuid": "3e116e6c-6905-4292-a1ea-7fc7552a1d35", "comment": "Malware payload", "value": "6c52c7e5fda22545d0a3860ac954da8c206d30f28dffbb0b9eaf0d5c130ea3d4", "object_relation": "sha256", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853326, "uuid": "3005d01b-e1c8-45dc-bb71-227e4bc22d80", "comment": "Malware payload", "value": "79edd903d87afaeba87c63321347a5499e5c2aaa", "object_relation": "sha1", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853326, "uuid": "364dee36-6dec-42a6-aebe-9d92db5c626b", "comment": "Malware payload", "value": "b23166c69c5c44b368b945651de1d303acb45e5c22dc6f5ac1cd651d356bd09498528a788eced1b1cc0339fc24f5ec1d", "object_relation": "sha3-384", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853326, "uuid": "3cdb2657-1396-42ec-94d6-e0b72f36ee5b", "value": "T11F21D217AAFD410075B5FA666E7080F21B977A148F79858C40CF3C0A5AE3974BB21BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853326, "uuid": "8f3a4692-3565-4336-b0da-354c68639d6b", "value": "24:Q1jfSK9QHZkrOOvyaVqcD5kvCniv9dcsRsmniv9diktRzs7+1mV0qBugl:A+KGHZkrOzYn0cTliUsaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853326, "uuid": "1718b8e9-d145-42dd-9548-e211f427ff77", "value": 1180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853326, "uuid": "ef118c1f-db1d-4ae7-b971-cbf0437d6f32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853326, "uuid": "a052b7ec-576c-4dec-bf66-551f60abf69a", "value": "Proverka.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1820a3a2-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855888, "uuid": "bc06ef54-2498-4f41-92dd-d7a6f8c4296f", "comment": "Malware payload", "value": "741637941daa76047973a5ff1528d111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855888, "uuid": "6587bf33-0f85-484a-b743-a6ac2fdc5471", "comment": "Malware payload", "value": "6c7a2ffd51c368a0e4ca103b3cafab72411618170036b57fd97c939d30aaa19a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855888, "uuid": "623372f0-0e4c-4542-9192-c4871b633b50", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855888, "uuid": "4f7a39c5-65d0-494e-845b-44e016598173", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855888, "uuid": "26d95bd0-aed9-4a6b-b81a-ce83816fba10", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855888, "uuid": "9fa35a22-895f-4d92-9578-0193709ac479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855888, "uuid": "a4e655f1-e9a6-4b4e-bf27-4a25d9452ef1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4a93eb-c756-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763783283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783283, "uuid": "ca80fe7d-e781-4147-b2e5-d4ac2195b61b", "comment": "Malware payload (Mirai)", "value": "1957dc9b3ee6b37a874716373a4d93ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783283, "uuid": "4d108202-a44c-45fa-a985-479738eb4320", "comment": "Malware payload (Mirai)", "value": "6cc76781836dca928918050d33558de5fadb0908c263dbe306ad555ce04f3024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783283, "uuid": "93da1f4c-55b9-405b-8786-fc70ad44d2f3", "comment": "Malware payload (Mirai)", "value": "2bdc238ae0bc835375bf3bf181b6c08d97eae014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783283, "uuid": "c02aa504-7fa6-4afe-93c5-f0ecdf5ac8e3", "comment": "Malware payload (Mirai)", "value": "de7d907f34d28a567f4d1ccfdf3cb909dee69ac9bb9507244350c11635589f2afc3f78e44adda88bf72c69e3a80bb0a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783283, "uuid": "9cdcc7f5-c86a-40e9-96fe-ba85a7981292", "value": "T1CFA36C66F9819B11D5C056BAFA1E418D331307BCD3EF72129D209F25638BA6B0F3E946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783283, "uuid": "f4eae4c9-a3d9-4f5a-a52c-83b63b962c2f", "value": "1536:7JnVW8ACFhSBmecljVCp2W1BgrnDdGN5MdYuaGwMUhvdfiJ0PF/qU71/YAcemH:3gCFqtppNqdYuaGB0PF/qUp/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763783283, "uuid": "699a1d0f-bf34-4577-8cbf-e3d206070f4e", "value": 103636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763783283, "uuid": "7bf4f481-fb0b-43ac-b620-73c1c3643b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783283, "uuid": "fac74f57-6fdf-4334-93bb-140f31325777", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9d3f19-c7eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763847441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847441, "uuid": "1aa93e71-8330-4cfc-8cfd-340004c6b8cf", "comment": "Malware payload (Mirai)", "value": "b1ae917f246f1a1712eb7abdabe9de14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847441, "uuid": "1755062e-8226-4ed3-8b4b-fbccf9695db5", "comment": "Malware payload (Mirai)", "value": "6cfa4bd1d504db0ab561eed71d57785b98bd985535cdc724f584c6e5f308f973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847441, "uuid": "b69ef172-4ffd-497b-8835-bd958b047d4f", "comment": "Malware payload (Mirai)", "value": "8a08c8c2c95da69635ab84c9b619140ce084c11d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847441, "uuid": "67182379-8a71-4b85-9450-6d1289f72253", "comment": "Malware payload (Mirai)", "value": "54689a3abd2dd25d530b8d1ae5d4277448cd12ecabd7a308892d8d760147077d7570ad5078a943707b0edccbc5dc49c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847441, "uuid": "2e6d541d-b701-49e8-8a4d-81610daa0010", "value": "T1DC44B60AAFA10EFBE8ABDD3706E90B4125CC551722683B39B570D518F54EA4F16E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847441, "uuid": "5a3acef3-e1b2-4f7b-812c-0d7fbf44e6c4", "value": "3072:9kuXdybKwZQq3jppCHDS2ZIQ4SNIcEuJLbCkEUN1HnT:9zXdybtZQwjpVPQ4jc51RN1Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763847441, "uuid": "f940c978-055b-47fb-afd2-42482b6e97b2", "value": 258800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763847441, "uuid": "4c2bc8f4-9d02-4905-a018-f86a6068a305", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847441, "uuid": "7943961c-ce31-4177-8ab3-3ab4dee375e3", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbeff64-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852945, "uuid": "86942d25-98c9-4fbf-b2d6-bed602b7ef68", "comment": "Malware payload", "value": "9ba5d0f5cea3ab9aa6fc04ccc959c7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852945, "uuid": "c9f1d68e-74d6-4879-9c6e-1efa7b0da8e6", "comment": "Malware payload", "value": "6d0d319dd6330e1f5fcd05471932c2ce6449e50ed1c5e5ed9a5320997af6c24e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852945, "uuid": "46d4423b-1563-410d-a046-b4dd9c9a5ea3", "comment": "Malware payload", "value": "407d2cdf2c29739420a314cc44a01de24a634438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852945, "uuid": "bf337130-4978-446f-b2c5-c5fbe5c860e8", "comment": "Malware payload", "value": "2e9277d3be2105ebaa67cca662c239a8a62035618acb4178e067c9fd9e3a74732b026a87bffc690ef9dc3105d3cfc2e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852945, "uuid": "b1126ab7-f08d-4f1e-8bac-a3890d7a0506", "value": "T19F76BE02FB948F83C4DF2FB610751384F774E516D392A7CB6550A2F8ACB27C40D5AA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852945, "uuid": "88d79631-89e9-48d8-a090-2ab347d1febe", "value": "98304:AY8hSe84UE0yq6XDe8i30du14rMTQektKgUOX32yn1lrt2KdT1:AY8woUESkdfeOUg35rTp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852945, "uuid": "c4cbe28b-24fe-4925-8edd-a5f889081d74", "value": 7808808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852945, "uuid": "1b7b37a9-f12b-48f2-ab31-ed1ca40ebdbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852945, "uuid": "38a9145a-e288-4fb4-bab0-8859f181e4c4", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ee525d-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855889, "uuid": "18708ac7-ac78-4013-96a7-f47c31d4cd0b", "comment": "Malware payload", "value": "beabd44477127263e542d90702285eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855889, "uuid": "6373ea29-2247-4ebf-9c55-2d9bf4713cfc", "comment": "Malware payload", "value": "6d52c6798065aca2f2e8349ec10701790bbd299481cd0fd671d9d49aab73356c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855889, "uuid": "8629c126-a771-46d6-9515-fe3f5097f5a4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855889, "uuid": "eb4d5bfc-4df7-4503-92b5-011d5f08e704", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855889, "uuid": "c0299da8-d383-4772-8fa8-1e8eff767585", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855889, "uuid": "763e8409-25a0-4224-9b3b-b317d50e255c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855889, "uuid": "29165aa1-ce5b-4244-aa9d-b4e1dc1466cf", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19dd752e-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855891, "uuid": "34c99683-4171-4f96-b8f9-97f35471aecc", "comment": "Malware payload", "value": "4f43e1260b69461a8bb2d070a7cd4ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855891, "uuid": "c93b4d42-2c13-4326-8446-a987f443aaca", "comment": "Malware payload", "value": "6d5db028a34bfc727220e73f2e5f833e92eae2d054cf919c6a1a1d489aad550e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855891, "uuid": "9d9138d1-a521-42e2-86b1-816d48c86e1a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855891, "uuid": "82ae9e42-76b4-4207-917b-d659248acebe", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855891, "uuid": "ca16a47a-396b-4266-9b1d-bf4d24505706", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855891, "uuid": "417f25c3-180d-4c05-bfe4-61d626bfff55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855891, "uuid": "9f0cb45a-e744-4ce9-9ee9-40482d35b92a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab2aa3a-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855892, "uuid": "91f4b556-d1d8-436a-ae9f-6d6e7f1b2b28", "comment": "Malware payload", "value": "e4def6c7c8e7b16404a14e695ad131c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855892, "uuid": "6176c0ce-24ce-4641-9102-b76ee3f6c2a5", "comment": "Malware payload", "value": "6da8a471ec6b2ad28c1d893b415660f62b88a9d3d64906485026dd010e56f15d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855892, "uuid": "c96d577b-34b1-4a8a-863f-3de47656d38e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855892, "uuid": "7564c30c-16f9-4878-82ed-53f5ceebc3d3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855892, "uuid": "7b2a3585-d119-4f26-91a7-c6875f4d5024", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855892, "uuid": "1503e2bb-af40-49fa-a354-ee81a2001af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855892, "uuid": "bc3bf172-66c2-471d-9a72-994bfcddf4e1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b700bc2-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855893, "uuid": "77633e69-bac1-48ee-96e5-7f7b6e02c731", "comment": "Malware payload", "value": "4d0fedbf3e6923a0fdc5c0a3d7bdf23c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855893, "uuid": "f4842f38-0b50-4780-9337-5ce171dbb806", "comment": "Malware payload", "value": "6dafcb989de4a47abbe2537752eeb441272c45a5aa3e2977cd6e71cca541e0e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855893, "uuid": "238d390a-a3c1-4037-b82a-f68661298959", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855893, "uuid": "8732e7db-4cc2-4932-8d45-3f8e6e7f9eca", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855893, "uuid": "9747ce9f-99ea-4ebf-939d-32850d60e919", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855893, "uuid": "5a7243b4-b158-46ca-b24a-d22422869a2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855893, "uuid": "2c2da9a6-f678-4173-a60d-ce5e909807bb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c406cca-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855895, "uuid": "1efb8801-8e73-4cf2-a9bc-199d9c7a93c8", "comment": "Malware payload", "value": "7ca77e31698adb018668c321bd858af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855895, "uuid": "3ca4bb40-4e42-4ce9-86fa-0b5e4edfa500", "comment": "Malware payload", "value": "6dd1dfb1b14e09a4dca8a863e6d76f4aa70708287c4ab0f2054edd18557d86dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855895, "uuid": "7011db39-b9c4-4262-8006-5d73b5f26414", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855895, "uuid": "d8abb888-00ad-4a01-8626-409df0c0fc5a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855895, "uuid": "09e9e0db-4218-433b-917a-f67382edfa4e", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855895, "uuid": "5ac29f0d-5bb0-4e38-8fd0-6686db6ed87a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855895, "uuid": "2ff68854-95e4-4d61-ab99-3e4304551630", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0ad350-c757-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763784006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784006, "uuid": "a3193692-3871-4e6f-a845-5f11b295e1ae", "comment": "Malware payload (Mirai)", "value": "2ac021ecf5e385bc6685227aca458876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784006, "uuid": "c69f6ddc-76ae-446f-a44f-4f9fc2e93699", "comment": "Malware payload (Mirai)", "value": "6dece824c88ec2ed11f8ac7c87938104e240a73e4231a95a0c5904f01303e307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784006, "uuid": "6a96ef28-a97b-460f-9b8c-3b9dc5c842c4", "comment": "Malware payload (Mirai)", "value": "023ecfe120b3247c4ec4487d3dceb6c30e384226", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784006, "uuid": "460f3e00-3245-4bfe-b2f7-797a2b0f8e84", "comment": "Malware payload (Mirai)", "value": "cefb7b365dae8ccc2711be151e6c12ddcf8333be0d3e205a3819df7dfc91d6911887353baf7de6fcd15a6ae578d6454a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784006, "uuid": "ee474168-c840-4e17-82ef-67d055925590", "value": "T17F149120FA0663B2CC720A3897956E5A6E7B04559FEB26312D1F533DDE628509F30F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784006, "uuid": "ebd71c67-b42a-4ed7-94b6-e0ff00357b67", "value": "3072:p9xIIk4XbJGSnJdLwnKWeCoa3cBxfUR/U4euJUKF:7xc4XLJdLWeEAmR7vq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763784006, "uuid": "e516e0f9-08d4-461b-ace6-4d27dd8b3002", "value": 197268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763784006, "uuid": "d19e28f9-030c-46f9-b6f3-570bae28e9f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784006, "uuid": "9487f312-3648-4902-ac24-c74a5fe13ae4", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d148f95-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855896, "uuid": "aa2c422c-b493-462f-b0b1-8a82e4629467", "comment": "Malware payload", "value": "15ad3cb8ad133e8c884365cc4fa6d889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855896, "uuid": "a1d9852e-325b-402e-b45f-ff78fcf3d306", "comment": "Malware payload", "value": "6e35af9c8c334852a5d38aaf190c46628c976e930a56654114059fa9c4920fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855896, "uuid": "2487a548-ef91-4afa-939b-542e5fa848ac", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855896, "uuid": "ace0ec97-1547-4c19-964c-a1f129d6e2ba", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855896, "uuid": "8ed91093-398b-419a-a498-dac7f2e17f21", "value": 2351616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855896, "uuid": "04dae3f3-462e-4d0c-8853-ca0ebccf446b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855896, "uuid": "94a71380-aa25-4018-b3ac-3ab6cc2a1f54", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de87cf3-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855898, "uuid": "6c00dcd9-4677-4985-925f-3a2dd7a6b6d2", "comment": "Malware payload", "value": "5ee45764082ef60c997530a1b94233b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855898, "uuid": "04bd4f3d-468d-40f1-b45d-70928e95a6ca", "comment": "Malware payload", "value": "6e4f9663e0f5132a1213276c30bdbe5144d07b26edb65126d479c525128cf432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855898, "uuid": "e9f1ad3a-cf54-4a20-b63a-3c3ef23bf5f5", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855898, "uuid": "9fad0420-269b-4d86-941f-a7b3c601ec19", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855898, "uuid": "2a76d21b-b6f5-45bf-acbc-3416baf28902", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855898, "uuid": "057fe02c-580f-427b-91b3-b1a82c5c06be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855898, "uuid": "8c08c1ca-7f58-4820-96f9-60b79b579be2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecfa0e9-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855899, "uuid": "5b8c87d0-aaa1-46b8-abb1-5438e22ee4ea", "comment": "Malware payload", "value": "40504de91317b25e9fbf5c7d1b915303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855899, "uuid": "02e24663-cb17-4015-a89c-9046d47d2498", "comment": "Malware payload", "value": "6e881536e778cff99f10ace57a559214c78b4827bb2e64c4ec89a7487ac10273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855899, "uuid": "02f590ec-6f06-4fd3-94a3-671c20881ae9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855899, "uuid": "0e0a6187-8fd2-4103-9869-bf07cea8ded2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855899, "uuid": "3b07bc00-76ea-426d-b018-84fa4f9628aa", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855899, "uuid": "4804c05f-3c9e-46b4-900a-97fabdac80a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855899, "uuid": "794c762b-4458-4cfb-8ef5-3a9fc1dc912b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318af198-c7b7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763825007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825007, "uuid": "b7dae06a-19fb-4dfa-b649-b8708e0ec788", "comment": "Malware payload (SalatStealer)", "value": "c518f9ad246c9534e1b3f89d5a4fd526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825007, "uuid": "b309aa02-292b-495b-b2ad-d02ab5cf5096", "comment": "Malware payload (SalatStealer)", "value": "6f3fb42f53a9e3d3702530c0e6dc20a9ffdfa28d295a125c66f2875b0fe25450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825007, "uuid": "c45bd69a-c7df-4e8b-a2a1-3005d1b9c401", "comment": "Malware payload (SalatStealer)", "value": "186f6f145577f0bc5db13e67f424b201f5edbd85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825007, "uuid": "7cf67bf7-dd0e-4dcd-98ef-1bfd924def1c", "comment": "Malware payload (SalatStealer)", "value": "9ababf2b277fd54e85d589347d8dc8f5a74310bfcc1d6aedf9bf4a580489a12a0cb88e254bbf8eb320c30baf2a56a4ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825007, "uuid": "b35a218b-7ef4-4cf2-b037-a2550a1e0f0a", "value": "T1E2C65A41FA8B54F6EA031832415BB23F23315D049B28DBDBEB547B6EFC77681197A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825007, "uuid": "150aa403-621d-414e-ad56-2655628d6b3e", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825007, "uuid": "5ce90572-ca80-4bae-9c62-7b122b7b36b3", "value": "49152:AKGzsyT+HdCOp2yvhLDqZlokxcqNrNEKTv55xe3tKg40N7Lk1jY0UH6iEN3IC2uc:nSsM+x2sJWRE9emFKvfZf2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763825007, "uuid": "32097456-575e-41c3-8cba-2e9a8ca11317", "value": 11654656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763825007, "uuid": "9e887a7d-4e32-494b-acd4-80cf3cdfca5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825007, "uuid": "365d0034-a223-467e-8089-4e4286474cc4", "value": "CRACKSKEETFORCS2FREE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbb24c5-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855901, "uuid": "61ac6cda-edeb-42e1-b8be-13402a24616d", "comment": "Malware payload", "value": "53d35066921c966f2ebb7c6f85ed2035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855901, "uuid": "d2705ca0-8974-48a6-bec6-fb2afd85a657", "comment": "Malware payload", "value": "6faadff4eda979a826aa3690fe5068856bd46a1a4e5da8b238b7885f24e9704a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855901, "uuid": "b88ddf4f-ebd8-4519-82d6-e2149fe3450c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855901, "uuid": "f57cf868-261f-49b1-a5aa-e6d5b1cf9a5b", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855901, "uuid": "c20ccab5-da8b-477b-9e7c-db03f5d3e0fc", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855901, "uuid": "7ed616c0-9608-444c-aca7-8f2737ac2b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855901, "uuid": "150f915a-2a1b-4646-aa4e-6d57d62cc2d8", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208a2002-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855902, "uuid": "0a99ec86-0b87-44e4-ba9f-cb7ad03ada86", "comment": "Malware payload", "value": "532200481adcb617c81db1d11a94f7a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855902, "uuid": "f3dccb68-2d38-4009-b566-438705227e68", "comment": "Malware payload", "value": "6fbb7d9806b2da7bf27afaea83cc85baf9884a6fa33e31821fa1d1f41ff0c4d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855902, "uuid": "61985a0f-dfe0-4fcb-8de1-f4c330fc5752", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855902, "uuid": "ec8c15b6-c5d9-4aaa-bdb6-c955ddeef474", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855902, "uuid": "840fdf60-80ae-4d46-b32c-adac9f91b9bb", "value": 1868800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855902, "uuid": "db6fcd34-20d5-4c2e-a59c-524f4f36ff32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855902, "uuid": "7903bc9a-d254-4800-b6b8-fcc9711fced1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217dd301-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855904, "uuid": "7ac2fd00-1770-4f67-a788-5e701bf49e09", "comment": "Malware payload", "value": "a9e09ec290ea2a910265283d24acbbaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855904, "uuid": "62fee85a-764d-4cd1-a69e-f9b944f9bd86", "comment": "Malware payload", "value": "6fc89d89d0c4a1fbb7927bb156b5cdd0e10cb9adbbd17a3ae10382c613cf924f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855904, "uuid": "1abaa29c-f5aa-43b8-90cb-c200b0b90342", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855904, "uuid": "5f9923cf-4b0f-407a-b22e-b8dc6729de87", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855904, "uuid": "6ef33dea-e757-439e-b8d9-1c65cb3e7aed", "value": 3842048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855904, "uuid": "a45f0c5c-9c96-446e-b6a5-67ecb3a23deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855904, "uuid": "e2d1f36e-7dde-4cea-9851-f64173aec41c", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2239a4a8-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855905, "uuid": "97a3469b-d596-4ebf-8567-b3e20061fdfa", "comment": "Malware payload", "value": "925db75af8fbac7f6ed5556a8c92029f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855905, "uuid": "9298465c-edfc-45ad-a8ea-3d016b33b807", "comment": "Malware payload", "value": "703cbe1ceaa85b0a74abad9281d17a80967c23f4ee209b3c8dd2454a343d3420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855905, "uuid": "a9eb0aa8-958f-4b37-8d95-c9fba6d6ebe1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855905, "uuid": "02137f64-8f1b-442c-9104-ff6110698314", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855905, "uuid": "eb153220-b586-4e03-9d87-beeacb8e8bc0", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855905, "uuid": "cdb31461-4e37-471b-aa55-8ecb1f599ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855905, "uuid": "3cbfe323-23f8-4885-b439-b05fc7773dbe", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232b67c1-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855906, "uuid": "23239561-a1ee-451c-b3b1-9b7029b4f691", "comment": "Malware payload", "value": "dccf81720493e1feb118c28c880de43f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855906, "uuid": "55d7ffb1-318d-4594-aeb9-63fdc378c7b0", "comment": "Malware payload", "value": "71378650d3dc38c55c184ba81322695567fb860df07b11d0d2cdf1b72917e885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855906, "uuid": "f2af2ef3-5d36-4d42-b0b5-3dd97db4d35c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855906, "uuid": "30a0dc8d-be57-425a-aa08-9cf22d79d502", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855906, "uuid": "3aa4c13a-c12a-48a3-ae64-fb780865c0cf", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855906, "uuid": "8b5863a2-04c4-4b91-8dfd-467253d5fd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855906, "uuid": "676b2654-0464-436e-a9cd-2b97032a9bea", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2407fa1a-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855908, "uuid": "8ef32225-d009-4de8-b787-7037beef5c4a", "comment": "Malware payload", "value": "43294fde346b8ba1342aceb6cb38d90f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855908, "uuid": "c6c242cf-d31c-4ddd-b225-09cb0b0c6356", "comment": "Malware payload", "value": "714c526ffaafd548700065a4ae550b4c73e2f3a72653dbd9b112acdac86a4e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855908, "uuid": "4dd4b3f0-800f-4c42-b189-3e5f737e02c3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855908, "uuid": "b920f8b4-8e51-41c2-a225-cd08aebef4ce", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855908, "uuid": "855bb18f-fd39-4fbd-b81d-00258acbebf0", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855908, "uuid": "887c86c7-6e4b-45cc-a9d5-ed8a902addd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855908, "uuid": "3c86facf-1134-491b-86ab-0bae69ad22f6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e2f005-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855909, "uuid": "5e30b546-4e11-4a73-8b55-580143b2f6b9", "comment": "Malware payload", "value": "22fdcda59eb88488ac0f3a9c33c8de71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855909, "uuid": "e6701913-0cf8-4741-8d14-2617b00f3f21", "comment": "Malware payload", "value": "716a0a7af8fbbb64bb59316b86ba3313ac7b4669d15845365985c2193f007eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855909, "uuid": "c164ecd1-7ec3-4dd3-a28d-4a6a23aee7e1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855909, "uuid": "a2bcca4c-a8c1-4bbf-a4f2-69f2f281a1d9", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855909, "uuid": "94e72989-1462-462a-bc2f-428743cc5fa2", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855909, "uuid": "e931ae0f-a4c2-4b23-817a-8a66687496ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855909, "uuid": "f56c2350-ce8d-4054-a8da-31ee95cee6c6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98755eb-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855327, "uuid": "18d8ebc9-ab3d-4580-bf12-7ba349b9dcaa", "comment": "Malware payload (Mirai)", "value": "a5e0bb799dc75b317570822a4ab8203f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855327, "uuid": "3c05b14f-2f4d-4b27-97c3-123f44b51b67", "comment": "Malware payload (Mirai)", "value": "7185ecbfcea16fe14279d4987cf089d3a73bdf00c7753d41965fb53a9a062828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855327, "uuid": "a4c9bba1-b5cd-42e4-b335-9177116c7c87", "comment": "Malware payload (Mirai)", "value": "ca58afb779c30827aab9e97353a24253116991c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855327, "uuid": "4a6f3ca8-708a-4386-b08b-d78ecedb8ff9", "comment": "Malware payload (Mirai)", "value": "a9f2646b9e25038876c26091a9b3baea0985c48639c9b418ad98897475535f2d625cfd7dceb7b70acf538ea4fdcd0dd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855327, "uuid": "066ff431-97b8-43ed-b695-4955f1bbcd70", "value": "T197C3AE87FB8B10A0C8120AF017C71F9D6B576211CE5FE8E3BC1E663B5A7A4DB1516781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855327, "uuid": "d893750c-2b34-48af-a6ab-73eb125ad63b", "value": "1536:it+2mPrGbK8XzSi58n6iCGrf52T+biLdT6XqlI/uCAYUxP/QgEvEw/LW8:itQryKYzSF6iCGL5c4WR6Xq9CAYVgIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855327, "uuid": "f3eb6486-5d5c-4e4f-93fc-941d882d32f5", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855327, "uuid": "510fd998-5f72-4deb-9d7d-56563ad54a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855327, "uuid": "a411a5b1-096b-4caa-b5bd-f427aaa72aa5", "value": "Labelloperc80.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b2f7f8-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855911, "uuid": "f59f4c03-209e-41d1-8348-be71551d87ff", "comment": "Malware payload", "value": "e2c0dcf4cfa6769f56d139aa1efd0832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855911, "uuid": "31d37d87-0366-4297-b619-dc92beac111d", "comment": "Malware payload", "value": "71d5fc57955dc5d1f0224662c5b0ff1342bd3d0ea03fa1ee8286f9739bd9c927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855911, "uuid": "7bbcff14-2a14-40b6-b942-c3de52ef3485", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855911, "uuid": "4f4b46f7-8be2-4285-959a-4f80215e4c0b", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855911, "uuid": "8ea506be-829b-4163-90a0-2b378a436c88", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855911, "uuid": "afca0c86-8808-47db-b95e-7dbd398849ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855911, "uuid": "397c235e-ed93-4946-9303-bbf79040fdf6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26849542-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855912, "uuid": "58ab0375-8408-4289-924b-37302533d582", "comment": "Malware payload", "value": "78d96b4fa0822465b35d393e0d7e5d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855912, "uuid": "9869e4ac-3e9f-4747-ab76-52ac0cc803c4", "comment": "Malware payload", "value": "721c1abc1902d6dbfc39595d4b01a80e75d8b6c653b1847aa6773cf829acd589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855912, "uuid": "cb93f983-ba0f-4ef5-9402-5a5391c543dd", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855912, "uuid": "4917e94e-940b-476b-bc83-be3792e75c28", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855912, "uuid": "53ad3628-e1f8-494c-94d8-921479ce0e70", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855912, "uuid": "779fc73c-e6ad-4664-be4e-15d984361fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855912, "uuid": "7b5e4bf8-faf4-4918-beaf-09dcbbc176ec", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7496770b-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829414, "uuid": "59efe914-00bd-4811-a3c0-718edd85a975", "comment": "Malware payload (Mirai)", "value": "50ff992d2a58f02f2e8257eb58834f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829414, "uuid": "ff5682da-3947-43f7-a351-22ec801d39f0", "comment": "Malware payload (Mirai)", "value": "721fe15d7d32f9940823b6401dba7004634d31e5d0144e778e07fd24d266d0f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829414, "uuid": "25919ad0-59d2-4d1f-b25b-aeeeae4fafc1", "comment": "Malware payload (Mirai)", "value": "48263c28909b933707f13d0f9f558edbbcd0812d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829414, "uuid": "b16dbc8f-838b-4bb2-ac6c-4fee71a0f2df", "comment": "Malware payload (Mirai)", "value": "df63830069e81e1597abcdb358e6bbb05fe130b0d631a7abcf292c69582d4a98a4e43ddc21d596174e3b8abbd92b57bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829414, "uuid": "9beb97e3-b169-437b-ad79-f61d166d13dc", "value": "T1AD6302B3CE50B0A5C470EE32E9DD9D079F9FDE6CC6FA15F60838782E9D4249520991A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829414, "uuid": "b256aa5d-7d68-4833-8a89-a86760360cd2", "value": "1536:eyWM+LX4IRZgfW7G1c0OjTH+M7uj/S4zQopjZI4L5:eyWMCXJZxJLTtc/S4DtI4L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829414, "uuid": "34a66f74-81a1-4093-b420-a4a85c0e8f6e", "value": 68144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829414, "uuid": "e682427d-5370-4a3b-8c4d-4d162ed320d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829414, "uuid": "9b3b0fc1-a9b8-4cb1-9881-d96f2d1fb75c", "value": "Polar.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276ab257-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855914, "uuid": "b7fe7b26-fa82-41e1-9239-d01d051b29c0", "comment": "Malware payload", "value": "d9722df06aa71ec892656dfc5de4fc93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855914, "uuid": "bda4f926-3d42-44ec-ad4e-6795bc7c6e3c", "comment": "Malware payload", "value": "728874593a6620e8f50b9227d59f2cff5e6c56ee30ae4594b6ee9620d7f2bf22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855914, "uuid": "27eb6c4a-87c0-4dc5-96fa-dafc58e3a862", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855914, "uuid": "86a94c5b-f14d-4c1d-a665-9e91f09fd075", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855914, "uuid": "0f49787c-3cbf-4ae1-b566-12a305d55a8a", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855914, "uuid": "797c5cfc-44e5-4ee8-bd1c-f163ddfa124c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855914, "uuid": "2994220b-2639-4482-8bee-3864f3209d96", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283a302e-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855915, "uuid": "5ccf6edf-53b3-4d0f-a697-791957c5f308", "comment": "Malware payload", "value": "144baa733bd1d1b97a3a13bd816952a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855915, "uuid": "6bd53d0a-9de3-4ce0-bc05-05264176730b", "comment": "Malware payload", "value": "72a3622715bba964d7a14ddd599f9aaa159fe14e31bc6f00d03a9982cbbdfa39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855915, "uuid": "35d23c20-dfe2-4b22-b017-8f46dcbd11a4", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855915, "uuid": "e3368473-f590-4b80-954f-b77476677951", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855915, "uuid": "6d99078f-8d3c-4cc8-ab43-d5d1be28e9a1", "value": 3270144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855915, "uuid": "fc50e889-28ad-48a1-8f55-8fb4403291f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855915, "uuid": "0e169c16-d0f3-4aca-878f-f4c31dc6f88f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fc6a70-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855916, "uuid": "b3963e74-e2e6-4b2c-9c9c-779f82db1161", "comment": "Malware payload", "value": "62bb88b39e61314295f851380ea319bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855916, "uuid": "ebb432a4-f78c-443f-ba5f-d9b94a536815", "comment": "Malware payload", "value": "734380fee978640667a78eccb398ece5c88b8f7ef31aa217bb393e50d22f41a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855916, "uuid": "0160368a-2a3d-4983-8d4f-6eec53bd5c39", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855916, "uuid": "9a6896af-7230-4d2e-aa59-5d6563284eb3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855916, "uuid": "1dafbacd-3ca7-476e-96a3-4e17f5f465bf", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855916, "uuid": "1f328395-f720-4dbc-a995-51c5afde1036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855916, "uuid": "52b02ad7-2bec-4ac4-bfec-41c201795bcd", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d3cb26-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855918, "uuid": "19e93d75-a6dd-45bb-9128-9a66adac451b", "comment": "Malware payload", "value": "307aa4a3df12a6175b767e4e993d844b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855918, "uuid": "68fe0838-6e72-4e0b-96c2-0a5fe01cba33", "comment": "Malware payload", "value": "734bc16ac5b8069d0906b610f15e4c731be3700f2bf1006654b85eda69e390df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855918, "uuid": "32256941-7cae-4457-ba21-ee3e8ecd7831", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855918, "uuid": "7774db09-2a4c-4f00-8e03-4d9ce75d63c2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855918, "uuid": "109d97ab-e038-4c98-8cc9-d5ca8370c37d", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855918, "uuid": "a0c1dab3-b979-4570-b834-545555f459b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855918, "uuid": "5fdc301f-8810-486f-a26e-3f226537e1d6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32efc9aa-c784-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1763803105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763803105, "uuid": "a32054bf-f160-4834-b9ed-c4fc1397e66b", "comment": "Malware payload (Adware.Techsnab)", "value": "a38956d64fc58f7042e38bbfd03012d0", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763803105, "uuid": "6018165e-f41b-4866-81d7-8ad8ba188e5d", "comment": "Malware payload (Adware.Techsnab)", "value": "73ef4e72847017ec56990591fe835d00fa6a45ec35eaa78d7fb5fe22a0ceafeb", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763803105, "uuid": "b2b88803-b809-491f-b467-a8414a077890", "comment": "Malware payload (Adware.Techsnab)", "value": "c89f432fae508516772b44f565b0ae2ee2c7af30", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763803105, "uuid": "3b9fabc1-3e27-46e4-a2ae-1764d4e2133c", "comment": "Malware payload (Adware.Techsnab)", "value": "09e1c9d2c5807a01630daf30de0542b1b1d3bfa6e9d230158f92a919b0cbfd861d18e01786e7d1347f67931691a2f6b2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763803105, "uuid": "d2623c55-ce75-4f88-8534-e6ba45b56e3b", "value": "T10EF45426AEC75CA783D39F63D2E3E31CBE68849D811B5AC4B5B9C3C21860D690749F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763803105, "uuid": "5c6e1fb0-60a1-4fdc-ae8c-fe8f8a345b3c", "value": "12288:mZiyXx3spF2HJGDu5xXJGeyRiFds7s1GqXg:MZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763803105, "uuid": "5aa956e8-bec2-4da9-8d84-49e519cd06a3", "value": 793109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763803105, "uuid": "43244bc7-35d9-43c6-86ff-14bd75f7ad85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763803105, "uuid": "c840d83e-2201-477b-b626-01e3f4757147", "value": "nocturia.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aed79fd-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855919, "uuid": "b05e1f3e-3c7a-45bd-af82-2ef2f888f7ac", "comment": "Malware payload", "value": "a730a867ab7e95be85638002b037b129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855919, "uuid": "56203a12-cdbd-4003-a23b-ee1d47f0865e", "comment": "Malware payload", "value": "745cde76317c659eda22bac76f7dae8e8d20b56aa120d828fdb0bd7d8b507e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855919, "uuid": "23b00d3b-98cf-44ec-8a7d-f42ab1be4b11", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855919, "uuid": "dc3d129b-b30b-45e7-8d84-e39c425c1525", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855919, "uuid": "0ca47e7d-21c0-434d-a5f6-9beeb96e6f42", "value": 2160640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855919, "uuid": "ad1e089e-c942-4205-b36d-024cc96082e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855919, "uuid": "25f8b03a-1c71-4cf4-b20a-eee87248e653", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd85263-c7ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763820088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820088, "uuid": "d1e3983a-5dde-4d04-a49c-f13f36ce086e", "comment": "Malware payload", "value": "ea3863ea6e0dbecde116a097306d4727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820088, "uuid": "3821ad74-00c8-459c-8ca6-b65e62ce9684", "comment": "Malware payload", "value": "7497372d24211844aa57ae4d4f97fd8b324c5f3f5ce4c81e8c150ac3b4c9815b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820088, "uuid": "acf50e7c-9e0a-44cf-8513-f22038293b9e", "comment": "Malware payload", "value": "484c1bc0b5d706fc0333fde2799b36595a4341f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820088, "uuid": "4f07231c-0bb4-4244-944a-35cb9580026e", "comment": "Malware payload", "value": "8c6415146c335052b77693eb0bdbd7399c5bf4dd58074e3d47f092b27c15557446747d20912bfdd13ff558585d6cfa91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820088, "uuid": "d8465294-208b-4c38-9d4a-80a15e3926f1", "value": "T1B5C3395AB2E01198DBB581F6D9921706EB7074321B15A3DB6BB853B31B2B4C68F3C3D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820088, "uuid": "7ccd4f84-46cf-4841-b1c3-a6f7234abf26", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820088, "uuid": "71407be2-cde1-45d5-903c-bf5efa8b8822", "value": "3072:62sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXS8:bbJhs7QW69hd1MMdxPe9N9uA0hu9TBT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763820088, "uuid": "9b6a7a95-a218-4431-a1a7-a503359080a6", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763820088, "uuid": "e3151a1b-f864-4827-8b1a-335475bacc27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820088, "uuid": "19fe8bdb-7bae-41c2-b098-e1b843febb72", "value": "clore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb8ff5f-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855921, "uuid": "771919eb-da91-4038-96f0-2ab1dceeb07b", "comment": "Malware payload", "value": "6337084fd5c4a02478d699f87b3fa60c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855921, "uuid": "1a725a30-97dc-4b7e-86e6-7c3ed54d5773", "comment": "Malware payload", "value": "7497dd1eb30c167abcb1d9d1c340c4c41eabac6f1c665fcd116974653825c574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855921, "uuid": "5c4214e2-888e-40d0-a7b3-5d5a6e1f0d52", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855921, "uuid": "c5c619bc-e2ea-44c6-8e95-209d5d822bfc", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855921, "uuid": "f648d843-8873-4a4b-b0e4-b1c4c0dcbf29", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855921, "uuid": "eae7f48b-da6c-4d4f-a212-ad3f4c74ba8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855921, "uuid": "ebdfd85a-0e65-4a18-ac29-192de30f1381", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c88c0c0-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855922, "uuid": "745848d6-eec4-4503-9986-886c208d969b", "comment": "Malware payload", "value": "98d4b0c924cf3bc4b0115e84aa9b1b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855922, "uuid": "32c4d708-4c0a-4886-b4d6-e3238280f902", "comment": "Malware payload", "value": "75843be09e0d759e5bfe540a0ddcbefb394a127fab5718e43091b54b1c391701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855922, "uuid": "92119153-7bd8-424b-9b6f-e3445dfc72d9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855922, "uuid": "d36e4b1b-e62a-4f93-92ca-6a24919fa322", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855922, "uuid": "73bbcbb7-8a59-4b6b-9416-d6f29e1c7122", "value": 3290624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855922, "uuid": "a2a1c913-7b29-46dc-a8c4-005cb6e9c796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855922, "uuid": "480daf33-99a4-47e3-8f94-2436f76fc6cc", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d56f416-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855923, "uuid": "cb9bf8ba-e867-4ea8-a9a9-1e118ee3ec49", "comment": "Malware payload", "value": "5ff4c9c63491e82d0596b0f7636aa415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855923, "uuid": "36af69f9-727b-4a61-a484-af13124970e6", "comment": "Malware payload", "value": "75c4d4d1c4792b977223573eeeaac2bfeb9fab822211913791819c37c614dd8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855923, "uuid": "0acb95ba-ae69-4090-8662-3cddc9c92a05", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855923, "uuid": "10195dbe-3094-4abd-a25d-ea208a1eed9a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855923, "uuid": "97ae7c4d-5f2e-4b70-aca3-5a8cd998b232", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855923, "uuid": "1166854e-c972-4be0-a7d5-36c4bace8573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855923, "uuid": "f8aab161-cb2d-4da4-b223-c3d65e2e9174", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76722cf4-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850892, "uuid": "08bc5b20-ce2b-43ad-a31c-d812a1b816da", "comment": "Malware payload (Gafgyt)", "value": "f0250fb8db786348ed1522b909b6b90e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850892, "uuid": "83c5812a-ea08-462f-93cf-a01487598276", "comment": "Malware payload (Gafgyt)", "value": "75c8fcf25c8a052c551f859c411c0c6a6bf3ee1db6078257f48f13ad903d2293", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850892, "uuid": "57950b19-d78b-497a-8baa-0f147414c3b8", "comment": "Malware payload (Gafgyt)", "value": "ad3b186502e9257f0158a1f2bbee1110fd51f3b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850892, "uuid": "6193c445-4bde-4378-a52c-a1ea9f8a63cd", "comment": "Malware payload (Gafgyt)", "value": "d35af77cc289821d91bded53cbee4e419ddb62b78629ff856487b9ec9ce74b50288f51a7bcdb616b02432d7194c9d497", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850892, "uuid": "850d5c59-b475-4ead-bf5f-5f5d1a53fe03", "value": "T12AB329377B270E23C0CA147112D70732AAB5C6DA38F95397B9E06DAC6F16A843916FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850892, "uuid": "f2652614-445d-4a5f-97de-cf82904b4327", "value": "1536:hXAoRLaNM5qtLO3tELfphmdddddT+WjB3oVmYj1EPZjDbfKasj:h7LaN8AO3ephwPqVmK1EPZHbfvsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850892, "uuid": "dd91e964-c857-4dd4-9c94-1830832ca659", "value": 108147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850892, "uuid": "c52198eb-1bfd-4ee5-ad12-0b33395e08d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850892, "uuid": "1abf3fe0-ccea-4665-8c9f-f42a6b3a2b15", "value": "Ayedz.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e6d0f-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855925, "uuid": "f26d1008-303e-4c39-ac6b-057ae0ef3850", "comment": "Malware payload", "value": "f411c2f173564dffbd7e984f086f73ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855925, "uuid": "1135007a-08ae-4e97-a4b0-6631efd155da", "comment": "Malware payload", "value": "765537d66bd1ae51873133f1e6f2ddaef56e2e8aadc1c18584c236600cb172aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855925, "uuid": "0fed9ac3-522f-4113-8b81-5d467b1f414a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855925, "uuid": "74b0b8ca-e101-45fc-84e1-cc94ea08ab7c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855925, "uuid": "38d09e2e-2764-46c0-b67c-04836cf9afec", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855925, "uuid": "c3441ded-535e-4b1c-a72e-df599329b53a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855925, "uuid": "ff545a3b-3336-4301-bf24-147d8f0261a2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3794f6be-c7af-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763821581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821581, "uuid": "f741eb1e-6647-4e2b-b5c2-384af518a042", "comment": "Malware payload", "value": "d301b8f92196a24b18a4b20627e99e1a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821581, "uuid": "70faf299-7806-4d0a-98b9-19499294f966", "comment": "Malware payload", "value": "7662e842e5b0df0d88f91d746981be7f5339894c6f30fbd57dedf5fbcc733e89", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821581, "uuid": "915a288b-e1ba-43c3-8063-e2e3f056fae3", "comment": "Malware payload", "value": "9330d8c414803c041b8cc7bed5f42df58f576801", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821581, "uuid": "87531588-9f28-4c5f-8335-7a635e95a901", "comment": "Malware payload", "value": "359206eebc3ebf7b96de7fdb5d2455488ec3c97d4c42f9c01318755023b20996cf9c21e5b2d80b9e38b0fb411cd4568e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "Trojan.VBS.Agent", "colour": "#95EFB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821581, "uuid": "75a287c4-1837-4875-a8a1-f726fa340ee8", "value": "T169B48C137D81A43AD9BA0E36883A97A15F7CBD244B70859B6388751DDEF00C05B76BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821581, "uuid": "b005cfea-14db-451d-bc27-dcb0d1c1a2d5", "value": "6144:o/mZE1jOZy2KL4GBiwQtEa4L2s41xRe0VkaDi75p2rrqN:o+8jOZy2KsGU6a4Ks41x5VkGij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763821581, "uuid": "d8b17e78-56b0-47e8-b1ce-4217ae22bb23", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763821581, "uuid": "c3fa6c24-3659-4e71-80ca-8eeca8621856", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821581, "uuid": "ffeec0da-fb34-4b66-b3f3-830a222e69db", "value": "49fc8b3ad8.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1afa13-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855926, "uuid": "bd9eb730-7dc8-4988-8339-fe711158a4aa", "comment": "Malware payload", "value": "5e25bfd51528db78c42de178769e9978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855926, "uuid": "f825ef31-48d2-45f9-96d8-e9275bfc7bb5", "comment": "Malware payload", "value": "767542a9cf1b3d7251806c1008470490628e4e7466fc29caf94dd5e8d54010cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855926, "uuid": "9f926066-07ee-49af-be68-446a60d30ead", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855926, "uuid": "af9d8716-38a8-46b6-b54d-daf356bb23ae", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855926, "uuid": "d125fa64-bbcf-4a67-8299-7e13dd486de5", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855926, "uuid": "6f67ffe0-d736-4f4d-bcc7-fe7e293291c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855926, "uuid": "5ea1e5f8-a020-4f11-955b-ed67c43d6240", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd86980-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855928, "uuid": "35f659d1-cec2-4ab5-8cc2-7df1876cf65b", "comment": "Malware payload", "value": "850b5bb3a16fa30c5723f15eb7ebeee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855928, "uuid": "d6427e6b-bc9f-4ec1-ad0f-3817cedb924d", "comment": "Malware payload", "value": "768cb6a3e98f0bffc211f981af358b554b6a3cdbc1fe94e6daf20b21a54f2a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855928, "uuid": "96ea4ad4-9a86-4d2d-9ce2-f9291422a2f9", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855928, "uuid": "d05e5884-be3d-40f2-b3f1-d76ea8730409", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855928, "uuid": "513a73dd-20db-4fc4-ae6f-ededf1321356", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855928, "uuid": "07230c5e-f252-47f7-9dd9-ebcd35af6c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855928, "uuid": "cebe07dc-13b1-4f24-905b-6ae19e9603eb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae995c0-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850765, "uuid": "a4b26657-a7b7-4560-a278-01572c088fb5", "comment": "Malware payload (Gafgyt)", "value": "403fae2977fbaa9fcbc26e35127e0054", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850765, "uuid": "7a09bd06-7ce3-4187-bbda-6139814a9fbd", "comment": "Malware payload (Gafgyt)", "value": "7696f46553683d394fd68f00f688dfd30008dd8845f29665a2788e2a7a325a29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850765, "uuid": "cb7cbb7d-9f62-4ad1-abb2-e8e435affef2", "comment": "Malware payload (Gafgyt)", "value": "26e9bcc558521d7dee9a7f828d79bcb6c82cb6d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850765, "uuid": "2a1482f9-bd59-4c0d-8789-d07d44f7e1bf", "comment": "Malware payload (Gafgyt)", "value": "2c486625ab37f1edbcfdf67ae06ccb4965d9498b1a735b16c35faf157cdae9d9f6621b46d885a556dd2bdbfc328b89aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850765, "uuid": "a598e4e9-2088-4be4-8b15-9c1f4efb9bb4", "value": "T10DA30A63F800DFB2F40AD67604D74B25B630FBE60E93256273577966AE362D52823F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850765, "uuid": "2e39d2df-7680-4fb8-873c-7d4167f9a6fb", "value": "3072:q1wDsx2JDfcrx/TFrD7dyJoDJ3ebomK10PZHbf3Fj:qN8JDfcrxDyJsJ3ebomK10PZHbf3Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850765, "uuid": "c762142c-7b64-4245-872d-d4f85e9d6571", "value": 101640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850765, "uuid": "21d8c3ac-e6da-4bc5-8089-fb4c29d29c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850765, "uuid": "878b1cbd-2ae6-4e65-913c-a13f344795af", "value": "Ayedz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c74204-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853624, "uuid": "4ffaa1c7-70da-4a45-84da-ca364c69164f", "comment": "Malware payload", "value": "31d2f0a7e90330fe9508decf4eff3795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853624, "uuid": "15e2ccce-094f-4445-8a92-2698d5e6444b", "comment": "Malware payload", "value": "770787fbce56ce7be35d47e63829cd2f0d952f266e6ffc4a820db1e7031b3a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853624, "uuid": "cafd7384-50c9-40e0-9377-6b4d264fc423", "comment": "Malware payload", "value": "a9fa03b4779b399f0f8edb89f1e2f3c7e206e27d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853624, "uuid": "5a3d8a03-8578-40df-bd3d-138bb481d418", "comment": "Malware payload", "value": "a6fa0a9e219897b2911cb44d03a69c28a793978cdf5382ade1811426afbd772193623b47f7af12fbcb3fbe491fb1c752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853624, "uuid": "70580796-ae18-4ac3-9bf3-7fe61c4df188", "value": "T19F14F6B3A014D591FDE89B3253369D3AE937FC375DE86E5C7048B022C4B3BA21D5192A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853624, "uuid": "530b32f5-8713-404e-af44-7f7b74eaf8ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853624, "uuid": "a67af529-3a74-4d4b-8ddb-355300a64c69", "value": "3072:QqGJNtrfbFXrOPkn/Knv2GgUTb4knLiEQ:QjzpDn6+GgUTb4kL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853624, "uuid": "f68b0425-1941-4eee-a08d-4724dcf79615", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853624, "uuid": "28cba34c-702a-4e57-89cc-565edbf4e4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853624, "uuid": "8f2fd7f1-e60a-4a1a-bb2a-eec9df9a7c63", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b4aa93-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855929, "uuid": "55f18d82-d56a-4faa-820a-4141e124ffdb", "comment": "Malware payload", "value": "bf85c0641115b43ba342111b317c5ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855929, "uuid": "74080be7-2d0c-4c7f-beb4-c06a1a2280bf", "comment": "Malware payload", "value": "7726e63afa035876ff21a7cd11bc910383e932f3ea8af8696bb8c715036a7f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855929, "uuid": "7271cf00-1ed5-4bb5-bad7-c3120b79c66e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855929, "uuid": "ada855d3-2623-45f9-8cc2-6dfd60f21524", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855929, "uuid": "5faf430a-2988-42ec-9593-f1ae471cc42a", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855929, "uuid": "cfd67330-ab52-4477-804b-7d02c8e9ff76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855929, "uuid": "463468e3-8e76-4623-9242-48d6d01b8063", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f31b008-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852947, "uuid": "56240a65-c912-41ff-b013-c6c491aa2573", "comment": "Malware payload", "value": "fcee986bde6fbdac75ca8dcc7e07b7da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852947, "uuid": "73951d37-2e9d-47e8-8f1f-82c96b394cf0", "comment": "Malware payload", "value": "7744b67501a840ba687c641b01e9924d40a034b02582e0f233174e11a85480d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852947, "uuid": "e9ee7c17-0cc8-41c5-9c1d-b68a7bd7cc9e", "comment": "Malware payload", "value": "1b8668ed667ac01cc11a61210a991fa974d2b0a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852947, "uuid": "bd80ade7-b82e-400e-ab35-b9533b53e4ed", "comment": "Malware payload", "value": "8786ab7631d8811e9d756562cc6f9f27192a7a1598c2fae7e7e3fae78534a4472a29c6bf2e40892bdf74fb57f20423aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852947, "uuid": "08e860b4-09c1-44ec-95dc-ef6233798cf8", "value": "T1A076BF02FBD48F83C4DF6FB610751385E770E546D356A7CB6600A2F86CB23C44D6AA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852947, "uuid": "7c4de871-e359-45e0-a1c6-892d4723b80f", "value": "98304:eNMrcIe8oyq6XDe8iHdu14rMTQektKgUOX32yn1lr1xq1iV:eNMrcIFSHdfeOUg35r1xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852947, "uuid": "ac1feac7-d10d-4fd8-8d88-40a303771365", "value": 7787304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852947, "uuid": "870cc22e-8153-4db3-9c67-c683685cd5ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852947, "uuid": "5f0d858a-5bb9-4b87-8b07-a8a0bbec2e12", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31841de0-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855930, "uuid": "b5811335-910c-44b4-93db-ee620b9e3967", "comment": "Malware payload", "value": "c7704f3cc5abb97bc23d704637e1070b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855930, "uuid": "105e6c4d-bc79-4c16-9745-26dc630c7d2d", "comment": "Malware payload", "value": "77a80dda2664890cdc32e2e4dea682a65715bf4ed4adab1dbea72b3938f32caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855930, "uuid": "5ca7c339-f884-40f9-b943-71e76f2565bb", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855930, "uuid": "b5314e2e-7197-49c2-b6a4-6f8c692c14d3", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855930, "uuid": "451dc2a9-da48-4036-a9a4-9aa1044a311e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855930, "uuid": "ad1a9bf1-a3a7-4a01-a5ff-ac6eca016cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855930, "uuid": "3769b5b2-e6cf-471c-bc10-083e1686460b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f893bf4a-c779-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763798712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763798712, "uuid": "876c4693-4754-4514-9efe-0cf7838503b8", "comment": "Malware payload (ValleyRAT)", "value": "c6efa2a6d986808ff85c22cbed8f86bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763798712, "uuid": "f024d9fd-c133-4790-b327-313c999c0753", "comment": "Malware payload (ValleyRAT)", "value": "77f72f83e3670bf5a308999d87156a8156e192b5ee7b085dc8107313992cd845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763798712, "uuid": "13b8cb9d-de61-45d0-a1d6-57cfb5d30871", "comment": "Malware payload (ValleyRAT)", "value": "72b7541b9706798b75b1213eb72451aaf3cb02fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763798712, "uuid": "8815797a-9d77-46c2-857a-3a1d4733fa0e", "comment": "Malware payload (ValleyRAT)", "value": "b8debf99ca5061936ecb8d14d6e906c0bd54133ab677a0f6fd191a287648bdcd0234b54f8c8cfbd255bf9b4cf4889ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763798712, "uuid": "f99ce082-85e1-4cb7-9ac0-c96ab23d3d22", "value": "T1CD644B0AF6A520F5D5BBC13CC942551AFE717C564360A7CB27A14A972F237E0AE3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763798712, "uuid": "acc2d73c-bb40-4662-b1ac-f4807b9c2aa5", "value": "9ebbc3bf4a855b7385ad36700ee09cc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763798712, "uuid": "24fdc370-6299-473a-8328-980f2206ecab", "value": "3072:vfx2kRJVUdjtA5JAM4BaNsuf9zb/nf2M/fSCdJ/Ja6CJ0hBX8+jtPhPrBGwVgBqF:3x1VUdzmnU6CJ0FptrBGaJyLHTwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763798712, "uuid": "779a0425-2021-476a-ad61-3f9a4ef5414a", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763798712, "uuid": "3b40bf94-eb2e-447f-8b15-7893e771304e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763798712, "uuid": "9739f89d-ac43-479c-af9a-b80837120f42", "value": "video2025-11-2121-23-41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3251d020-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855932, "uuid": "7fb82b7c-1fce-467b-9104-aca49100cc1a", "comment": "Malware payload", "value": "611c1ea1d7bc1859be7eb48e1d441425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855932, "uuid": "9b782b15-cf47-44c3-90c5-38a3a15cb4dc", "comment": "Malware payload", "value": "7836c9ca0117aac4492cac163331855195ee1110758e0433f109db4d45d35b51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855932, "uuid": "9f9f104f-a956-494e-8233-0d1df93bc845", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855932, "uuid": "759ca5dc-b183-4ba2-8542-55a2e1102f7c", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855932, "uuid": "65f680e2-4981-4ef9-9b2c-e6c0d33c9f27", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855932, "uuid": "9b8ac35d-f09c-4bc4-9f96-986ef128e799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855932, "uuid": "f582a9f2-1302-49c6-8b78-02d2cad9ffa7", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3322c0eb-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855933, "uuid": "985cc77b-debb-4022-9ff0-1fe0abf4772b", "comment": "Malware payload", "value": "98c0bcc72112a67c6fb4e0796c387bc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855933, "uuid": "687975ae-a1c1-497c-950f-7de3da212936", "comment": "Malware payload", "value": "78662c45e13c5c393bf5cb906da6250a5eb116aaf0c1d9c437cf2bc8aefafb31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855933, "uuid": "7df13d32-40b1-428f-b7b7-5014c667e562", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855933, "uuid": "34160611-7a2f-4710-bde9-40edcf74f55f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855933, "uuid": "2f48c826-03c5-497e-adba-cb6864c74f89", "value": 3271168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855933, "uuid": "c5d40bee-cc64-4b74-8309-56e8784c099f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855933, "uuid": "6d610f91-f7da-4320-9f48-f4e8d534ad98", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f0fe27-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855935, "uuid": "bad97eb6-02ba-4e66-86fc-c3dd86d7efaa", "comment": "Malware payload", "value": "33a67e8d676e5931d8bd4ff52cb49fc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855935, "uuid": "090a0dc2-8394-4c48-9a84-3b05858fc363", "comment": "Malware payload", "value": "7888a71ddd29bdb203552870ec6d0dc8f101ab4074992de1d845b6002f6c5a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855935, "uuid": "d246e815-b190-446a-9f1e-f89726a6759d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855935, "uuid": "7cebac96-79c0-4821-9d10-fc5418902730", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855935, "uuid": "8aee9fb4-e43e-46a1-ae9b-46e15fa5996c", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855935, "uuid": "e52875dd-33fa-4228-a5f6-74e4d885d735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855935, "uuid": "591860b9-8fd7-4d13-9af4-01826cabc789", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ac5c99-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855936, "uuid": "98f3b6ad-9d01-4ba7-b776-1a7983c28ac3", "comment": "Malware payload", "value": "2727d658b37ad7696105970198e660c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855936, "uuid": "1af7b754-54af-4f7c-bd6c-0a9f00638d31", "comment": "Malware payload", "value": "78efbf9065ddfde49fd10b395248925f4df6d660b530ea473dd9b6ceaa3881aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855936, "uuid": "b89f179a-587a-4d0b-88ed-3d7f4b8d81d6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855936, "uuid": "001912eb-6209-4f16-8040-27384481c3eb", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855936, "uuid": "8c01ab8e-46e2-4d05-b367-211de9b6f8c5", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855936, "uuid": "42bf84b0-400a-4124-8c5a-77b519198c0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855936, "uuid": "d4c5705b-eacc-440b-b3de-777f30bc826a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35810e72-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855937, "uuid": "9a0c29eb-49af-41b6-a4be-ce472823410d", "comment": "Malware payload", "value": "278f31c374f2cc61114a7784200e26c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855937, "uuid": "e8028795-0674-430c-a5aa-3eb3e9a548d9", "comment": "Malware payload", "value": "790b77d2caaa24819ccf641b87efd231eb7d4bacad01d65f3acd098a5c725e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855937, "uuid": "056e8fe6-e052-48bc-a049-9500413cd411", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855937, "uuid": "1f806589-9f0f-49ec-a5df-a0e2e68d1e65", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855937, "uuid": "bb333f59-2202-4dd1-a3e1-45d7038d9c0f", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855937, "uuid": "6b62d7bb-7928-421a-bd78-b802f6d2affc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855937, "uuid": "d06b3ec5-71a7-4a7a-8220-30703e70a6c9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f0dbd8-c756-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1763783405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783405, "uuid": "fc8968ab-3a54-4db1-83d6-91be3f01b229", "comment": "Malware payload (NanoCore)", "value": "9031203d209103caa412decc7abb6265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783405, "uuid": "4da13973-6bf8-4d57-b32c-e0839dad5238", "comment": "Malware payload (NanoCore)", "value": "796f9ee88b9456ca2908fc99fffac955cd0695cda65749c95c8020f59b135c4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783405, "uuid": "02969c3f-949d-4409-91ce-83414954d28a", "comment": "Malware payload (NanoCore)", "value": "b1a4d4ee2e68a448f28018e3c817cdfbff3ce585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783405, "uuid": "87d03afd-9255-4fb2-986a-6e953eabbb79", "comment": "Malware payload (NanoCore)", "value": "39a89d644fe004df830906e9be7cbcdb239f1b361e74e5c79d80e003ec36c35189a62714beae4893949391c66a1c06be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783405, "uuid": "c895f0dd-a29d-48f8-a4ad-acfed9e8bc55", "value": "T10D14BF567BB98A2FE2DE897971121247873CC2E3A9C3F3DE18D454B68B623E406471D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783405, "uuid": "0def1145-ed78-4f16-84cf-932c9720b534", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783405, "uuid": "fae25f0e-b740-4628-a39e-f59de6fc522a", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI8e0EhIW0DJsuNRBIEEgmzK:wLV6Bta6dtJmakIM5lEIGuNR5RR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763783405, "uuid": "3e108d90-932f-456e-80ea-104be08831fb", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763783405, "uuid": "4ac72eaa-c800-447f-b1e8-5a7e0567f08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783405, "uuid": "506e98f2-3778-42c0-9cc4-14ab363a5334", "value": "ThisIsTheBest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3631a5d8-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855938, "uuid": "896f74c6-31ee-4e8f-a859-ffbd7f59ccea", "comment": "Malware payload", "value": "6abe6edf1130402282434704640edf98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855938, "uuid": "b4edb894-9f3d-430d-a360-85e019c1e798", "comment": "Malware payload", "value": "79a155fa66cc9abadeef1470f5b8c07383949915cc64948dec43b40f2c18be19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855938, "uuid": "35bed02c-87e7-40a2-a763-d786896d6eb1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855938, "uuid": "f8d77203-f46b-4a11-a7d5-b8c89117a95f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855938, "uuid": "ee600c65-5e7f-4426-9351-f087ab370573", "value": 355767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855938, "uuid": "d6e6430a-d91d-4c2c-9c20-cd6c4a9aaf8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855938, "uuid": "f90d6d56-f4be-437a-942c-81229d843fd1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3750ab29-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855940, "uuid": "67316b32-c0b9-4d86-bcce-0d39daf1bf4d", "comment": "Malware payload", "value": "ae7c8ad0bc7327c882306a5634177721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855940, "uuid": "a0708bb7-a1d7-44e0-a4a2-2ec799bcb000", "comment": "Malware payload", "value": "79dc672738482c46efd93425dbb86577044bcb099dec16a25dbe574c749bdd1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855940, "uuid": "91fc16c4-8e3b-488d-ade0-ee396b1ad317", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855940, "uuid": "5199e55a-ab7a-43e3-a6f0-54f890a88904", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855940, "uuid": "028d9967-61fe-40ca-8f35-b3824ee1dcbb", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855940, "uuid": "3aa7f769-520c-4618-ba66-12ff63de8103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855940, "uuid": "86e9eff3-db61-4cab-92a1-022af38c81e2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381f33de-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855942, "uuid": "3b4f93f2-db03-4356-ac72-d7a9f9ff964a", "comment": "Malware payload", "value": "4749ef8aa5d2ac1437b168d103afa057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855942, "uuid": "b887f36a-35d6-4608-bf5c-7ccf3e1f9111", "comment": "Malware payload", "value": "79e59385a5b86d1cb0b0fd299e3ffe8d398b4e9e07b4d185016afb215f3f7bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855942, "uuid": "369e2b65-1ae6-4b01-89f4-859d3527844c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855942, "uuid": "83201199-9bfc-4845-8a92-5742b8999c58", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855942, "uuid": "b43eb08a-e302-4d5c-ae7e-93f9362b4d74", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855942, "uuid": "131ca077-68bc-4b7d-96c3-cc4a834dbb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855942, "uuid": "3b32ad01-c4f1-4301-94e1-de81ceb51c83", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f721aa-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855943, "uuid": "dbf161fe-e14c-414f-8afe-2c383a12fb16", "comment": "Malware payload", "value": "22e0c001011dda261aeca12e80b931e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855943, "uuid": "1cfd9c2b-9a4c-4818-b3f8-f7e5ee88be97", "comment": "Malware payload", "value": "79eedc54b2ca64c4e39e1a3919514b756848853a942b04f028f52c298cc1307e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855943, "uuid": "78e138d7-fb52-4c4c-8167-2b279815591b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855943, "uuid": "fd974313-fbac-42e3-bfd5-8a2f7c373418", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855943, "uuid": "7fb7d5df-1408-45d8-a0ce-7180225a34fc", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855943, "uuid": "bf0d6dad-e843-4abd-96c9-24c0de4328ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855943, "uuid": "c51ebdb6-99c8-47a1-a147-bfbdb297fb59", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bf17a9-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855944, "uuid": "476816d7-e353-457e-b855-87f26f11bca5", "comment": "Malware payload", "value": "e37ebf5f8d9d1b99ecbf2d668a0a45ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855944, "uuid": "6322abbd-f7fb-4fc9-bda5-f17578f8838f", "comment": "Malware payload", "value": "7a13c17fde495025504e34a8d8bc755fd939007e296dc717d24a58e4f937ed0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855944, "uuid": "d00c1b23-780a-4381-912e-81bd90359b75", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855944, "uuid": "84852aba-00d9-4ef0-9ebd-6c2f9713ea4a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855944, "uuid": "7439b8c0-c24d-4271-b28d-6b64246d56d7", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855944, "uuid": "b1be6787-a622-4dd5-b275-3032befb8cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855944, "uuid": "5b5c53b3-42ae-4ad5-80e4-12b97ddcb678", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c5dea8-c794-11f0-a129-42010a9c0007", "comment": "Malware payload (SpyLoan)", "timestamp": 1763810161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810161, "uuid": "06b59e2d-475a-48a4-926a-eb6ba560dfa6", "comment": "Malware payload (SpyLoan)", "value": "c8a51b8a7083850cee63e28add7688be", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810161, "uuid": "99f19f97-df51-49e7-882d-0468042ee628", "comment": "Malware payload (SpyLoan)", "value": "7a5d31d44f876553e8b79c1727e810396e56b93888326667d07c0f590b6a1a19", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810161, "uuid": "99462e9b-b137-4a80-baec-2fe559c154b8", "comment": "Malware payload (SpyLoan)", "value": "49542884183512681bef079d5c14f5a330600e17", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810161, "uuid": "a2479aad-ffb7-424a-b5ab-c90bf3bb2ffc", "comment": "Malware payload (SpyLoan)", "value": "5ae42b946f3b6494eb4d83bf7c2746cc24df1ecd5304b3612fd9393755864566ae3b4499f9fe2fef535a5a0ff361bbf1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810161, "uuid": "dceef89a-9c80-4322-8f26-b25be6b5c725", "value": "T162573397F729883FD5B616B38D6A013237729E0186826B173A48772C2D7365E4F89FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810161, "uuid": "e434cd9d-e16b-4333-a22d-c16dc2efa62f", "value": "786432:5EPyyxy3WUzRKfhyvY9TxnHjz7vAMBOIZBlvxgb:mNY2yA9TxnDwMB5ZPv2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810161, "uuid": "16b28499-a057-40d4-bdc7-12c8111e6842", "value": 27436503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810161, "uuid": "ca31619f-c979-4ca0-a2fe-3f8cd57cd22c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810161, "uuid": "03ea9ab7-6eec-4de7-9354-b5d95556e46a", "value": "np001_1.2.4_17706218.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae83ce6-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855946, "uuid": "654192e1-3dde-4554-8a69-ab430c497aeb", "comment": "Malware payload", "value": "4311d6c31bd8cd078c2ee123d1598141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855946, "uuid": "9987ab38-f171-4118-9a86-138458e1c885", "comment": "Malware payload", "value": "7a9498b790f69297322e5fb5026c05150426624485cf585e286e0094968b854b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855946, "uuid": "de416026-1cab-412a-b93a-6ca4835aa9b0", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855946, "uuid": "d61531cf-41a3-4ace-a851-6f5dafd8d9c5", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855946, "uuid": "1da318ba-726e-4051-8793-3f24f9a33c0c", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855946, "uuid": "9e553d69-b70a-40d6-9981-34cee15753f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855946, "uuid": "25cf68f5-0e50-4255-aebe-faae56aa2018", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc181f9-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855948, "uuid": "ab4cefef-d78e-4dd7-8567-2044b7ff7e1e", "comment": "Malware payload", "value": "66b58c889342d0f1207094d3acf1464f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855948, "uuid": "1c333cf3-e7f3-4c29-b41d-e76f1a4145fd", "comment": "Malware payload", "value": "7ad21a47a9885acc64290915d0e4a068002952d53aaa46bed5f9ad48df5aed75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855948, "uuid": "c9d79840-d9e8-4b03-9fb1-9757d4cc0701", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855948, "uuid": "6d07a05b-631d-49ae-987d-ecb40783d1ce", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855948, "uuid": "e419cf68-5694-4490-a967-f4022689a5a9", "value": 3266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855948, "uuid": "bfcb2664-de17-4046-a17d-3959bb6a38a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855948, "uuid": "60996d95-81f9-4442-95ed-dc8eb73270c6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c90974a-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855949, "uuid": "8e70bc06-455f-4139-9230-008b748582cf", "comment": "Malware payload", "value": "a1bafc1577a38156c3320b8353e610fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855949, "uuid": "5820638f-0d49-4132-a595-6813f3c54a33", "comment": "Malware payload", "value": "7b47b5f09015302822d0b8ea4635b6b57d8cf2f053f1142896335563b01c6858", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855949, "uuid": "dec446de-859e-4924-b4c8-8ed2e1e59501", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855949, "uuid": "39bc461b-7907-4eff-9f0d-81bf2d87d685", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855949, "uuid": "6e0b94df-7320-40cd-90eb-f475ed91dcc9", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855949, "uuid": "1b2de74f-c899-4635-88ab-a2b2379a123e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855949, "uuid": "763f481d-0ef8-4217-984d-b3cb1242e99a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5d4c64-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855950, "uuid": "54fe2d79-63e4-43ae-8541-e4bacfcf6204", "comment": "Malware payload", "value": "c2231ee1e8b07639eacdd8bf4f764551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855950, "uuid": "8a3b186d-62f2-41da-a67d-f7fba99f891c", "comment": "Malware payload", "value": "7b94b3ed9445e824b3d61617b2d36cd79ffcaa30f5ce08db48d1298fd43ef68a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855950, "uuid": "af529a93-54b1-4030-a3ae-881ac09f8fce", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855950, "uuid": "cc4906d3-5ac5-426c-82ca-e986fa465602", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855950, "uuid": "39ec2d7c-0189-4128-9c29-5203cbdc48f5", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855950, "uuid": "0b395eed-0e8d-4033-99cc-f1e52a4beaaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855950, "uuid": "b323a548-5f36-4ac2-b889-f874bdd59df0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1917fe-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855952, "uuid": "03c24c7b-0ea6-428d-94d1-66109d7cb29f", "comment": "Malware payload", "value": "58753fab62e7b487762254ad02431d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855952, "uuid": "ab3d8ea3-c620-425d-9c9a-db58245a845f", "comment": "Malware payload", "value": "7bb6d8e86fa0fda40bbc4585c7fc228eb35a9056cb5d4af56e3a0805ad27bf1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855952, "uuid": "e555a035-8178-4253-a488-8992ead10ed0", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855952, "uuid": "bcce4964-6117-4bdb-9d3a-279efad008c2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855952, "uuid": "131f0240-a093-47d3-8646-d83350e39d78", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855952, "uuid": "1b6e1c05-ccc9-4cd8-bce8-c3e6e6486aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855952, "uuid": "78dfcf34-9250-4ff4-8ec9-1ccb6f55d71b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907a23b0-c7bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763826884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826884, "uuid": "dd2ec522-a17a-4cd6-980f-582847b2fe18", "comment": "Malware payload (Mirai)", "value": "12e0b9edacf8a370bf5986798b8dd8a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826884, "uuid": "1dc20c9c-8cf7-4dfc-a926-7600a0acf494", "comment": "Malware payload (Mirai)", "value": "7c1699eaa1e1c9e930269a1c132e6709fbc060f0568d289709674c0cc93e79a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826884, "uuid": "a02b9518-ce86-46ba-af07-a0144969cafb", "comment": "Malware payload (Mirai)", "value": "495ed413d5bbaebbc33cc182b2d72a18fd9695bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826884, "uuid": "73f725f0-3acd-48d3-8f1c-659b4e137d0d", "comment": "Malware payload (Mirai)", "value": "6b986e9dfd07e4d9d91c021c9fff79fa84618fcd40f7548bfe9bf1a82a66c43a59a952947aad882c316a55836b43a637", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826884, "uuid": "f2b0ca13-e93c-40e7-9078-bc83a70e345d", "value": "T141D3DF32E4006C95EC111AB83CB992BC07109E7427DA91D6FEFEF95E6437D8439AE221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826884, "uuid": "c92eabc7-db7c-4143-8f32-92a964e24f8f", "value": "3072:MfSccVY2gl57wBbFp9R/ulf+/V4wXl5c3u:MfkklxwBbT6sV4wXYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763826884, "uuid": "bac5351a-9be8-4e57-9726-6cb5beff4afc", "value": 131708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763826884, "uuid": "b41fa977-8166-47a6-85b0-d5242507d0ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826884, "uuid": "ec6f7412-c2ca-4438-8735-57af33fefb13", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eed6281-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763855953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855953, "uuid": "93feb9c9-2ca9-49ee-aabe-0e806d784646", "comment": "Malware payload (QuasarRAT)", "value": "f56a5dcd825fa4cdc152e98d64d6459f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855953, "uuid": "7f7fe137-b277-412b-bdbf-9844e552c6ac", "comment": "Malware payload (QuasarRAT)", "value": "7c43ae2ca51ae94f803ea9a406ecb53cbdcef5237f643e500e7f7802d306f297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855953, "uuid": "fa4ca9d6-6d96-43cd-a338-85c4771901fc", "comment": "Malware payload (QuasarRAT)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855953, "uuid": "55acfe9e-15b7-434b-b0c3-2598917ba05d", "comment": "Malware payload (QuasarRAT)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855953, "uuid": "2479cea0-ca75-4964-ac9d-f9c426a74333", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855953, "uuid": "a3f8fe38-494c-4c98-966b-a43644f05fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855953, "uuid": "3091c8cf-e00d-4b6e-804a-1d4a49d0b4e2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fde6315-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855955, "uuid": "ee6a3f2c-1bce-4107-ac12-4ebdd2b68f28", "comment": "Malware payload", "value": "2488f9b6e1c923fa76c51d0d8acb60ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855955, "uuid": "0611c68f-59fd-44ee-965a-d1d988f19abd", "comment": "Malware payload", "value": "7c6142933456b8841f3ab6a7cd3319c27cde4489214d437f61cd273707a94cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855955, "uuid": "8354d982-9bb7-4571-8fcc-ea52dab148a3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855955, "uuid": "bde4904b-ddd1-47b6-8f71-7583eed56ddd", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855955, "uuid": "871ef9e4-c9c4-4b46-9f5f-e5f69b914f80", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855955, "uuid": "d098db72-2910-49d5-a5ef-c7b96d0f91b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855955, "uuid": "d7ce8402-f6ef-46b7-9ac8-7dc407f1463e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91280ee9-c7bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763826885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826885, "uuid": "a92cf9a3-4f06-4fe5-8f34-258f6cb92955", "comment": "Malware payload (Mirai)", "value": "cf37edf0f92df07962a15e71148b6cd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826885, "uuid": "ddeaa3e4-1214-4895-90c0-1f37a6ba9e29", "comment": "Malware payload (Mirai)", "value": "7c67e18cee43a178fd36afc03bf4b52e34b71efa18459c2870135ac275a1d261", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826885, "uuid": "47bc9855-1874-468b-804d-d09005c05378", "comment": "Malware payload (Mirai)", "value": "d3e9cb02bdbbcf142bf3f17c5642471e1b632688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826885, "uuid": "7c334218-d204-4c3f-a01e-27ec601b811e", "comment": "Malware payload (Mirai)", "value": "d6eba328d9f57e808e1c62ed1212226c3ea84dcad236ff06732ff2c91b876f94a3940e5aae03aa6775402df903f4d452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826885, "uuid": "0afc7ea2-466b-47b0-9893-e3fde509c330", "value": "T1F4D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826885, "uuid": "5f2dc45f-6d35-4252-959a-eeec01709e50", "value": "3072:79eSuygEPjt6qkWqMdKmDnYMb0gBd/gQyVGsdqml65aj:79eSuygEPjt6qkWqreH2la5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763826885, "uuid": "0abd2fff-1a8f-4943-9333-7dcef193decd", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763826885, "uuid": "eb5c0c0a-886d-4fc4-97a3-2d6839144198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826885, "uuid": "845c42fd-8365-4964-bd31-c0541ecc47c2", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40af5ef7-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855956, "uuid": "65c05c28-6173-47ab-9cd3-ae59a5c2fe89", "comment": "Malware payload", "value": "545030d963bec16806d61d8afc1800a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855956, "uuid": "e46567f6-03d3-4082-879d-cc94b2b2b51e", "comment": "Malware payload", "value": "7ca4c67fcec9fd7026f570c3f1f2e5185bc967b35904b316df78e9ef6cf52faf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855956, "uuid": "065cdccc-5913-48c9-aa91-273ccba06f9d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855956, "uuid": "d6458252-5510-4dca-86f2-0e12472d066f", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855956, "uuid": "51b3251c-e09f-4d90-821d-44b3b9a6aec3", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855956, "uuid": "4092ca59-c742-4ef2-84a8-4ef37e405bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855956, "uuid": "56ee5b61-3dfb-403a-b461-cdae80d272ab", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a49f8b9-c77f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763801023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763801023, "uuid": "4b9b7c5b-5001-4dba-8e31-fb835046dc6b", "comment": "Malware payload (Mirai)", "value": "e339b321a239f80a0a138cf232a80a65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763801023, "uuid": "6b0c7db4-16e0-4a73-9e92-6fe1ce0c9f76", "comment": "Malware payload (Mirai)", "value": "7cdf54031e1486466482989145c606397dd968669ca32a49c9c301a75b831b63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763801023, "uuid": "37f8677e-0c3b-4b61-b827-5180caa55b6e", "comment": "Malware payload (Mirai)", "value": "c5eeb6dc589ed1b42b722fbf6d9d0ea13194e741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763801023, "uuid": "8494a93a-dfc4-4503-b136-21cd1f7a76ca", "comment": "Malware payload (Mirai)", "value": "04b639ad10dd19ba52e8e52a9451e1947a3316a16a07fc2e2f55572bbc8ac1d894789d9b60dbab17f721081e334199b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763801023, "uuid": "6ff1027b-de8b-4d52-b4ee-8afc3149035f", "value": "T1AC934B51BD92D613C6C16677FB1E428C3B2753F8D2EA32038E216F61238B56B0E7B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763801023, "uuid": "f2692c5e-cda6-4dd9-ab97-28dafefc3377", "value": "1536:GloLfxQeb0m/iaiNocuA+dw/130cwUOg9aIZv/6emPg:GloFQpa8+y930ax0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763801023, "uuid": "cbdf11cb-53d9-49f8-a70b-437d442a3b61", "value": 96016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763801023, "uuid": "6a46126d-f9f2-4fe3-b7ee-19453df9bb3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763801023, "uuid": "0fcbc798-2d96-47f4-beb4-109d878e1108", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c3fd53-c75b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763785519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785519, "uuid": "c8b7393d-d910-4b87-8877-957aa388dc37", "comment": "Malware payload (Mirai)", "value": "4e824474e210dcf8818fd712e6da6a95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785519, "uuid": "bb798406-61e1-45b5-b1b6-d8f64d2cce52", "comment": "Malware payload (Mirai)", "value": "7d1a64fce814f579fdeafa68a1f7b89412ee705456e2d2ed543e2ea2a51c49ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785519, "uuid": "7720446c-e6cd-47da-a89b-21f9460cf0af", "comment": "Malware payload (Mirai)", "value": "5f119727dc691c052b034acc4b93b29d54daa01b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763785519, "uuid": "71aa9cb9-dbe8-4d08-a01b-ecc076b637cb", "comment": "Malware payload (Mirai)", "value": "0935de9aba93dc7e4a227cfbdc9a1956200cf92693592b5ff621aedf0f7edd028449221f5c43f1db83ca8bb6c1cbc908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785519, "uuid": "5f1b0476-7d5c-40ed-8652-861c1ab1d837", "value": "T1886301069B4A1B49CC1A78B98F79CD99A48B709D008FF8C3F4671E2534BE55BC864C3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785519, "uuid": "f1cbae81-b811-4a38-99cd-2be6d9247989", "value": "1536:u6osztFzP2/3R31v/aZ7k2S9sk4YMFbu3C6ot3jS/A7ubgSCkoUtorYG:u6zzTzO8U95ibuy7zS/GucSTSYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763785519, "uuid": "f0283eaf-78e3-4959-9500-5f419fdf57de", "value": 73244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763785519, "uuid": "b3f68c03-61b0-4c7c-baf1-be2ae2107834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763785519, "uuid": "62bccffd-a3a3-445b-b6ad-3d5f617acc55", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4171f83c-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855957, "uuid": "dfa56419-2053-40f5-9013-cb4d0b8776d3", "comment": "Malware payload", "value": "16b468133379830504f1f0796a02000a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855957, "uuid": "1cdb7a48-b12f-42a3-9193-09287ec2d7cd", "comment": "Malware payload", "value": "7d2f2b6ca631ed873d69839d81742302f35de670847eb7de4622562e538fdd20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855957, "uuid": "f70c753d-b1eb-42d7-b6d0-f88b3d971ca6", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855957, "uuid": "2b62facd-a459-47df-a2cb-df34bb1d93ab", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855957, "uuid": "0742c217-6883-4077-9630-9b018c6da706", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855957, "uuid": "0e324693-1969-4526-9d29-609529d5d41c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855957, "uuid": "16e136f7-6b67-48e2-9396-ace776cd482f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b45647-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855959, "uuid": "e1664dd4-9f08-4d2b-8838-91c29f1b935f", "comment": "Malware payload", "value": "41d76ea4273705c192cb5fede209d74f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855959, "uuid": "591b385b-f594-41bd-a3be-1772dfa4c142", "comment": "Malware payload", "value": "7d76a251e8f7f9ac23afe4f68fe1ad84b940c1ac72dbd20bc2055997fee7a779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855959, "uuid": "00e01fff-13e2-4877-ae3d-8f5ee85249d3", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855959, "uuid": "26517b16-2563-464d-bdf5-0bf842c101da", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855959, "uuid": "6cd0ecd9-c6a5-4d43-83bf-d292ba3578b0", "value": 6496256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855959, "uuid": "dfdb9dff-89bd-47af-ae1a-699fe8503360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855959, "uuid": "971d7c78-fedc-4dc0-8f7b-74167b982e30", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43799c9e-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855961, "uuid": "16dee19d-0cd8-4299-a210-c812afae7326", "comment": "Malware payload", "value": "59331c00a834f7cdac797459a0847fc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855961, "uuid": "3151616a-99a0-4382-b158-acdd444225f0", "comment": "Malware payload", "value": "7d9c5d56abb3ff8aa1c0ce83df4292cbf8744097c079ab2310ae25ba6cc489ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855961, "uuid": "6d1217b2-197d-4176-ae23-fd9e5b4dba6f", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855961, "uuid": "24214c7e-2aec-431d-a20b-eb348cdbbdcb", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855961, "uuid": "d8085706-08cd-439b-af69-dd3b5a781627", "value": 1867776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855961, "uuid": "e53e4b51-cd51-46c7-8088-b4d4ed4f0f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855961, "uuid": "e1729996-67b0-42f2-af4a-e044d3c8f7e6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4449756d-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855962, "uuid": "cafef940-e33c-415d-8131-399622a7f371", "comment": "Malware payload", "value": "39b24b31e285b544521a250cc7c7e67b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855962, "uuid": "5fd966a2-faa5-415a-a29e-c99820fad9d3", "comment": "Malware payload", "value": "7e939ad9ea88f7d6a752d6ed512c6243cce8be49e1c1b187287b32b58f9de4fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855962, "uuid": "296bd1a2-aa06-4cf1-908c-d57885adb202", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855962, "uuid": "83493ca2-c93c-47f8-abe6-91460747c9fd", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855962, "uuid": "a57cbdd2-66a1-4509-bb78-787abf048755", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855962, "uuid": "ff1e78a9-cb77-45ed-b5fd-8d0f59c64e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855962, "uuid": "5556e239-5450-487e-bc4c-576d1911313b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451827f1-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855963, "uuid": "38e7fe3d-3678-4e17-b41c-5d66ef8276d2", "comment": "Malware payload", "value": "11624a9f8d21fac3b39c2dd056c1fdd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855963, "uuid": "1f4cc52f-2e7a-4857-a036-fca07695d7e5", "comment": "Malware payload", "value": "7e9cc85fa40579b1be47941326787c65e08e9ca0526149c234b311acd0c1a914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855963, "uuid": "f4af3da4-079f-4bcf-b4c9-4730a6759a79", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855963, "uuid": "07c967df-7883-4565-9608-df60b84574a7", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855963, "uuid": "fb4a7646-4966-4870-a367-559d5d467729", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855963, "uuid": "356d78ba-9745-4363-badb-3364cb803c82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855963, "uuid": "bc75e866-73b0-46b2-b02a-bf950f03b6e5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e6161c-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855965, "uuid": "a1611eba-faad-4ef0-8233-5befdff1f66d", "comment": "Malware payload", "value": "c6ab9f46783de1c7069c23d0e4c029a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855965, "uuid": "00cdcdad-1db2-413c-898d-27eb1ac7c585", "comment": "Malware payload", "value": "7eacb8f767c39fcdb30818d01a825e13f3908fa5d782e5d45a4b26d903dd0891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855965, "uuid": "d8bbad03-ae41-4ef5-8497-d35d96bade6e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855965, "uuid": "3f7614f0-3855-4bb6-bd2c-b18f5d8f5ce6", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855965, "uuid": "9704ba0f-16cd-40c3-97f6-60d35ec46292", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855965, "uuid": "af333995-b4d7-4ccf-b81b-bd780ccf2c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855965, "uuid": "3589e96b-09b4-4225-ae21-721bfff328cb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cd7624-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855966, "uuid": "86667f02-d5db-4d8b-9ca6-4c7b24144980", "comment": "Malware payload", "value": "01c4ba703f6ce7c9a5ac0dbb712c0d16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855966, "uuid": "19765a60-14b5-45a6-a62e-3b8a06a5b85e", "comment": "Malware payload", "value": "7eb7bbb2dd5c51bc26f46b5d2e1040513e30ffad799f6009776c5e63b69f5ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855966, "uuid": "faa20ad3-a6b4-43e3-bb62-7a45c18b5d30", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855966, "uuid": "ee41c8d9-08e0-4406-84f0-0cf3695c2fae", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855966, "uuid": "bc2ac338-1ae0-4e34-bf80-68a700fe9c2c", "value": 8714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855966, "uuid": "885b66e4-85bf-498c-814c-7fc604b0555a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855966, "uuid": "d8483809-d9ef-4f36-91bf-f57b84afbb74", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a73c4d-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855968, "uuid": "6561fe07-c499-4025-8599-70f573204137", "comment": "Malware payload", "value": "5e1583b953fbce83f90324558603902b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855968, "uuid": "9c052fa7-90b8-41bb-947b-a3491e6dd940", "comment": "Malware payload", "value": "7ed207c4ee2943946feaf7aa6d7a587d9fc156e1c5a7d8f5a2b8248bec6c671e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855968, "uuid": "9c658ddf-f56a-4164-8e4e-9325bfe2b9b2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855968, "uuid": "8cc06a0d-2a7c-4536-b838-624348bedacd", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855968, "uuid": "72f2b513-3788-4a6c-b1fd-8f7c18d8082f", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855968, "uuid": "1be89ea0-153b-4a63-91ad-1fd30c38e34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855968, "uuid": "3663bcca-afb8-43d6-8072-ffa58943bed3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b369bee-c7de-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763841773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841773, "uuid": "b20a5236-a190-4030-98bd-4abc65ef8a28", "comment": "Malware payload", "value": "8ceed92f26a88d4a879432dd7099011d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841773, "uuid": "0dca2604-873c-4aeb-9450-edb5541c6cb3", "comment": "Malware payload", "value": "7f424b4c5bd2c14bc90380f25f64092c2ceff53b78a3194adb6f0fafa71bb4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841773, "uuid": "a577066d-6d53-4105-a6bc-ca4778ddaeea", "comment": "Malware payload", "value": "5422c26023f2a0a31a77cec669b91164a0ef9ba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841773, "uuid": "8f420c1d-8384-4d21-87d0-8f3b6f220e8f", "comment": "Malware payload", "value": "454dfc8d06c40e7eab00c03369dda7ee98a39b96bccfca6fd320aea58945c87803f64a2fe1e484bd986d23b555463d79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841773, "uuid": "e3dd0f0f-d988-4c13-b4d5-14d55cadc5e9", "value": "T1CAA31956FC819B12C5D112BAFE1E118E331327B8E3DE7213DD24AF21378B95B0A7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841773, "uuid": "be816782-3899-4e14-8f36-e81cffdf17ac", "value": "3072:dXc17WiZTdt/ipCOvoVQ45aXDqJSG0GEqsJ:dM17bZTdt/ipCOvoVp5aWLs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763841773, "uuid": "eeb71301-c51e-427b-890e-6c7b20537dc8", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763841773, "uuid": "c71d8f65-6fe0-4f06-8e43-6c184ed28352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841773, "uuid": "c23cac39-bda2-404c-91ea-2becd114c9af", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4865604b-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855969, "uuid": "92a12dca-e27e-4aa9-aeed-fdd1504d8c91", "comment": "Malware payload", "value": "876ff2dde9e749433cbc146494e3661c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855969, "uuid": "554f5147-706b-4dd2-9a8d-3013535e37bd", "comment": "Malware payload", "value": "7f96177416122537d0ca9f70b7ae0d34c8f72d32c7b1382d32c76fb8a5c6ad80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855969, "uuid": "5c1c7fa4-43c6-49c5-a5db-fa2b5012f18f", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855969, "uuid": "4f7f2754-7180-457c-a53b-9ae078f756ea", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855969, "uuid": "df111416-01ee-4cef-b7cb-e7c4b9bdb179", "value": 532492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855969, "uuid": "a8c97b39-d8d2-46bb-81fb-6d540f48cea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855969, "uuid": "37e7fadd-06a2-4802-b9ef-e22974763d59", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493644d2-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855970, "uuid": "6147c5c4-28ec-4d37-a928-f1573bbc25af", "comment": "Malware payload", "value": "4bac4f55f2690992eac5a9e63b681542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855970, "uuid": "b922d205-3491-4914-9d15-a96610b3713c", "comment": "Malware payload", "value": "7fc8e256c65723358acdea0c44bd0dc1e4f134e28e1b966c165e0303ef4bd88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855970, "uuid": "d4568e00-5114-4168-8489-400990165255", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855970, "uuid": "fa08c43e-1bcc-4e38-bc1c-6aac145d8240", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855970, "uuid": "81c9cb1f-eb4e-459a-8103-18c621b965d5", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855970, "uuid": "bfa1fa2c-30d0-4277-a587-be3e0b9049ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855970, "uuid": "e26e27f2-5f25-4b50-a7b5-34bc460d3b4e", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a112da8-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855972, "uuid": "a18de7bb-8ac0-4e76-bd97-7603bb5e47dd", "comment": "Malware payload", "value": "bf8dc83b0de682d4bdf1b555c0088aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855972, "uuid": "6b9af38f-39b4-406c-8c28-9d0a1cbf1817", "comment": "Malware payload", "value": "7fdfd7462481634f41f936913f011b6e6f7cc6ba63e3e52663f5ca597de7d086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855972, "uuid": "1f40fc09-6fc2-4b5d-bcea-60b577aa6976", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855972, "uuid": "e3b0b3d7-7bc9-4481-815b-699dcbbb8a41", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855972, "uuid": "0d62495a-82d1-4767-8557-015e852da8b0", "value": 3293196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855972, "uuid": "36e42e62-031c-473e-b35c-6b7bfd6b706b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855972, "uuid": "5249dd76-bc18-4fe8-826b-4df64c2e2b83", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ade42f0-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855973, "uuid": "177b1432-03b8-4ecb-a612-d53f0685f8f6", "comment": "Malware payload", "value": "c4f93e16f6352cf29a399231742d473a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855973, "uuid": "c981f9be-5c37-40b3-b54b-4ed480c433f0", "comment": "Malware payload", "value": "7fe453ffb100dc37b7d7cbd3e1a8af5856d18510b56c2fd7e4453d09fe9d9051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855973, "uuid": "817f3a3d-567a-4b80-ae1b-5277f6ded345", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855973, "uuid": "55a3086f-c225-4ac3-933e-3eb80f480b15", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855973, "uuid": "a6462864-12c0-4641-ace9-1ff4be136863", "value": 3330048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855973, "uuid": "b34be66d-9891-4ff1-83db-76f60c4bf559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855973, "uuid": "bd0d2d3f-2f0c-4b0e-b3b3-b64b1ceabca0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bac1828-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855974, "uuid": "ef090ff3-39cd-454e-bbfc-aa06dddec31a", "comment": "Malware payload", "value": "72cab9513a9461a4984c03f6c4587df5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855974, "uuid": "ef82cca2-6dd6-4b75-b011-b363e466a250", "comment": "Malware payload", "value": "800af71e590e9e26f3bf052727ba6a0ca78b265f77db41758fed5bf60f4fbb26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855974, "uuid": "968b538f-45f8-4119-8f76-37944407303d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855974, "uuid": "503bf116-ec26-4c17-9742-5072f2259e25", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855974, "uuid": "c024cdf0-3da6-4090-9b4d-2602242359fe", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855974, "uuid": "cd00ec0d-27e4-4a8c-b95b-440c8db20b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855974, "uuid": "82b63b0f-00fd-4c0b-95de-7d69f2ef7a55", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c743213-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855976, "uuid": "d2599a1f-3671-41d7-98ff-46c99b149f9b", "comment": "Malware payload", "value": "af735943498215e0a076dde0b806a303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855976, "uuid": "280fc629-691b-4b3a-8150-3dd82934590f", "comment": "Malware payload", "value": "803bf3bd01898d5f5ba4dbe0838e7db049710c17f4ede83cebc6d7f4bed8898a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855976, "uuid": "784b2b87-130a-493c-86a6-5cc7987272b1", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855976, "uuid": "efdadf06-62b3-4de3-85ce-d8e1f666bd9e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855976, "uuid": "02ed7931-bfcf-45cb-94db-8fc36a790b32", "value": 1950208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855976, "uuid": "355ad478-7787-4f59-a808-228df270cea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855976, "uuid": "2e918f15-aee6-4649-986d-899b48cdb5d2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4096d6-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855977, "uuid": "ab7f90e4-4b4d-4477-9e3a-7a75fd669fa8", "comment": "Malware payload", "value": "ba675e895e98aa371a2267c360696d5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855977, "uuid": "b99d16ed-e6a8-448e-bf91-00330a0f13c6", "comment": "Malware payload", "value": "8040e64f6724f9af90735828103cfe23d65c39d3e1eb7f5f0fa74a61e5b43dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855977, "uuid": "8cf70999-efbb-4386-9196-06b4d588b785", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855977, "uuid": "847befb7-4d88-455d-9553-644c47db11b4", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855977, "uuid": "ab1dd996-e407-4595-8bc1-747d2e632b28", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855977, "uuid": "ee9fa4de-5be6-47fe-9916-24e1ddc4a82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855977, "uuid": "d6fffedb-984d-486a-9009-5401ae97bb55", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7323f3-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855979, "uuid": "7a0113e5-09bb-44e6-815b-3933c21ed284", "comment": "Malware payload", "value": "eff176f900be1623f03582e5d43f5aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855979, "uuid": "d445ae4e-552e-4311-8af9-01369a84b29b", "comment": "Malware payload", "value": "807a88f5ce843156352b2e466135d5eef4f6bc6c76ce2604f5f23c1956e77f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855979, "uuid": "5247848e-c396-486a-87a2-089824c5d5ca", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855979, "uuid": "02e19811-76e6-4bfb-abc9-5ca54bcbf2de", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855979, "uuid": "e9123ae0-e372-408f-b735-92ec30568044", "value": 3285004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855979, "uuid": "5b89c2c0-70ae-4977-94f9-327832c8b303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855979, "uuid": "3acca794-2718-4322-9ea9-aa6d450058dc", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3c3823-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855980, "uuid": "8c4150ba-5b93-46cd-b976-8dfb3429c844", "comment": "Malware payload", "value": "1af6741064684d661f188db4ff521251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855980, "uuid": "00683d82-f6f5-4684-a8cf-d11653a491bc", "comment": "Malware payload", "value": "807fd76a91b636b9912159d84e7a0c368ba2462ea7bb02638f3e613440e2c209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855980, "uuid": "866b036b-1103-48ca-b390-5f3b037d467e", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855980, "uuid": "0e752769-f21b-4b16-a85e-c88d45438641", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855980, "uuid": "8a44af18-dfd4-4123-ad2b-2a258a05a3e1", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855980, "uuid": "31a1e1ab-52ab-4db5-96d4-40519f2a1916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855980, "uuid": "b6c37411-2c71-4c98-b675-e9e4c04cbbc3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503f9806-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855982, "uuid": "20c6c0fb-97d7-4b4d-bd1b-785940584e81", "comment": "Malware payload", "value": "c53ae614790a9802b4872db15c813869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855982, "uuid": "e8989e6b-437c-4099-aa90-018d1ed93ed9", "comment": "Malware payload", "value": "80d8926421adb3426b815a4851c5a560cb65dcc73dfb45a56bc9d555fcb3bcf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855982, "uuid": "5aae0c51-945e-4ffd-98bb-343a2005662b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855982, "uuid": "4801708c-86e8-41dd-ad5a-7f40789e54ee", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855982, "uuid": "fe0585ad-a7fc-49f4-9139-ec1285bb526f", "value": 295988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855982, "uuid": "20cccc91-9685-4801-8842-bdfe33395bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855982, "uuid": "0556312c-6eff-495b-8b03-4c55589869c2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512e70b4-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855984, "uuid": "953a5a50-073b-49ab-82df-18982d4cc740", "comment": "Malware payload", "value": "6c5a7ea1320ee2153051eda670cc5822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855984, "uuid": "bdaad8d4-0081-4675-bbc5-c1673c74cd51", "comment": "Malware payload", "value": "80db1617c73f69bea14bccf6dcc4775ccb2e91ccb4a15bafd661939e6ba4aa14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855984, "uuid": "d8347ef5-d4c9-4ffd-9394-e5a8e15f6cbf", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855984, "uuid": "86e93b53-ca56-41ab-8d24-189c0b27fc34", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855984, "uuid": "99288142-6bc9-4c93-8d82-bbaacc81fbc2", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855984, "uuid": "056f3d14-0238-4365-9063-aadda05e7590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855984, "uuid": "66244b8c-d8d3-473b-9779-3fb17335995a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f27eb1-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855985, "uuid": "2d50fe5d-5dde-4330-89e7-8393e1f675c5", "comment": "Malware payload", "value": "7eef4772f9698fb6f84fc3ea0d20337e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855985, "uuid": "ca476d58-4e8b-4059-8560-89ccf134e5f6", "comment": "Malware payload", "value": "80e80417f8b11352a7a69fc1e0b6c0a3cd43c2ee3a6d7622dd8870b77f3387be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855985, "uuid": "3c15c9eb-2a08-4aeb-be10-b33b5f2d8aef", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855985, "uuid": "fc9ef5a9-83a4-4fb1-90bb-e0d90b82848a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855985, "uuid": "701d9519-fd6d-4afd-aa0a-57c2132c1de1", "value": 1987584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855985, "uuid": "3330e963-8271-4b82-b323-e429c6c93e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855985, "uuid": "6ef85506-7046-419b-af6c-9545ef32cfb4", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c8b7bb-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855986, "uuid": "055664b9-d308-4aa4-ae5a-5280fb6bd9ba", "comment": "Malware payload", "value": "265e30b35a34a71c9f5d8269b29e3274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855986, "uuid": "c18b8a84-9962-4058-b7c5-92bf183092e0", "comment": "Malware payload", "value": "813a4823cabb96d550fe0629624211b8dde03f9a3541f654ef09125016af9f3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855986, "uuid": "1acec6b2-0c97-49c6-b3bc-be1d1cb2859d", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855986, "uuid": "341bd158-7e6c-4f6d-b29f-2fd33c1d2d4a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855986, "uuid": "3fdfe914-56c4-485e-9657-3b0f994fd08c", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855986, "uuid": "74eb1d74-85c5-42e4-acb9-c0c8034f7184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855986, "uuid": "1c56becf-65bd-464f-89f0-95690ccedbb0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537ff58e-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855987, "uuid": "e12456d6-3f8f-4e07-bc75-89c4808b937e", "comment": "Malware payload", "value": "42d40571aeddf605490cd8da65468a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855987, "uuid": "5051ddf4-1bb4-4357-9f3d-4180012b5fe4", "comment": "Malware payload", "value": "8163f93e88a9ab0e3f8bd03a7923c56e8968f717397912ea114cc0e38af41353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855987, "uuid": "1ce70019-e340-45a1-adfa-eec6f71685fe", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855987, "uuid": "767211a2-5071-4d9c-8dcc-a029998d2b2a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855987, "uuid": "6a75e9a5-d64c-4702-98a4-bc6e7d7be3fa", "value": 376844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855987, "uuid": "487a4ae7-5acf-445e-b91b-5b65dd0bfec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855987, "uuid": "acaab9bd-d55e-4148-bfce-d0229d587565", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547dd811-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855989, "uuid": "72c7659f-9c01-4cff-9d56-b859044fe252", "comment": "Malware payload", "value": "da4cbbf4dcbdaed16c3588dcd73cecf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855989, "uuid": "c726ceb9-0880-4a50-b021-cf8c62c28285", "comment": "Malware payload", "value": "81868d9611a3f5020c4d27cc1eb4b766405df2fd2d4d1210c62c970dba71b2e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855989, "uuid": "7b1e13e3-48da-4c71-b5c5-2bf73f39ee95", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855989, "uuid": "ca0d1e9b-57ab-4f81-950e-5cb6ae53f650", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855989, "uuid": "8a6807bf-ffe8-40f6-bda8-9c5c87efb362", "value": 3269632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855989, "uuid": "3556e085-70d8-44e4-83c6-ecfd2276835a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855989, "uuid": "c4da30b1-29f8-4368-bf9c-dbe7baa63b06", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5565111a-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855991, "uuid": "f32fc564-6ae0-4ddb-8738-8eca0e20e50f", "comment": "Malware payload", "value": "9ccb4fe944622b2b62e6ec2f436e55e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855991, "uuid": "b83f2e57-c958-4edc-81c1-f4a09ea34c9d", "comment": "Malware payload", "value": "818e961a03ac974e50bd261b8c0b76c01d741f8d93bf608d97bab0b6a15a45dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855991, "uuid": "576bdd56-5c54-469b-be08-4b9b8bf6616b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855991, "uuid": "7e1d40d9-4938-4366-a134-6cfd9dafe32a", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855991, "uuid": "b11d5053-e3db-4b06-9290-8326f8cced86", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855991, "uuid": "695d756b-ccc1-400a-b000-339a76211352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855991, "uuid": "4f4abe8b-315e-472f-a3e8-d529dba858fb", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214bfa77-c7bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763827127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827127, "uuid": "35135552-03a0-4b9c-83f2-d285bd594d15", "comment": "Malware payload (Mirai)", "value": "ef04354acd9bec17e305488cc6280773", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827127, "uuid": "a36e5fe1-9cd9-46fc-ac28-84d34831680d", "comment": "Malware payload (Mirai)", "value": "81bc32c435fb347b817adba424c248a00e0a0d016f51fef95dff6498ef06e2af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827127, "uuid": "3df5bc2d-3b7c-4921-9a6a-8ba4969c4f4e", "comment": "Malware payload (Mirai)", "value": "54c152549420426d179cf17ec429244adadea895", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763827127, "uuid": "d23ea26a-a068-46c8-b91b-6d1c01928476", "comment": "Malware payload (Mirai)", "value": "321a5f1a2d5b73c7a37ffcb6d15a36eaedc933f4d91a2cd5ef36ff0a885ddc2412d8a270a382019d313fd547871739e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827127, "uuid": "0bb99ae3-4ab0-402f-a3e1-8bb224b50641", "value": "T114045CE3FC01DDBEF81FE77684034805B230B75124925B3663A3BA6B9D3A0595973E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827127, "uuid": "1152507f-c2f3-4afd-a441-fb874e07f4e6", "value": "3072:yFxjWTpacHlYtMkTL9yxsiP7hURAL7j2tP1t6V9jbi/LhiYo3R8:/pxHgpyx9PFURAKN1tnL0TR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763827127, "uuid": "113c2c2b-390d-4e05-ad37-410a2e06d16b", "value": 190220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763827127, "uuid": "9cb96e5f-d913-4984-bce6-b9e23ecf72b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763827127, "uuid": "0e25dc0b-8007-4b30-a17f-b12d35a4a6a1", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a1e0be-c7e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Kamasers)", "timestamp": 1763845472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845472, "uuid": "95a2f553-9c51-4ff1-9a50-21acecb0d491", "comment": "Malware payload (Kamasers)", "value": "e89aa31ad992a0380a217a90bc416f2f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845472, "uuid": "e274dfb6-aa5e-47ee-9220-fdc6f750595d", "comment": "Malware payload (Kamasers)", "value": "820b35c66e45626e5c8cab4ad0b564961b66dd49f2f58020221706e04f4536aa", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845472, "uuid": "e73d9901-4f56-460b-9b37-137441915ca3", "comment": "Malware payload (Kamasers)", "value": "5ebd6bd9659e5a977814656cee88cd3b955fce78", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763845472, "uuid": "41fc6244-8f9a-4d42-9662-c79e566b4f78", "comment": "Malware payload (Kamasers)", "value": "109a9ecac5d3261876ce0186931883d04f60617c8626902c4d90a85af9406e3b99c59063d3adad6351df180d5eeccedd", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamasers", "colour": "#83987A", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845472, "uuid": "7c684a8f-5a34-4ed8-8073-40dedb0b39d4", "value": "T1CA65235642E41855F936533964F10267E632B492ABB482EF15C6C1FE1EA3BC073B6F0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845472, "uuid": "00d9640a-b6c0-4038-b38a-09516eee39da", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845472, "uuid": "83268e2e-01df-48d6-9fd5-07d68334b916", "value": "24576:AjUEvz73as9xe+eo1h5zDw7CjWKdG6Hin8L+X24BR38E5qXI4YjKYdHlBQhXbcet:AjUEbRbe+ZhlwkW7Hn8iXfR38dI4YjKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763845472, "uuid": "c803c1b3-6545-419d-a10b-cc48b02ac615", "value": 1491384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763845472, "uuid": "e0204761-99d1-4ed9-a900-70c275e4c03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763845472, "uuid": "f99f1ed4-4cd2-4dfe-9805-3a0b7ece4c75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567e7d9e-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855993, "uuid": "3b2903a9-c056-4381-a1f3-3d2f4afebb18", "comment": "Malware payload", "value": "e0efb1b83b0260760abf9abb5de837bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855993, "uuid": "a1e06d0b-bcc5-4692-9431-8d61168d3c01", "comment": "Malware payload", "value": "8210a0db55ebc800ddb8188e844775cea22cd742e54f23dd2b29e754295cec72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855993, "uuid": "e9aed498-e98c-4f0c-9684-2d9640e7c18a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855993, "uuid": "22eeb0b2-aa75-43b5-8ba1-6922802e807e", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855993, "uuid": "3317cc70-5191-4978-85cc-9b98a92e0ab4", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855993, "uuid": "d4f679e5-1404-423a-a4ee-d012e3a52dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855993, "uuid": "99f59929-fda8-4da9-a019-87e6fd30dc10", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57df3b8c-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855995, "uuid": "79d9d0d9-4df3-4573-a13d-680c14646f33", "comment": "Malware payload", "value": "6725728b9223b5cc4e9f70577329a0ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855995, "uuid": "82829017-a835-4878-b285-08bae301af9d", "comment": "Malware payload", "value": "822513a81a5c5a24c65b8139c65c91b78b9565f95b09176de500e3568b336932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855995, "uuid": "bc079cea-ba83-4f9a-a9da-ddac6d2f3ecd", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855995, "uuid": "ec4f03c4-38b4-4cfe-8585-2fa2722b0ec2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855995, "uuid": "171fa192-6c62-4e68-b773-13ae5410468b", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855995, "uuid": "a8cd6921-22ab-4b2e-b6b7-44392933ec00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855995, "uuid": "24f6ca6c-c361-4c15-a742-6642482aa8bf", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e8135c-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829416, "uuid": "cd10b191-b637-41d6-bc09-5ea14b0d2f9c", "comment": "Malware payload (Mirai)", "value": "a76dcab4a2d7a36e2cc2613d4bea6b0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829416, "uuid": "d769ab89-75e3-42b1-86e7-d0f9965315b5", "comment": "Malware payload (Mirai)", "value": "823e092401f287b3e22f10869327f39323375a93542880b8680371be1e1d9b3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829416, "uuid": "6f020ec6-219e-4100-a6ae-d32fa720e7cf", "comment": "Malware payload (Mirai)", "value": "4db1dc7cc6408e552fd4f9053d2cc05e43be973a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829416, "uuid": "1beb5f45-044d-4fa4-bb6b-62e8c0575888", "comment": "Malware payload (Mirai)", "value": "e69e1c752d1cc7d5617c97c697d273961ad0648092a9448051960a206a291fbf8f6010c037d4259e960590e91e6974f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829416, "uuid": "500ae23a-9683-4a4b-b4ff-8bd768b9348f", "value": "T13E3302D3FA97C661DBDFD270DBE239C52648D03C94906CAF8D51512C3EB9B842528B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829416, "uuid": "9d64b415-d8dc-48ad-b7d4-0dd93dad9601", "value": "1536:YO9v276g3xFWUlpJ72Cgn693mKp7zGnouy8tya:pvvsxFvlpJNgi287z2outP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829416, "uuid": "01db11fd-5dc6-462b-9321-b24dead155d0", "value": 54740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829416, "uuid": "1e7ed4e9-f8f3-4075-8c1f-0444d1a43286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829416, "uuid": "489b5277-2be3-41c2-9dc4-b6fe76a1b7ea", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06e2bfa-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853217, "uuid": "ccaee7cb-70bd-4132-9979-fb725cb352be", "comment": "Malware payload", "value": "4806af8d8cf2f6f57aa72d0607e97ee9", "object_relation": "md5", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853217, "uuid": "e6950ecd-9f7f-41a8-8623-c73df6551813", "comment": "Malware payload", "value": "8257f6366279faed18b65f12753ce5a3144dd2773ed777f4650f442a650edc8c", "object_relation": "sha256", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853217, "uuid": "eb28fe32-fce3-455a-961d-12e3c2e530f4", "comment": "Malware payload", "value": "89cb56cb825a69934ad02c7e15684b7aefccd47c", "object_relation": "sha1", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853217, "uuid": "3a882d87-c5d0-4b70-8745-a0cce52952a8", "comment": "Malware payload", "value": "d8c713796318cd5733576fb3c211ba4ff318dc2947334120a08a812fb4764569d20bc8fd1ca4fe47ed18b4e4e27ae021", "object_relation": "sha3-384", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853217, "uuid": "a3dd2db8-5250-42b8-8c23-d21e1605bc9d", "value": "T1F4612E790B4BD0D98724B587C846ED45AEB4027E361AD60431EF8E25F6FE405C33D359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853217, "uuid": "edbcc4ec-a446-4dbc-8dea-a3db065c6e39", "value": "96:DTQYEzVQpx+/A5fVNpKCRvCUuRdMA5nRWiv/KZ3krsKlx7S:QbzVQb+/A5VAUuRdMA7Wiv/uUrsKlx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853217, "uuid": "7303514d-8d08-46f0-be72-6b5fe1fca327", "value": 3455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853217, "uuid": "845e1c27-8cff-4b03-99e0-76608b19c664", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853217, "uuid": "8d6c4957-6248-4580-a971-3bb1e660829e", "value": "DOW.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4e7a8f-c794-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810177, "uuid": "5efa719d-114d-4438-82c4-bc64b0de6338", "comment": "Malware payload", "value": "521ea04ec594c7d730c48df1b22749c3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810177, "uuid": "782adf3b-0203-414c-b1c0-8fa821fbcd10", "comment": "Malware payload", "value": "82764c5242b2b3592a98ebac4c0046b93c1a3f1ab47b434b1222fb14adf12cd5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810177, "uuid": "c5cd6fdc-ed15-4b3c-b5e7-3e444121c271", "comment": "Malware payload", "value": "7ff91b0fb439dd8ec412ef7ebff07d859df4a2ab", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810177, "uuid": "98768be3-accf-48a6-a8a1-0a8e09d76cc6", "comment": "Malware payload", "value": "b64ef3278baa0eeb3799a14b4aa6d5a4b7dade0b813d7f6b2ddf724f2d5a645b8867c9ce453e27bc5d40c2267e193250", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810177, "uuid": "8453224a-15d1-41c0-844b-a1a61ad069a0", "value": "T1EE95F142F3E5AC2FCDB340364FB90B7A41468D968646D31785B5B12C9DBBAC48E86FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810177, "uuid": "8647f4d8-b2f2-4380-ad5d-6805e133cd5f", "value": "49152:c3ec+aeb2dFyK7xlvJ0vxxbhuadYmK6OPfFFD7jLE+sg2AcJd:c3kaebsPHNjBPHPAJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810177, "uuid": "d4600c68-725f-4c72-968b-84b2d88c7ef3", "value": 1892445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810177, "uuid": "1511c056-6f35-426c-8450-7b2679f09579", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810177, "uuid": "c184f136-7e5f-493d-822b-efc35143adb4", "value": "download.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2712aa-c7d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763837613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763837613, "uuid": "3feec6c9-d3ab-4939-8729-d97e869fd406", "comment": "Malware payload", "value": "d8557f2f9f269caea679b2d58d98b7f0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763837613, "uuid": "86fe506c-2619-4c14-8eae-bc50973a360d", "comment": "Malware payload", "value": "82a6ebc4ce6cc397cbcc8c7002901a83a2568beec4fa88e279a5f0512fdf5085", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763837613, "uuid": "63e21219-b8c3-4c2f-9444-4c43a9f2da87", "comment": "Malware payload", "value": "f851641c2f344437520b9114acf695496e80158e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763837613, "uuid": "123f6e4c-c430-45f1-804a-e8e903e32302", "comment": "Malware payload", "value": "b4afd4da20f81bb41efede23f52fa189f5734b4cf748c974b68263059aa492792adc082d7d506ba2f15a8b33299890dd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763837613, "uuid": "9967024d-e8e7-4c27-ae5b-e6b79f535da7", "value": "T14B36336B36FD893FCC17317A48FE291942599F2A0E9084E7F15CF7A60B74AE4A230355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763837613, "uuid": "af2228d7-92a1-4f7b-9b81-882306fe0ab8", "value": "98304:ZwQ6uy5l8MgXW+3tS08FAPueFL3T+lZvPEbZd2SzV4elWZqmsfjXGs:uQtyH8MWqS9djwJPEj2u4eoZqmsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763837613, "uuid": "9164c1de-6395-4b6e-adbc-95814819891b", "value": 4874240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763837613, "uuid": "f3b5190b-8994-465f-b4a2-cd73caa8147e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763837613, "uuid": "56915141-6d2b-4018-9b6a-14ceba5a765f", "value": "SecuriteInfo.com.Other.Malware-gen.61295838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5968a8d6-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855997, "uuid": "f7333e2a-1cde-44f5-83e5-4e71e92800be", "comment": "Malware payload", "value": "496318819b1d422e3ae107909ce2690a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855997, "uuid": "7e2bfed5-a94f-4959-b35b-233459ed8595", "comment": "Malware payload", "value": "82bf83b603ed61f07416cd0a2ecc888e9fa58b366f2e566bff811c2e339f9f04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855997, "uuid": "b60b9874-e36d-4a53-ad4a-35a8a14d833a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855997, "uuid": "973d4622-4edc-4617-bb29-f5a18f8137e0", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855997, "uuid": "c0aa532c-4ba7-42ff-a949-43126a5abd86", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855997, "uuid": "363ffa11-9a89-4afb-996b-f829def8f007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855997, "uuid": "49afc98a-7a2e-4570-b31b-af3f10e77930", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c445026-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850768, "uuid": "34214ced-8184-4349-96e9-d37e7f65d6d0", "comment": "Malware payload (Gafgyt)", "value": "61a515b4f207d878a11c70314de522cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850768, "uuid": "ea707965-7c66-44d1-8d5c-2d3ce326b6c5", "comment": "Malware payload (Gafgyt)", "value": "83bc34eff76149d31c9d32d1f137f40c6319defa600d7c41c27d36a49f1fd675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850768, "uuid": "15795f99-afb5-454c-b9df-d0a3a3620262", "comment": "Malware payload (Gafgyt)", "value": "7b9b8ec3fddd4c4ff6d9a5f758f948f2fc8a6761", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850768, "uuid": "40a766a1-45d6-4449-823b-b209e4791bfc", "comment": "Malware payload (Gafgyt)", "value": "44032298a17b4ea8c7174f139835d05eba3f514e71a0079c425cb5dbfc4b093ff41bd21adf6229e887be2e3bfbd51f87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850768, "uuid": "b092a438-4167-4673-9000-dbeeb9a0dce5", "value": "T11E830802BB40CAB3C44305B6169F9B110A33F9FB1E57AE56F36D6CF09E15585B222F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850768, "uuid": "4f98c1ee-2812-4745-9749-42377b2f83a6", "value": "1536:t+cP74KUOUM9HqjjnXYw5jvl7MHdJfuu6YK0mf5hQdddddV8dQl5+mYHc0r6jmV8:t+cT3UOUM9HqjjnX9jvZM9duTr5h48ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850768, "uuid": "9ab45dc8-2074-47f0-8d15-3c319641bb0b", "value": 85756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850768, "uuid": "d9f93816-f083-4d92-bbe5-c20199f3bd72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850768, "uuid": "82483835-d853-4756-862b-97fc6df216fd", "value": "Ayedz.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7595baf9-c794-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763810089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810089, "uuid": "0b711bf0-81ab-4846-9dd6-d9b2d86459bb", "comment": "Malware payload (ConnectWise)", "value": "1767d0725f23137dd2cb93137f026fed", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810089, "uuid": "a30f2cc2-3ffc-42fb-b001-683591381ece", "comment": "Malware payload (ConnectWise)", "value": "8401a048f5f4523667b02e4e49a8b76d800051cac0f8044f9698ac4c70558861", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810089, "uuid": "e1b285a0-f33c-4d6f-83d6-0edb64ca8144", "comment": "Malware payload (ConnectWise)", "value": "5f54e2d0e721d4fdbe6724d4d98d4335965a800f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810089, "uuid": "491bc95c-9cda-47ec-8ca1-8baccaadd289", "comment": "Malware payload (ConnectWise)", "value": "a421414d9f2df4eed082abeef9232655c7ba5f844dd7250774ac53978c26bc8243ecb4be86bebb1ff5647e0c9170b06c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810089, "uuid": "27bfc6c5-e6c6-4aaa-b443-177f926d9607", "value": "T19956F101B3D696B9C1BB0638D8799269A774BC009316C7BF53D4BD796D32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810089, "uuid": "0598da4e-053e-44d5-b6bb-ba9916a7fca3", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810089, "uuid": "3e803fa5-57b8-4826-b4cb-f544a76cbe78", "value": "98304:8Gs6efPMjb2w6LeJR+WJ0dX2DSQG1oqryAqqlDQg+lz5:9fefPMjb2w6L4Rr0AP0yANlDdm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810089, "uuid": "b260ed92-3c89-4246-bd90-1d8bab42b55b", "value": 5979928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810089, "uuid": "6d4295e5-aa3d-4a36-b6f6-af3101d17638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810089, "uuid": "c2fcdf46-3949-4389-b9b1-27c93187b27f", "value": "CoreTool1753368313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98acbff7-c794-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810147, "uuid": "c6232110-295e-4ea2-bc70-7b38e8e3f1d2", "comment": "Malware payload", "value": "0e7284a4915f5bfa3481f13fa75fa4a4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810147, "uuid": "20cabc80-6fa6-4086-8c71-35355bd865a6", "comment": "Malware payload", "value": "85339733fba9712099a9a9c788f03aa77b93d7e7c973f12d564fe5e79cf776c5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810147, "uuid": "bd37c2dd-c574-4d78-ba0f-bac81356058a", "comment": "Malware payload", "value": "5510a398bb2bce311e856cca4f79e4879d6fa5f4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810147, "uuid": "106dfd3b-0c7f-4f62-8ce0-f4506dff7081", "comment": "Malware payload", "value": "bcfda46a244ac41891fed4506d06bd682aa59bfece6ae7db7dee74631f1ef111be3898a8f20adf2842e807e3c08471af", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810147, "uuid": "d950e2fe-df1f-424f-bae4-2d4da9459486", "value": "T141C73355F768D92FC8BB21730D6A12353A668D068A97A7032A4C3B2C7C736D44F9DBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810147, "uuid": "14ce58e1-d3c7-4b7d-8926-19585929d8b8", "value": "1572864:UvcJFcZevCfLydomWzaXvrbkP5KeC1cVmwI:ZUsvO8rbkm4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810147, "uuid": "dc5b64a9-6ab7-477c-af78-47e4944933d7", "value": 54853015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810147, "uuid": "447bf183-7a20-4780-a795-93fd628f7de1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810147, "uuid": "3f4b510d-b963-401a-bc5c-9400c7fc0705", "value": "flujo_mobile_v7.11.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bdfd2c-c7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763848368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763848368, "uuid": "9a72fc14-2724-4907-b338-ad3385c3f4f8", "comment": "Malware payload (Mirai)", "value": "4595527333c4ebad6252487676014fd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763848368, "uuid": "6a0b64b0-1de3-40c1-961a-b1fc9dab752d", "comment": "Malware payload (Mirai)", "value": "85bfc29f6c1a295d7b947934e07834b9793daba6e56b67a9294c2d641372773d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763848368, "uuid": "7f890da4-20cd-49c3-8cbe-ce7f3132f5cc", "comment": "Malware payload (Mirai)", "value": "ef6ae55583bee3da6a6dca68cf7bf71b57c3f967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763848368, "uuid": "0c0a1850-86d2-4ddc-b3c0-8414671cee71", "comment": "Malware payload (Mirai)", "value": "6af57565c62c56aab2ed5c5b48851626a30274b104cff3f2eccacc37c02dcefcaa3c87c1709bf8f298eae1630a569e5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763848368, "uuid": "c655fdbd-4595-4f33-935d-4d40b47ab2b8", "value": "T12E63022D2886E4A5DD23CDE3D6A28449FAD52FF0D4EBF5623D32448C6F499827FD4884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763848368, "uuid": "f223b776-7996-4b5c-aea9-285b36762fb1", "value": "1536:SEU+EBwLligN1wTBQ25ExhmPq0mHojRjjcvhOR6L2d+HADLLA:SH+E6LcgNeVQ7xoBmW1jKOR66dqADLLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763848368, "uuid": "d9a4f58f-541a-40e1-990b-752b048dab6f", "value": 71416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763848368, "uuid": "ff1f8b70-cafa-4f7d-85e7-6f599cf7e929", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763848368, "uuid": "1b686471-30aa-4099-aada-38f6153bbc92", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7ade16-c7d8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763839517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763839517, "uuid": "8be728df-39e8-45c0-8fe8-cb40502b6e73", "comment": "Malware payload", "value": "c79206c367b5ca196977fa0fd48b397d", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763839517, "uuid": "fd051ac1-22f2-4072-a1e3-9e939a6d5da2", "comment": "Malware payload", "value": "86e4cfa5036c05cdea10e9bdf0cf153efa374ed005a5d0463dd7d859d7f35800", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763839517, "uuid": "74d9bc47-f4a6-4ce1-98bd-0ce715683192", "comment": "Malware payload", "value": "bd1c2501e4a8f013e6ade51dbbd76142be4967b6", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763839517, "uuid": "dc9e8ce7-b0c9-4133-a8f8-fe7d32bf7c8c", "comment": "Malware payload", "value": "97dc534f2f20619a7b41f11d4c2da8bd93864c19be6abb87abedc8f341dabdb12d189d87b654bc5479037bb75d760000", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763839517, "uuid": "93af3be9-9ff2-4b98-a9b7-e385d7c0d305", "value": "T166936F2469F951D53233FF424BCAB387A72E67B26B064F851A55034E2212846EF17F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763839517, "uuid": "dd2629af-8834-488d-8dbd-a462f4e7c749", "value": "1536:wqYKPNR5KZiyMb3J9FFqyinukfuPf+ihmcXrqOTif6kGjRpqHA1U+nWcXJw9HBDH:B3PNKZPMb7qyVmuH+iMcXeJyDqHYpXi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763839517, "uuid": "801297a9-fd28-4b9c-8cdb-a563334e7811", "value": 93130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763839517, "uuid": "100424c3-dfe9-4a25-af04-d620a83b18e4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763839517, "uuid": "45e5169d-5305-4f1f-8f6e-86c2587ce46d", "value": "SCRRC4ryuk.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42517ce4-c7f4-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1763851234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851234, "uuid": "b646fc24-2b10-40f9-9f41-1b91558a3c6f", "comment": "Malware payload (RustyStealer)", "value": "b6b5b7bda8f200629b01fc388228d450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851234, "uuid": "9d841ec7-be7b-42b4-8044-aac3566249c8", "comment": "Malware payload (RustyStealer)", "value": "87cec3315255e1b9140077b071134da1487414c09506f87f018acb945fc415dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851234, "uuid": "d6f5b2b6-3174-4b34-a717-b8467f1cf640", "comment": "Malware payload (RustyStealer)", "value": "dc9625abb70537dd5bcbf1097c01071a3cb28984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851234, "uuid": "1f5fbbdd-29f1-4084-8fce-50572f13c235", "comment": "Malware payload (RustyStealer)", "value": "6557594f0eb5fce036f1ce39f030246b5942de5ca78dd9aec265afe7215afdfa67053003d809e0cc1732c8a2cc6f5aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851234, "uuid": "97e65930-2c91-47f1-921c-8afe38a18761", "value": "T160B67C47F69291EEC46AC074835A6633FA327C4E07347AEB9BD086312E65FD06A3D714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851234, "uuid": "c34ee0ad-c599-49f6-ad99-85e645d36e90", "value": "6233d9a980db624a8b822e7b8108f5a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851234, "uuid": "bd7b6d20-99f9-4195-ba2c-d1a81f39be7e", "value": "98304:hFpf4qii47VglJ1uUNLDLcqlcDRTZ1PwR9fBivOvEitCTH+1fe:h/4pgpuWjYwR9fGOvEECTIfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763851234, "uuid": "1a6d2632-3a1c-43d2-9d76-93a964b93092", "value": 10536744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763851234, "uuid": "4853afec-9818-4b7a-b4e2-13ec4f3afd64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851234, "uuid": "55ab78a4-1158-462e-acac-c6479739d3ab", "value": "Easy2Convert.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc75296a-c7b4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763824005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824005, "uuid": "1c3d385a-ff44-4b90-97ac-fa2cf356cd9b", "comment": "Malware payload", "value": "18f62dba1b3d8e856a5420cc751a89d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lyrastealer", "colour": "#B94DA8", "exportable": true, "hide_tag": false }, { "name": "maranhaostealer", "colour": "#648749", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824005, "uuid": "a01c0115-09e2-4f80-bf99-30aa74e05aba", "comment": "Malware payload", "value": "8921c1bf22ea060348031a70153ee0953e764f9fffdd75d7a0cb0958a868b009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lyrastealer", "colour": "#B94DA8", "exportable": true, "hide_tag": false }, { "name": "maranhaostealer", "colour": "#648749", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824005, "uuid": "7acf114f-b3d3-4fc5-9a49-1022472a317b", "comment": "Malware payload", "value": "94d92bec16110c0cd6bc5b1df04d18c6c41affdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lyrastealer", "colour": "#B94DA8", "exportable": true, "hide_tag": false }, { "name": "maranhaostealer", "colour": "#648749", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824005, "uuid": "efa3284e-e981-43b5-8d00-4bba8fda13c7", "comment": "Malware payload", "value": "8a3bffa55dd6a0d2819c00879085a2cc5ad9a77a901074937963ef7fcf9c26abd1216c99c975967446811a1612978d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lyrastealer", "colour": "#B94DA8", "exportable": true, "hide_tag": false }, { "name": "maranhaostealer", "colour": "#648749", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824005, "uuid": "ae44eef8-9c9e-4aa9-88ef-af3e31512780", "value": "T1001833127B4E1E39F4EDC9766A224479513FFD3190DA9C939AAC4908DA384E018FDE3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824005, "uuid": "bb28dc9d-2c8c-4874-868a-e1586d862666", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824005, "uuid": "8c031e9a-8a9a-480c-93d0-fe962b547ae8", "value": "1572864:WUhUg7VkatVOxjJVGMH9PFFO+Hl98XBW1zzrj+UGTjW5UdfBFHDv1ylcpBIy7M+C:PzZkatV8jbGEfO+r8XEZwj3VL1yCpBIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763824005, "uuid": "e5fb035b-686b-4898-bd37-6ae8f63391d4", "value": 90432305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763824005, "uuid": "832bd64b-a15b-4b95-ba93-5bf94238d09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824005, "uuid": "70c12e5d-4994-4f90-8085-5d87f2c93704", "value": "injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadd1632-c763-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763789240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789240, "uuid": "5241d4bf-376c-4f20-a85a-cedb5a4c44d4", "comment": "Malware payload (Mirai)", "value": "968107fced0e1446f549455a513044a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789240, "uuid": "732f1c1e-c9d9-4c6a-9b0a-fa0f0dc8331a", "comment": "Malware payload (Mirai)", "value": "894f49b3a40d06fa659e72da37ccd2c8027d620698d806d2d508cbe172027d25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789240, "uuid": "28a4b158-2b44-44e6-898f-bf8f3bcb1d57", "comment": "Malware payload (Mirai)", "value": "9acbb730bbccaf4dff3f8a1c06ad0373cd4a2c07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789240, "uuid": "569df652-8a01-4c52-9667-a258eb8f806b", "comment": "Malware payload (Mirai)", "value": "13f950af024d522c33d0d70a252ad1521fdd5094d4ae13a57abab161c14c44f606e5a304cfc0e8757222d17b3123add1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789240, "uuid": "a0557258-d891-4b6e-857f-55c9fb4af8d4", "value": "T1619312869066D14AC1053676E2F326B891049AB5237DE8DCDCA892671DF98FC22DBF03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789240, "uuid": "73818c36-ba9f-460f-977a-591d02ea0d9e", "value": "1536:4UGSLkMSx4ldZCguBr9DoLWnTSvmL/FOrvmsT+FXj3UGrMkA8imOHu+E+opfdgwA:4UGSLkZxOaBkgmmL+0rUGwkAFPKdgwdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763789240, "uuid": "0fa88871-61d8-4ca4-9363-be9b007adb10", "value": 91300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763789240, "uuid": "1a992fd8-7708-4a09-86f9-22d9ee05d077", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789240, "uuid": "2976d462-9a9d-42b8-979a-06a172c99fb5", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e654c9-c7b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763824821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824821, "uuid": "3ce5fbf5-1fdd-4b7e-acf9-d92d107da9c8", "comment": "Malware payload", "value": "85bb0d97a5a35c3ff84ef42b5ea06751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "Winlock", "colour": "#8E9C36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824821, "uuid": "be1b4b36-a11b-4e91-9038-03ec9d8ad2ae", "comment": "Malware payload", "value": "8a17462c08ceeb2a307fe0e1a467107ee4c9c801db7e021d12eebb0a9722efdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "Winlock", "colour": "#8E9C36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824821, "uuid": "f48774db-3fff-4ddf-b683-d9ca5572bdcb", "comment": "Malware payload", "value": "f1a9969a998a3ef0152c6ec4d8772ee9f5048880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "Winlock", "colour": "#8E9C36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824821, "uuid": "ec1f189a-dc7b-4003-9ded-8a7b65e3bb3f", "comment": "Malware payload", "value": "aed68c8f84ce035910144f6d7ec39f22721c26a9552886633fac37f265645af37daf48a696e55991537a89906770ce0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "Winlock", "colour": "#8E9C36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824821, "uuid": "0afdef90-2862-464a-ad5e-67b4be9d4562", "value": "T1BCC5E122F3918837D55326345D4B93D86926BF201E2858877BE93E4CAF367C27839367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824821, "uuid": "31d4c6e0-d16b-40dd-879f-b29c0d67eaa6", "value": "4ed4c51dbe5a6b19a1289dd0f315e3f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824821, "uuid": "c8ab8fc5-03e9-4080-a072-f4be527c08d3", "value": "49152:bzf6V1jqp9ekTDoSxfHLqY+xKkmyLW5RhM0gl4:bzyV0pBfOtIFIl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763824821, "uuid": "c6eb1fb7-321f-4e68-8c77-47fccc66da00", "value": 2647552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763824821, "uuid": "9a3c9585-8a73-4f65-b9db-9bf384a8daca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824821, "uuid": "c7f41d14-6d60-4802-a989-fd9df6198308", "value": "Plaguecheat_Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3975f2e0-c7f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763851649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851649, "uuid": "ef84b00f-2dd6-4b77-8bb6-d4bb872649c1", "comment": "Malware payload (Mirai)", "value": "09ed8ce5dfe57c45c7b8148388d4c0e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851649, "uuid": "88d0b978-a139-4c33-a0b2-c13c5a46f583", "comment": "Malware payload (Mirai)", "value": "8c3606305bad336f131b983c89249142ca83e9ac7c3e6a8edcf20bea007fb05d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851649, "uuid": "b57bbd76-5174-482f-b86d-ae3e62995490", "comment": "Malware payload (Mirai)", "value": "29f8659cbcc55fdc9715d7fe8e18bb2b8b7244ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851649, "uuid": "439a5dc6-a59f-4e5e-8a53-7dc62bbc079a", "comment": "Malware payload (Mirai)", "value": "81a8560632eabe1ce43c47982e5cefe72b7d46c1235ff68f2592e8c905a5e83b751bb6a50d0508cf0a920e6200413166", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851649, "uuid": "d518d080-ddd4-4b09-9dfe-c70843e165d1", "value": "T19D140746FD52DF13C5C722F7FBAE018D37157BB9D2EA31029D21AFA4338649A093A251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851649, "uuid": "240d0c62-070b-47c0-adbd-001138269c3a", "value": "3072:0Vqd7i5L/PizOHzcWTsCX907U4K/YrhhFQ/9ebLrxMEeP:0Vqd7i5LdcWTX9cU4KQrhfQ/aLtMEeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763851649, "uuid": "2f809693-749f-4c9d-9f98-61490f49bd7a", "value": 193280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763851649, "uuid": "69d91fd4-8e3a-4cc7-85f3-9ca8921ed6ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851649, "uuid": "9cf7c5db-8ccf-4d0c-a7c9-ea7cccc4e889", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8347154e-c794-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810112, "uuid": "b2584fd5-56c0-40a5-b89f-31e177c35bb8", "comment": "Malware payload", "value": "3e827437970dc630636dec88d4bf3b3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810112, "uuid": "897ca864-5ac3-46d9-8478-88cd96bb02c9", "comment": "Malware payload", "value": "8cb9dd6ab59b915f7e6c9372201d9045350157b37618ffea9af02fdac47dc992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810112, "uuid": "3fb25550-ec29-4cf7-ba2e-805a715a9013", "comment": "Malware payload", "value": "8c10fc5730a495d90aef4b7823407e948d12588a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810112, "uuid": "ac30c41f-3cdb-495a-867e-9b0c774afdee", "comment": "Malware payload", "value": "c0d6d82dc3278bf678c2ca1c694679754759567e33a9e47224d422090b85cb12a24aefb422ec4d586420f22e671e39e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810112, "uuid": "146d9e77-45d0-4c60-8c43-a27229625208", "value": "T172F733217AC6A036F1B251B07CB59A89506EBE705B314ACFE3C4591DBD70EC28636B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810112, "uuid": "0b3eff39-0f1a-464d-a409-da443eb7b307", "value": "7d5e499d4d16151d88c783201297aa29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810112, "uuid": "00a99a64-c126-4c61-9512-ccb839dd15aa", "value": "1572864:2BF7N9rM4ZH2DagNSfw+JLWHfc4U1wX6egVmsM/LwEhlk:0FJ9oXOgNPeLW/c46vs/LwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810112, "uuid": "89a801ce-265a-4023-ab29-784565ee2d93", "value": 74484776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810112, "uuid": "7f79f0a3-fe88-4c82-8d32-1170c8d00940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810112, "uuid": "2127dd6b-9456-4663-b297-493ee9685059", "value": "QQMusic_Setup_2193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f90887d-c7f1-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1763849995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849995, "uuid": "1f79d312-80d0-451e-98bb-3557fb933431", "comment": "Malware payload (MaskGramStealer)", "value": "ed0c0b413bbc5b51f367a12d084bd81c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849995, "uuid": "f7bbe0fa-651d-45d1-9ac8-31ac16a986df", "comment": "Malware payload (MaskGramStealer)", "value": "8cdc955d3b984ef389b30c4038a8961a379eff7a03372d0cd9954d3631f9d9bb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849995, "uuid": "254f5063-98b5-4fb3-8dd3-36be997d3019", "comment": "Malware payload (MaskGramStealer)", "value": "cad035d8627289c02e9225678fe2c378eb6fcd41", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849995, "uuid": "7dd2301b-e68f-4fab-b971-578614581cea", "comment": "Malware payload (MaskGramStealer)", "value": "b871e5d323587ef119990b77cc96070c6b86fc625583a9fb84672a21694a9aed76253c44102a2e5b5cbbffff7487a822", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849995, "uuid": "358464ef-c031-44b4-93e6-a7677c45cb78", "value": "T133B56B0BFCA158FAC0A9A33188765186BB61BC451F3123D72E90B7B82F72BD05D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849995, "uuid": "0db56f06-9660-4a43-b59d-5a4ea5484623", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849995, "uuid": "731d227f-b0ad-4cb6-8db7-35dc570c9d2a", "value": "24576:mZnAFEM3uYD5NDdGGd8qIPVRnCUgjtbVnITvRfJpHUxGmcoeleTNj4HGu2U+cVT3:mZnez3XbDMGmlHngjhVnO79yUm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763849995, "uuid": "f2372703-ea9a-4f40-b44a-0234eae1b1fa", "value": 2383360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763849995, "uuid": "057cd933-9414-4a77-97de-325f2cf31727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849995, "uuid": "4b3b581d-d684-463d-b8fb-ce095396b50d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad90a16-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855329, "uuid": "165fbc0f-4d3c-4111-845f-72a8f5bc0fdd", "comment": "Malware payload (Mirai)", "value": "e6f686b70c0bd25fc755efac0f60ed65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855329, "uuid": "61db7ad7-50ea-4433-b9e5-746b0a316ab3", "comment": "Malware payload (Mirai)", "value": "8cee4bdef3b61a30f88f568645271966e08a911f35a1789321ece9208f70002a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855329, "uuid": "05024b6a-56a4-4b6e-9a4b-84823c44fbb5", "comment": "Malware payload (Mirai)", "value": "23a9568fe05ef6179f6596bc23b10164e7dc6297", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855329, "uuid": "5e16012a-d589-4c02-8778-82d38c8aaeac", "comment": "Malware payload (Mirai)", "value": "10cbd9c88083fdf725acb643668ad5b152d6007484c3b6968ed127122289ffa906ec4e412fd9607dde500388ecc868d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855329, "uuid": "667b9c3f-17ee-493f-819c-da01a8211b90", "value": "T1F913E1AA570498E6F8A487FD5FF45BA008264FEC5502EDAEB390B484CE5A1B47C0FDD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855329, "uuid": "736c120c-1149-4912-838e-5de100d4bd14", "value": "768:YwfcQ+l/zCodkjYUcEOseObzXaH0pvwCaL3LrMJ854asivDdg7kcBJgGlzDpbuRG:Lq1OZjYdsm0pIC0iiGivDdg7kcTVJug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855329, "uuid": "2192d812-ec6e-47c1-8c52-1fb64050044b", "value": 43172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855329, "uuid": "1437e2ed-749b-4be6-bd57-8e13c7e333f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855329, "uuid": "ef78132a-aec5-4b3d-8102-f812032ce4c7", "value": "Labelloperc80.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8a6b60-c75d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763786664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786664, "uuid": "f97e4e45-f00c-487c-bcc6-6c7019101a3a", "comment": "Malware payload (Mirai)", "value": "013b48a330bc01ccc7d2b6a3f97f2c03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786664, "uuid": "4df248e3-1b87-43e0-b7bd-a1b95d35758f", "comment": "Malware payload (Mirai)", "value": "8de1bbdc0f265cb22429cbf08385fc52cf963b0719cbc94edebf461d4b148e2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786664, "uuid": "29deb498-8306-4d10-8fa9-d7ada75a0ab7", "comment": "Malware payload (Mirai)", "value": "fbf4145c7068d3a85528adea48078c7ab92ee8dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786664, "uuid": "48bf78de-83ae-43db-97db-34754c7f0c07", "comment": "Malware payload (Mirai)", "value": "0870425c40632df245f80d2d9440ff04512a30ced86e1841b7ec0e7447850f9fb040ef13f2c781769c2c87a4507e5bd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786664, "uuid": "eb5aafde-f4dc-4cd3-ad2c-8aaadfcf9a01", "value": "T14DC35A42EAA3E0F1E1870170055BF3E78A34E6305156DDCAEFA83970EC716829DAB75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786664, "uuid": "ef2c825f-458d-4b22-9d3d-2d6a318bfdbf", "value": "3072:6T0Qk1X1RiQCacfn5EJn6C3rRJ0Hi28m:6gLX1RiZCrYi28m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763786664, "uuid": "c0c3e6e0-3e13-40c3-b31f-b801a8ebfef6", "value": 119484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763786664, "uuid": "6a3e67c0-ef4b-4171-85a6-97d8d49f41cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786664, "uuid": "2768dd31-2a8d-4cf8-b4fa-49b4c63cf5e1", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114bb859-c7b7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763824953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824953, "uuid": "2f94a504-c45c-4199-9796-ceba47f36daa", "comment": "Malware payload (SalatStealer)", "value": "8c54fce34b3ff78a4a6760f31654fb8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824953, "uuid": "8a7b9966-bbc9-4c56-a357-2c3ddc6c8b0f", "comment": "Malware payload (SalatStealer)", "value": "8fa96c144b77d26f411aadbf218a532710a01690fd6fcdc79c99c4fe4aced37a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824953, "uuid": "c578b520-b2a4-497a-aecb-eef7fcc2f262", "comment": "Malware payload (SalatStealer)", "value": "f8dc05abd7dc92cebb86dbdfcde21d15eaaa7bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824953, "uuid": "01623ec3-c9a4-45e3-9a89-e811773c617d", "comment": "Malware payload (SalatStealer)", "value": "0fed9646ad1b4e0af808783ba9491dddde141b0cfe665cccfbad03ab9888dfc7219a4c9516ca9ddf8b4f67a650d90ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824953, "uuid": "4475be43-6a10-4bcf-a8c8-1e224b23bb50", "value": "T176C65B01FA8B54FAE9031835405BB23F67355E048B28DBDBFB543B6EFC77691192A209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824953, "uuid": "186d789c-45a9-4910-a9fd-22c6570bbcb2", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824953, "uuid": "31c5be3e-a035-4684-bcec-6c60d64b3186", "value": "49152:4MSnB+HnkBFkqATcmh+Z6DRxRSOEHpdTe7G5BV3kdNy7UH1OSmDCgqgiHlgJtjEj:piBgn26cmm6D7y3lxdqPXL7PZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763824953, "uuid": "89448012-d8dd-4e4d-8111-1df782ff48bd", "value": 11662848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763824953, "uuid": "87885223-e1c0-49bb-b018-ea77cb48b03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824953, "uuid": "9aacf15a-a82c-4a37-8139-b0a62317e997", "value": "RuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47634051-c7ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763834922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834922, "uuid": "2aeee329-d6b5-4b92-b34c-3d9bf2c7cc73", "comment": "Malware payload (Mirai)", "value": "9709821eba1eefefbe9f05ab7c6b3638", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834922, "uuid": "d08e7218-4deb-4ed8-8b32-5f5f031cd97b", "comment": "Malware payload (Mirai)", "value": "9085164d22fa877de656b3f52be33846f585fa916b03a2d669a4c6f27c35769a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834922, "uuid": "df86f7ce-6e8e-4cd1-8e99-dc3947c226ac", "comment": "Malware payload (Mirai)", "value": "7daf8f338a7b8845b142ab8f2b277a0b702df05f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763834922, "uuid": "eaa1875b-78b0-4e3c-a498-acba42c0b665", "comment": "Malware payload (Mirai)", "value": "2efbfd1c7ef83a2f0af0f41623cbd646c906cdba7be5359b17ec1f63805626a9e1e29f7f972169858e45945defefff86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834922, "uuid": "a842b53e-5220-44b6-bb77-f6297a7203c0", "value": "T174146C92BA6E7D7BD2530F3FC24357543F3CAF424A012927A06E628729BB6914F17309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834922, "uuid": "f07a588f-109c-40ae-89a9-fc4c7387e539", "value": "3072:oeQha4ZvjxMp+EC5YPjjj3yu/TvOCx4/cQo+MAn258tRAeLfSp:oeIZvOp+ELPvjygvOCu/clDF+Ae7Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763834922, "uuid": "6a5b5405-8e0e-422a-8aa8-4d9ce73cd446", "value": 200616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763834922, "uuid": "83942672-947e-44da-bfe5-16a04611f856", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763834922, "uuid": "c217e13d-ee02-4b11-9bd3-2ed80b0369ea", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923d5b7b-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829464, "uuid": "3380eab7-e28b-4781-b577-0ce516eb38a8", "comment": "Malware payload (Mirai)", "value": "03e661bb4e97a8e332e6295cbcfdd2d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829464, "uuid": "ae0a5950-c1f6-4457-9d19-790fc6e84da4", "comment": "Malware payload (Mirai)", "value": "9211415f3f3a2932197bfb0e88b2cda7ad4435415d8cf8df98b14445316e91a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829464, "uuid": "b9f489a1-93a5-40f8-851d-d05923584fc8", "comment": "Malware payload (Mirai)", "value": "310a51292f1609c5817d6cfd640f33a95160c97c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829464, "uuid": "b7c320b6-4f25-4999-b282-646696ccf2fa", "comment": "Malware payload (Mirai)", "value": "5573c0fcd48b814840c778d69389c5b245a54e22bf1ded5b68d4c8b8de890a2e54b1c5edd249b463862cef697ca767f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829464, "uuid": "8914adcd-b461-47d7-8d1c-ec4cbcc23e1d", "value": "T1E1F35C02731C0807D1572EF0373F6BE193EFD9A221E4FA41654FAA8A9176E72154AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829464, "uuid": "39d14da8-fb41-441b-a6bc-98dc225e60f9", "value": "3072:XiipxMxKSK6kXIto7iKJ+gasxWpMueXS6madSLK:ZCYxGMueXDmacLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829464, "uuid": "8b0ba840-17b1-4034-b69c-72654832268f", "value": 169532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829464, "uuid": "e826c744-fe7c-4ff0-9123-fba41d3abaaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829464, "uuid": "997f4baf-d1ad-40fa-aa3c-dbfca4d7f56b", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4099c2d7-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852949, "uuid": "813063a0-b6fd-41dd-a0b9-195ec2f8cd83", "comment": "Malware payload", "value": "8141cd2c93ff198a0c09daeaee168869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852949, "uuid": "1e53f259-e975-4181-9acd-e2a587c862cf", "comment": "Malware payload", "value": "926ef1a9ac8c380b53068b2eda7a1cf8e15bd661b24a422276051debd979af17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852949, "uuid": "44a76020-0d39-48e6-a7b4-7a371f7ef456", "comment": "Malware payload", "value": "b9e5bcfa300480944efa58080069f58c60e13ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852949, "uuid": "cc658cd2-06da-4917-8ec4-66de4d6e946d", "comment": "Malware payload", "value": "ca4635ca8b3154628f0510c6148932c4995f5c97a4a88cdac8ece8793603903aab338c6f67fb4df0fd700734cb2e7b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852949, "uuid": "c8e07ea3-aca3-4f97-a974-5830e61da78c", "value": "T1C276BE02BB988F83C8DF1BF650751384FBB1E516D352A7CF5110A2E86CA23C54E56ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852949, "uuid": "b7969a3f-6c6b-4486-80c9-67faf4495f51", "value": "98304:Ae84UE0yq6XDe8i3Zdu14rMTQektKgUOX32yn1lrG6PnSE:AoUESpdfeOUg35riE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852949, "uuid": "7f684929-093b-4b78-91f3-2dc3beeb371a", "value": 7815464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852949, "uuid": "2c9127e8-5fd4-44bb-8d1a-4e571374f268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852949, "uuid": "e488e9b3-3aa5-417c-bbb2-5d1547291088", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49982ed5-c7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1763816887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816887, "uuid": "ba15279d-91cd-4ff8-972c-632e1350d2b9", "comment": "Malware payload (PureCrypter)", "value": "5e29d27426a99ff8dd44d62f642304cc", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816887, "uuid": "9cae0fe9-d6b5-424d-ab88-eb6b66fe7632", "comment": "Malware payload (PureCrypter)", "value": "929768a1e0b02f4cb4625c3fa4bba44dc599eabbc0e8f5c4b0ff1fd6639df642", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816887, "uuid": "3f4636a0-d5db-4ae3-9c7a-dc8111680679", "comment": "Malware payload (PureCrypter)", "value": "86d8c8db6239bd6c10e9f7aef0725fa18df0b474", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763816887, "uuid": "755c7d78-82f3-47c6-bea4-e3016af79348", "comment": "Malware payload (PureCrypter)", "value": "6f543d795cb04518d3feda51dba11bbf07bddb63faaeebfb9517dad55a8eee86011b0d8c126fe79569308978e2968fd4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816887, "uuid": "9a982d2f-e8e3-4eae-a1f0-c5c76b6b1f80", "value": "T19CA633587B72B3A6C37AB9316A95722063FFDD7C8580131378CA4E5D4B0B291C9A7BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816887, "uuid": "742e68bf-90f0-46d2-a4a1-575c23e04108", "value": "196608:RTV/XPQaFYhS42XpCXKW+a+9FAHeDUz9z9Q73bSc3aDs:D/Xo4Ys4CMXKW+L9oGK9z03+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763816887, "uuid": "ec30b1c2-4c5e-4ccf-aaf5-b322834dbf7b", "value": 10399744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763816887, "uuid": "443c37c9-3438-4b5c-bab0-36c5594519b1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763816887, "uuid": "ce6642ee-9cf6-45da-bcf0-2b9d957c6029", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4200374a-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852952, "uuid": "993ecebb-6b80-404e-b160-3f005d538d3d", "comment": "Malware payload", "value": "3951df4e8619f683e0c7020425d0e7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852952, "uuid": "baf89a59-f98b-4b3d-9c21-b689afaad72c", "comment": "Malware payload", "value": "92cf26ac4fbce70f5e2b65dde547bd27e45d923dcf51a70c9e073024f671969e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852952, "uuid": "3d1deefb-23d8-4166-a0d0-118b0200aa3d", "comment": "Malware payload", "value": "fc2292e5d8a64265da710c89d5b6730a15df22cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852952, "uuid": "ff78e8b8-6a5b-46e6-bc8d-2633c5dc3e8c", "comment": "Malware payload", "value": "85d99a5c8ba68c69f18ff26abcd62c2e050bee35191d87e3f5c89fd334a0e554d84308c74f68416f748b83df91da25a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852952, "uuid": "3c018867-a2ac-45b2-b505-1b98ea917a19", "value": "T11F76BF02BF948F83C5DF2FB610751285F770E207D766A7CB5100A2F8ACB63C45D5AA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852952, "uuid": "29125b64-07b6-4209-ab64-b270dd97fa01", "value": "98304:GEe84UE0yq6XDe8i3Mdu14rMTQektKgUOX32yn1lr2TtFj:XoUES8dfeOUg35r2TDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852952, "uuid": "f00d659c-15e8-4b13-907f-8287d5e62dbd", "value": 7814440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852952, "uuid": "97da75ea-2cdb-4ad6-9571-c897a6e59780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852952, "uuid": "5a145ddf-b67a-4ac8-bf06-58944a6b9ac7", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732cfd2f-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829412, "uuid": "26640f8a-fe0f-4964-9584-afde9df1b1fd", "comment": "Malware payload (Mirai)", "value": "dfe08de9e9abbc255050011f222d7b0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829412, "uuid": "30fc42bd-276e-4f39-be50-cef602b199e7", "comment": "Malware payload (Mirai)", "value": "93a1c252d10d76024a5d488f92658d0f9cd32dc0ad90ed9ed64b26bcb93194ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829412, "uuid": "5d25dd45-80f8-4ebe-8bbd-d20b2e6a26e4", "comment": "Malware payload (Mirai)", "value": "0e6a2f00e12b8eed62290b0d5e8dfc9e787a6c8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829412, "uuid": "42bd33d4-7ffc-42f6-9651-882f3580af36", "comment": "Malware payload (Mirai)", "value": "021a4b9b6f8882268a11691b8c057671adbec36acef8d350d7fd868f0082e20167f342f3506a3c1d7312511de3eb5b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829412, "uuid": "5cea9202-e812-417f-b7e8-f6c7ae5e33e3", "value": "T14233F131856B1289E23C513D04AEF71E04C9742BA74D81F783E8919FA5EFFA9292418B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829412, "uuid": "895d8ac5-edaa-41f4-bdfa-fe76212541b8", "value": "1536:U2bgyKRrB1Q1qgWvhe1rDjODj7r3o9rwhQRDVgnouy8tyH:UxR/Q6uqDj7IVDeouti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829412, "uuid": "87998d76-4aee-4c3e-872d-53b954b14320", "value": 52928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829412, "uuid": "5e67d134-684d-4175-af16-ccb37528f515", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829412, "uuid": "7ca3364c-ef4d-44ef-a554-3ac89c7ec9e7", "value": "Polar.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b2c125-c794-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763810122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810122, "uuid": "de957d4a-1512-41ea-8c4b-e9705c5da261", "comment": "Malware payload (ConnectWise)", "value": "75dae460f5e56bb993b9bdfd7fa49097", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810122, "uuid": "3338befe-bf4d-4321-bc98-013f698c9843", "comment": "Malware payload (ConnectWise)", "value": "93e4fbed69c23ab3e4262e39f0b2409fc692cbc57aa68c72af94fdfd3c71c482", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810122, "uuid": "f9c15500-b8e0-4857-aad5-6a834045fba6", "comment": "Malware payload (ConnectWise)", "value": "cbbd1ddf3aa5c3888665961e48a5eac72bedfa36", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810122, "uuid": "793fc2e0-f78d-4608-81da-e9b495a470c3", "comment": "Malware payload (ConnectWise)", "value": "4a5d94d638a26a24bab53cbb8df1fdf77a653459e89dc94a402540a0119e2431ea673508bd57fa79aa44ffa5d4a05c27", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810122, "uuid": "cc71e1e9-78fb-4aaa-905b-0a834d6ff16b", "value": "T1DD56F101B3D696B9C1BB0638D8799269A774BC009316C7BF53D4BD796D32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810122, "uuid": "4c04687d-99e5-4465-99ec-ad19607f452d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810122, "uuid": "d86cb370-f10f-43fd-9819-9870b9571593", "value": "98304:sGs6efPMjb2w6LeJR+WJ0dX2DSQG1oqryAqqlDQg+lo5:NfefPMjb2w6L4Rr0AP0yANlDdn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810122, "uuid": "e243091a-cf3b-44a1-a2f6-79124186d0df", "value": 5979944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810122, "uuid": "e637a197-d5ab-4693-873d-90573b37a5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810122, "uuid": "ce880aec-e3d2-423e-b7f6-c5f4639e6558", "value": "SysConfig1753373971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f64aa61-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload (HakunaMatata)", "timestamp": 1763853511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853511, "uuid": "baae6449-9283-42c2-9c51-b2ccb5af3ecc", "comment": "Malware payload (HakunaMatata)", "value": "a3c278f58423f1d9160950fd13397bb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "hakunamatata", "colour": "#A7C5F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853511, "uuid": "6b5280e9-b195-43f3-83c6-20d7eef2dab3", "comment": "Malware payload (HakunaMatata)", "value": "95027bddec8e2f6724437e2b95d2ddc8c9f66841ed93b7ac50061ff4a59f16c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "hakunamatata", "colour": "#A7C5F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853511, "uuid": "828c06ce-669e-4ddf-8580-5f12ee651c86", "comment": "Malware payload (HakunaMatata)", "value": "2be182ebf3e88ef1268a9465bf8c250883b7a374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "hakunamatata", "colour": "#A7C5F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853511, "uuid": "9589f004-394f-4699-bf23-3fcfbcd0ac5a", "comment": "Malware payload (HakunaMatata)", "value": "d800043f47a8b379b88df747fd1389b09411011865bac616294d348b3901c8b8015bffa23eb6c8e0a36739e3d65faebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "hakunamatata", "colour": "#A7C5F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853511, "uuid": "92fd4160-13e1-4afe-9c19-4fa393af281e", "value": "T1F583BF497BDC4B35F46D4E388AB782A11734BD65D819C38B66DA400F1C733889FE26AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853511, "uuid": "ad100947-7f17-4bb5-9e0a-8a3547deb164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853511, "uuid": "f0c0e1f0-7759-46b2-ad53-7838f222480e", "value": "1536:vRZmoDGK/FShIPoANJLlAXuSXv+qSFEAeOF:JX/khIPFJRAhP2EAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853511, "uuid": "4fdc76f6-0aa1-49bb-b2a3-8fe610a0b960", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853511, "uuid": "a2f151f6-a54e-490a-a012-0bd0298a2edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853511, "uuid": "65bd0fd0-d989-4340-87a3-5a4a07cef319", "value": "WmiPrvSE.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ea367e-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829472, "uuid": "9f73e0af-4f46-4db1-9972-888d258a50dd", "comment": "Malware payload (Mirai)", "value": "6cebb3365bef4f16b321e24f96878e6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829472, "uuid": "b0fe20e3-fe60-4d81-a668-4f9028552cf4", "comment": "Malware payload (Mirai)", "value": "9527af4e0a87c9f65d4a4033667403d351b119beb34006b8281da84786091ebd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829472, "uuid": "664ed71c-b8aa-498c-ba9f-cbafaf6e94f1", "comment": "Malware payload (Mirai)", "value": "5802e59cb96f5729c3b3ec0da5ce63245b5f9400", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829472, "uuid": "dce62b14-c031-45e7-97f0-18d1dc5e59a9", "comment": "Malware payload (Mirai)", "value": "10871b2137a0753b9062c13dab4c98ac0cc522ba2e671e93ea700bc549bdfe39d9da267b34396a8c0e8c1e54feb664d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829472, "uuid": "0379ecad-5ccd-4e7c-b73e-499a4d98e14e", "value": "T1CFF32986F8D18E16C5C212BFFB5E418D372A57A9D2EA3103AD265F20378746B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829472, "uuid": "0753d0e4-1ef8-4cb8-9830-530fddd35476", "value": "3072:p/pb+aXEoq9iVOrrSHLlCM5Km4hdg0KYigaaVUcp:p//XEoqMkrSpRAm4HgXYigXVUcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829472, "uuid": "1cdddb2d-9746-4cad-8880-328db117888d", "value": 167648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829472, "uuid": "e781168d-3d9f-415a-a3c7-f1117ad31b26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829472, "uuid": "d19f4e67-db55-4a2b-9bb8-b4a27f3857d5", "value": "Polar.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6c82a6-c7f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763851414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851414, "uuid": "1d602b23-2197-460b-acfb-a18b322d90d5", "comment": "Malware payload (Mirai)", "value": "f7ed1f624186dc44e209490e5bd3b253", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851414, "uuid": "fff8fe9a-e032-460c-af5b-8292cc00c7bb", "comment": "Malware payload (Mirai)", "value": "95a174a46be479869c331d7711b8848447451910c1e8b744fb46fc1f91cd2cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851414, "uuid": "28775776-792d-4d31-a5d1-28e568b66f5d", "comment": "Malware payload (Mirai)", "value": "9e33bca7c21a84c94162a8e6bb87ed1a2812a311", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763851414, "uuid": "2f0f098d-aa1e-4443-8a1d-e2647cc2c8c8", "comment": "Malware payload (Mirai)", "value": "160463f6bb22445c9aa99e01fddc7f86f0ae11edb0ac4ea3b87f702e9122ed954ca75b9b7d90afcb16ba0a1450d94c3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851414, "uuid": "23059768-80aa-44a9-a631-03f297be420a", "value": "T153E36CC9F383E5F6EC5609700177EB32D972E63A312EE981D3B8EA35EC12541C516A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851414, "uuid": "0915872d-433e-43d4-b4e6-532b305332cc", "value": "3072:SfxIcsIRDgX99UIkWXhM+GuvNk6+IJnvh3L1:yxIcYwI1Xhs6P9vh3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763851414, "uuid": "f6c716a2-19f9-4cb2-bc75-efc681dd2f26", "value": 154152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763851414, "uuid": "9ecd64a0-9d44-4ed4-8f1f-20a91108eea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763851414, "uuid": "e76ea097-3bf4-44b4-ae17-ec30afd5c505", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e2f924-c7fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763854844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763854844, "uuid": "83931717-edf2-42de-8e0c-57abf783190d", "comment": "Malware payload (Mirai)", "value": "c1394a845feb8c4221cc4f53a656f12f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763854844, "uuid": "ad122914-e63e-45c7-a812-52317e82e90a", "comment": "Malware payload (Mirai)", "value": "95d5a7593cdc8ce89777e467532b8da3517b0e0a73f7200a2b4d77476e0881dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763854844, "uuid": "f53efeab-ef8c-4590-a3e5-743ffbd2c565", "comment": "Malware payload (Mirai)", "value": "e0285d825e9352474bfbcfa3334fa2d49af8b766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763854844, "uuid": "c45a482a-8d95-4557-a917-cffe4f1c6cf5", "comment": "Malware payload (Mirai)", "value": "43faec43618b78ee695db70491fe45e316ebeb8cb6702421141ffdd4015cf218656ecc76b6bd9bb29b3f7cbe9ecff528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763854844, "uuid": "c85a0e21-ad54-4e74-96c3-b38dd1b40144", "value": "T133732946B8819A13C6D452BBFB5F428C372653E8D2EE3303DD256F157B8A81B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763854844, "uuid": "86ca44ef-b17e-47cb-ad47-b13c5e3a86de", "value": "1536:ahDW9xRkiWPdaqgHIm9y6r1yE6C6/Sfh5eVF08yug7Rk8:ahDW99/Bom9br1yE6C6//Vyug5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763854844, "uuid": "6e4d57f0-cc27-47d1-986d-ff043bc22b11", "value": 79376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763854844, "uuid": "92a0b7d3-fc45-4aa6-83fe-07638f9be6bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763854844, "uuid": "fe6c9104-b4d4-4934-b513-1d5a3385560d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1806689-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855394, "uuid": "f54f5f25-9493-4640-a17b-2ab66c4b058c", "comment": "Malware payload (Mirai)", "value": "1b62416104e9af48aeba25a2943ec1d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855394, "uuid": "6f0469fc-f544-46ea-969c-e2055caab366", "comment": "Malware payload (Mirai)", "value": "960c407f3e5b988a4ef0f7e4d980debe33172d1fa79f7695c154677029ef9caf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855394, "uuid": "6df1f49d-9977-44ac-8e53-748ae9ee08b9", "comment": "Malware payload (Mirai)", "value": "bd0f0498f1a20f668f4ce9e5adde1e4611c0b513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855394, "uuid": "9c462931-f472-47e1-842c-274358b2c689", "comment": "Malware payload (Mirai)", "value": "71b6630aab398d16c04f33f580d740e644c329127a60a4521b880e7ab4ea627356231f85b6ee1d7bf0ab1c6a6b332e09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855394, "uuid": "aab2be28-68fe-4a62-b211-089359554e98", "value": "T169B3C85E7E218F7DF7A8C63047B34B21A35923D626E1D685E26CD9041F6138E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855394, "uuid": "6d56c3ba-2e58-4b73-854d-dae013f6d266", "value": "1536:jTtgHlCSYhqbLLqDridBiNZVKCNrx39W/RGpYTKGNeRL1HDJ7ABfNL:qH8Ob6DDVKCNrx3qRG6LOt765", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855394, "uuid": "16bd6293-eabb-42f5-886f-82acd5beb220", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855394, "uuid": "b892b333-cdbf-4f60-bdce-fc41d4a41de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855394, "uuid": "436f9695-d44e-412c-82de-3512e9b56614", "value": "Labelloperc80.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e8fb45-c7ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763820726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820726, "uuid": "147c2dba-d04e-444b-b947-955878d387cd", "comment": "Malware payload", "value": "5b71d378b0c36e4f8dbc6d2bda47a733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820726, "uuid": "f3762afc-5d5d-482a-8dfc-332cb239927b", "comment": "Malware payload", "value": "97858b4df05b58b93a33bc63a3eaaec53e49ebaa6b59d4a1762593d3ab2ff0ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820726, "uuid": "84fed545-4090-499f-9e9f-477fc1e3cf68", "comment": "Malware payload", "value": "88edf0dbeef6b10bb41660059222efb825288e70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820726, "uuid": "58248af7-a15b-47be-bed5-71d22d2e06d3", "comment": "Malware payload", "value": "0cf95f8759af4e25d2d214b775fd36b099fe32ac0c5114621ec7088d98d4e241a585b537ea7087312d3dcedb7834a1a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820726, "uuid": "a26fb903-8866-4aa4-bb34-8f6302a1c903", "value": "T13ED50123B2CBE53EE06D4F3B05B6B24954FB6621A523BD5786E484ACCF260601D3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820726, "uuid": "dcbac7ad-6809-4611-9b87-be24fa81112e", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820726, "uuid": "ac7b6a6d-1148-473c-b45d-9762393c2d48", "value": "49152:mwREDDMZEh5ctmWmIgepzBhbs8koKxOTZzA0F+8w2LX/mrvcTbc:mwREWs5ccPcpzLs5obdRF+nuX/mrvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763820726, "uuid": "dcd29cb5-ae24-4c0e-ba06-f527e0715712", "value": 3012590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763820726, "uuid": "6cb29060-84bc-4da9-8bc9-ad6f58eca3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820726, "uuid": "ac210fc0-bd1d-4533-bdc5-2b1ebd9e3717", "value": "greeff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8ecfca-c764-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763789642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789642, "uuid": "efd12f5e-30a5-4446-81e7-6163f53e10c6", "comment": "Malware payload (Mirai)", "value": "e8b3ae4508e72638b5c5aa2cb2555e8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789642, "uuid": "30894dbe-1f80-45a0-b406-365de723a77f", "comment": "Malware payload (Mirai)", "value": "97fd6e21fb8a3910f2440cf737355e007e24b951ac0cf423328061ef117e8d32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789642, "uuid": "a6f63fcf-8e3e-4481-a85f-bbd169a3a142", "comment": "Malware payload (Mirai)", "value": "cb6c5591bda44a57f736eec928cd7c59d08cd8f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763789642, "uuid": "c376eae8-4384-48f2-8340-060556eaf0e4", "comment": "Malware payload (Mirai)", "value": "e13ec8938e2cc69cc709108d642acfd28a63f37ba74da83cb963a85bf4d644228a4abdec5182b543527395800243a0be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789642, "uuid": "69c6fad4-e03c-4300-91eb-7324780aff8b", "value": "T1D4831241481C4A3FFC8379761154A7EFFD42F66AB84F0080B850ABC755DA8CBCD6E4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789642, "uuid": "f74e8d1d-2026-4960-b492-26d32218d867", "value": "1536:J+RPNv2SM+P+2XJ1mrxVCrn7YxoGR5/aXwGcoh6kGHR42JRW0/:URP0SVPBX7miTMuQ5wwTE6kGHR4Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763789642, "uuid": "be55c619-14cc-4652-9c39-2461f42e8ada", "value": 82948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763789642, "uuid": "3eab9c59-0ef6-4674-a1ff-b8d2f1336aa6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763789642, "uuid": "da7ebbd3-e6fb-4e53-92ba-ffbef0059c60", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a132058e-c7fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855688, "uuid": "922f203d-fb38-4ad4-b8b2-4ffecd9999b2", "comment": "Malware payload", "value": "a783f2c9657268deb95b73b6050f5e3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855688, "uuid": "bc9dfea8-99d5-4046-8e83-4b588c0166e7", "comment": "Malware payload", "value": "99499e93fa0bb9f32426c7ba42b7c45c4c56ff8f2bcf704ce06aad3e94d00dc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855688, "uuid": "342c8d36-bff7-485e-919d-52754ac9e1e7", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855688, "uuid": "d9a32657-8db2-434c-9d9b-b9e7e57b3035", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855688, "uuid": "b82a37e1-a8e7-483a-9426-547d2a33a871", "value": 60156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855688, "uuid": "0c70ef60-43bd-42a8-a051-e57bff65771a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855688, "uuid": "53603751-9037-4ce6-9a81-d5329643e63b", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30625246-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763850775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850775, "uuid": "6131fda0-7a55-4a1a-854d-a2e2bd436fb8", "comment": "Malware payload (Gafgyt)", "value": "b9a5ea51e11711f2d37dd3ec0d1d8c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850775, "uuid": "1018586c-9598-4b0b-9d81-acbf7eaaf462", "comment": "Malware payload (Gafgyt)", "value": "99869f7dfb5d35b4be855e537d97e9e1a950775f8f5852d098b703b95cc50b1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850775, "uuid": "b011dd2f-e00e-44de-bdd5-6de1350a3ca4", "comment": "Malware payload (Gafgyt)", "value": "367d6c5cd89ecd0e0269adf98c3cc20d5bc0edfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850775, "uuid": "e0604d7e-04a4-4cdd-828d-31cfa706ab86", "comment": "Malware payload (Gafgyt)", "value": "fa467477cf4b4e62df60d17a287fedcfd0ac2c9169b32d3e164d6652875a52b40cbd7ce925db432fdafcb83c5a3ac5b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850775, "uuid": "7f6f2883-c5fe-417c-963a-10a37fd10604", "value": "T139A33B05FC444767C2D327B6E79F434D7B326AA457D73301AA386EB02BC1B992E39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850775, "uuid": "e9224fea-590c-491b-a6bf-5a18134c4d39", "value": "3072:++/Cy4F0oZKWb5h/Qeh4EmFmDQFdC8X30j:+O4F0Mpb5h/QefmFmDQFdC8X30j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850775, "uuid": "1f29810d-0b13-4be4-b39b-4d46819ff991", "value": 102048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850775, "uuid": "4726dbfd-d5ee-4119-80a4-84da3e6ab448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850775, "uuid": "30700b6e-5ee2-4e37-8dd2-d6a51cf09da6", "value": "Ayedz.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988f4887-c75d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763786525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786525, "uuid": "9b0da5ab-9e24-4fe3-85be-c793403fe8fb", "comment": "Malware payload (Mirai)", "value": "beac8f38aa88e554ac1d95575c7a0a4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786525, "uuid": "180bfcab-9801-4db3-98ac-a2ef94e30d9b", "comment": "Malware payload (Mirai)", "value": "99ffa905d34dcfbbcc2042d08e9374446a610d0a8a027dee6f35cb9447a23f35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786525, "uuid": "670788bd-e50a-44b6-8685-b08fe4642b56", "comment": "Malware payload (Mirai)", "value": "877c933c2c60553e5efcab85e736e776b65d5dfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763786525, "uuid": "af19dfa4-e410-4b51-87d2-2576ba3b9155", "comment": "Malware payload (Mirai)", "value": "fd07f6fa18d0bd800801eaf9beda8a046517bf49d41c1814ccb2028ac957d7f55237472ded8aed2612fd72c202eb9eda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786525, "uuid": "f74cf1d7-4e39-4e72-b1df-15e39f53b5ea", "value": "T168934A52BD81CA12C5C562B7FB1E428D772753FCD3EA32038D226F61638A96B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786525, "uuid": "0d2950b7-dd17-4a02-98ac-c66d808bb1da", "value": "1536:4dJhsyCj3o8EIE55dxSfHVpEZBj/D3DJoLemA:4dJhM3FW5X2HVC/rDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763786525, "uuid": "79b2f9c0-6a7e-4189-bb94-067a4469f171", "value": 91348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763786525, "uuid": "cb43f982-0860-49a2-9e0c-8b7c2b44b6f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763786525, "uuid": "ba242fd0-36f5-4286-bf09-58d0cc70daaf", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b001b7f-c7fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763855087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855087, "uuid": "9003cafe-0788-41ea-947d-5c4bf396c545", "comment": "Malware payload (Mirai)", "value": "0d682a9e1051ddbd88f8d75529a92736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855087, "uuid": "f728dedc-2a42-410a-af75-52021fd388aa", "comment": "Malware payload (Mirai)", "value": "9a99b3f76b0fbfe9f87ac5ff40cd7a1cbe4acdc7c86cbc689960ceb3e27d1986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855087, "uuid": "ba2cb88c-4640-43d3-af0f-1e2e37d49a5d", "comment": "Malware payload (Mirai)", "value": "7f2e678e9a6dd8a9aa64986c1b7c16828d697b8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855087, "uuid": "168e8aa4-5118-4bf6-80fe-1dba62be80e5", "comment": "Malware payload (Mirai)", "value": "0ff278f8425470c6832296ff1326ff8089fd252a3f788659f8342275d6eca567ad4fd0ed8d490a3335212aab3926bd2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855087, "uuid": "c4cf1448-53fa-4b1c-a8d6-c6dc647798ee", "value": "T14F734C42731C0A57D1A75EB0293F17E193BFA99011E4B789780FEB5A82B1F32514AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855087, "uuid": "bdef3811-b328-454f-9704-f21edaea6619", "value": "1536:VUgF5BwCD3A2AME7bZR/+JVtd7ukFKbTwgxug7RKv:VUqo2fEXZIfukqTvugov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855087, "uuid": "a9a7af84-5fd7-4f30-a35f-9cb57085466e", "value": 79108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855087, "uuid": "f8d16568-986e-487c-807c-ece7d308fc87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855087, "uuid": "342d818e-76ca-42d0-9548-21c2e1cec042", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0fe5b1-c7a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763815492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815492, "uuid": "3a962120-f6fd-4b37-bc39-8dc92fa073b9", "comment": "Malware payload (Mirai)", "value": "2476de98911fad458c65633b74597169", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815492, "uuid": "f34d8830-2f65-4639-aca0-c12ff540d1af", "comment": "Malware payload (Mirai)", "value": "9b75ce8bfdded14098b580127ccdc639fb41592a02e9e92b634f0bae49556771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815492, "uuid": "2909f10e-5b37-4161-9f16-8e074837f094", "comment": "Malware payload (Mirai)", "value": "8d73243c65f96e027eed98a4ace892ebe7554ffd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815492, "uuid": "3253f3af-1b02-4c55-970f-c7861e2cbf6b", "comment": "Malware payload (Mirai)", "value": "219f064803666fec20638e30733608615b9c65b4b122be3d5570b4911cbe82e86870b8282016d688fa3dfae20eb234fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763815492, "uuid": "b20127c0-ae8e-4a7b-936f-ad0833e73100", "value": "T1AE837D02B70C0953D1771EB4293F27E5D3EE9A5122F4D548380EA78E91B1F329686EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763815492, "uuid": "4eb74a1c-fe12-4e15-837c-85f8b4e1b25f", "value": "1536:bvTkHUpXyHIrbKJcbAUB7xVmqSUd0IbYbHDxlscT5+ZnxBGN:rzcKONUZx4A0I8zDkcMZnxMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763815492, "uuid": "e3420ffc-a40b-4e3e-b690-e78f37a66ea5", "value": 83492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763815492, "uuid": "83f31f35-ba26-40fe-84d5-8f58b268d75f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763815492, "uuid": "e1288126-0984-4b03-a50a-48f244bdab7b", "value": "uppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070fdf1d-c7d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763839538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763839538, "uuid": "e3df6414-5450-4218-b95f-d5d45ec1c2c4", "comment": "Malware payload", "value": "d156f602084db5e8c7ae1dd3a1f5220e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763839538, "uuid": "3afebf8e-464c-40df-b04b-2c5fa851fbbe", "comment": "Malware payload", "value": "9bd052991737957b0e030c9928759b0e54c504275122df16b0cc6521460167b5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763839538, "uuid": "30e6cb66-5af6-4e23-8548-97e5ba228625", "comment": "Malware payload", "value": "b69c9fc39a82ad6e0ec0e7334535320669ccc6e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763839538, "uuid": "f735bb82-cf2b-48ec-b9c9-a3507931c49f", "comment": "Malware payload", "value": "78c350940fdc290c71458d3bd5774aad6399f22ed7649dca046e2ef563facc5ff3e3fdfbec61f27d879b529ea84ca905", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763839538, "uuid": "843116e7-e7f3-4edb-a02f-0ea01089cbfc", "value": "T13055231E37E42066E9B657F418F306CA5932BD625B2587FF22C9D27C0F232E065B1B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763839538, "uuid": "eb6dde36-3d68-41c2-8910-2375a08f28b2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763839538, "uuid": "0e77fa1f-5221-4ae1-995f-b8e15a46cea5", "value": "24576:UvyR/yZFYBXZRsYnivE5OEQ09QKt5wj653/kCZOp97P7Q01rb2D4b99BLAgwd9:xW2ZRsYosOs9vPZOzT7Qa2DC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763839538, "uuid": "00626172-3a15-4bed-a3db-9a9a8fe94708", "value": 1359984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763839538, "uuid": "4418d55b-139e-4d0d-9bd1-2aef759fd6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763839538, "uuid": "f40ba8f2-9ae6-4909-8382-982afaa29510", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489afb8a-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853392, "uuid": "f98a1c15-0f41-4e9f-a385-3d33b8903976", "comment": "Malware payload", "value": "2f4e3a84fc74cedf53a092a96b7773fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853392, "uuid": "ab4782f1-2703-4e3d-b517-d657aa6d86ce", "comment": "Malware payload", "value": "9d3cb6490c930f3c508cb015e83d9afc6d102396e78b42e4ee128d42912dfd2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853392, "uuid": "f5a5685b-9e49-4dbe-9187-0bd8a38fb4e5", "comment": "Malware payload", "value": "f982f355e4f4ac349898415d19a8b8951c840032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853392, "uuid": "85d27118-66ee-41f6-a2aa-d15598a6babf", "comment": "Malware payload", "value": "13c891eb9b89f9c13fe3dc0e5965f6a11d69d384bc11b941c220d26331c99d7e165b40426bc8335242197a7f86cd4d2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853392, "uuid": "23c728ca-2f11-49ad-8ab3-ba43338569f9", "value": "T1C114F7B3A014D595FDE89B32523A9D3AE937FC375DE86E5D7008B022C4B3B920D5192E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853392, "uuid": "b45e9591-f7cd-4365-b88a-afc5e2a7f812", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853392, "uuid": "45144625-396f-400f-af62-c2591ba61011", "value": "3072:VZaHGJNtrfbFXrOPkn/Knv2GgUTb4knLiEN:CmzpDn6+GgUTb4kL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853392, "uuid": "462596ae-6c90-4a18-8612-edb4adbc0b88", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853392, "uuid": "949c5e46-84e8-4f4f-8698-8d252f91ce9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853392, "uuid": "d07f4598-367a-424f-9e4b-227b9bf677f6", "value": "TGscreenshot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59d12db-c7b2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763823108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823108, "uuid": "4ccf5937-9f48-49a4-9542-8c75deda2e45", "comment": "Malware payload", "value": "be635ad69bd6ae9d2e36c9009dc1934b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823108, "uuid": "9a7c3867-d64e-47af-b914-987d8c90d38c", "comment": "Malware payload", "value": "9db702ffc7cbb28a5d06642b06b100f27a6ab2f3933b670beba1d0dee3d10c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823108, "uuid": "745af579-5a19-49b9-bcc8-bc5257f199ef", "comment": "Malware payload", "value": "2141ca36ce0a405f922df4a28423e1af1d0eb405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763823108, "uuid": "090f8cfc-d434-49d6-b071-6e5ae6cff5b6", "comment": "Malware payload", "value": "25321df3021cec7368ebedb9b6931b193f7c055f5e16e476ecd97ee5aa925d13efd589dcb17956e3a2742664d1684737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823108, "uuid": "ce98de3e-49cd-426a-b92a-35abd652c08f", "value": "T1BAB44A1AEEEC00E5E06A91B889738D01C77638653764DBCF07A4C9A6DF13BE15E39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823108, "uuid": "f8ef173b-6b43-40b8-92c1-308d0b56c3a1", "value": "6cca7e75b412649b6f438549de300123", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823108, "uuid": "98d16ad3-850c-4386-b4ea-f2e7c02e2436", "value": "12288:Ip59DrP2j8l+bbenla52Wals5FWULZRelLeRWfU:eZrP2j8l+bbenKals5sU8LeRWfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763823108, "uuid": "99866f4d-e156-4b17-bf30-bb24bfac7c84", "value": 505040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763823108, "uuid": "824fb75b-7fa8-4ccf-9313-4038b3cc878a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763823108, "uuid": "02ca6ba5-56e1-4368-9faf-2d7105779215", "value": "windows_notepad_v2_with_sign.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f84c7cb-c7af-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1763821675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821675, "uuid": "97332925-fccb-443b-9fad-3496ecb2d13e", "comment": "Malware payload (Rhadamanthys)", "value": "26ac2c4232a4ea8d63820830d54d715a", "object_relation": "md5", "Tag": [ { "name": "176-46-152-62", "colour": "#2FF8CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821675, "uuid": "714fa5a5-85a5-4a15-8335-1aa7bd8ac661", "comment": "Malware payload (Rhadamanthys)", "value": "9e072e908725c84d710311124cbb82f59ca5ef5658014385e8fde7237cfee983", "object_relation": "sha256", "Tag": [ { "name": "176-46-152-62", "colour": "#2FF8CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821675, "uuid": "c421d753-889a-4580-8079-9da6ad197a3e", "comment": "Malware payload (Rhadamanthys)", "value": "2baa4bd0da03fc0ca96dcd7213723a8da85fc7ae", "object_relation": "sha1", "Tag": [ { "name": "176-46-152-62", "colour": "#2FF8CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763821675, "uuid": "a07366b4-5827-4a73-a08e-408afd23e251", "comment": "Malware payload (Rhadamanthys)", "value": "b6d8af4b4709058a2b8e30e90016e2abd00eb0a787e34e9d17c879f143f74aa994e6c9614671bd9b4c6a31d6a8142c50", "object_relation": "sha3-384", "Tag": [ { "name": "176-46-152-62", "colour": "#2FF8CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821675, "uuid": "378e706f-f56b-48ce-8a72-64a645c4cebe", "value": "T102F36C5773A520F8E177C139C9920A46E772B8350B61ABDF03A0477A1F676E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821675, "uuid": "9e2c4c54-4261-4baf-bf04-8a537f4db504", "value": "23aa6ede111f6ac860a5e9008f9b9673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821675, "uuid": "f2a12b0e-66a8-4235-baef-64f8746f8565", "value": "3072:SBlWijqU87dGuWZKE7629VLbi0Xuv6GyzeO0DsbxmOnHH/Sa21jdGl:SBlWijqUqdGnoy/9VH15uO2WtidC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763821675, "uuid": "577eb772-a950-42f6-b4ee-7c9cf6a84919", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763821675, "uuid": "663ffc8b-24bf-430b-b98f-6ed8e5f10020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763821675, "uuid": "6784ae7a-13c4-4111-9972-4c1dcc979ab8", "value": "xQ4gNK9auvFo4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43feb4cb-c7ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763820743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820743, "uuid": "0a777a6c-b241-4621-9ad3-e2dbcd49d880", "comment": "Malware payload", "value": "c24e4d8f2c506388ae07f3e12fea7724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820743, "uuid": "3709a912-b76c-4780-bddb-c0c48ed47461", "comment": "Malware payload", "value": "9e169da4054cae5b459b7cce25e95d52e8f7658e09b4ee8f86fb9c14fff84c3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820743, "uuid": "da6d52f9-c3b2-46c4-a70a-a1e94527d31f", "comment": "Malware payload", "value": "e8a64f07c291f1af4cf4a08416b163ad0be154bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820743, "uuid": "6c088bd4-b08f-482f-b391-d58b6ffc552b", "comment": "Malware payload", "value": "42019a0964dadd7c4406aedf028726beaea9f54d4e2fc18f0ec0dc2005ed96697b1400f485b2790a72e5de32c22aeab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820743, "uuid": "762faf91-88f8-403e-b131-841472e9d7a8", "value": "T111F38C307281C072E997113189F6C7BA497EB8320B6565CBBBD50B7E2F602E18B7535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820743, "uuid": "eaf28ca4-7f19-4b59-bf97-f4f8b4072620", "value": "f77943c8d22695ea8ea634ac5b7c0801", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820743, "uuid": "70367003-6d66-47f8-9411-d60f75bab12c", "value": "3072:72wyDhBwZ9VEIosdM1g9jmoi+NexQURhv:72wyNBwPVE/Ujmoi+NuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763820743, "uuid": "247e742e-cce5-4d4e-b046-afb4ef35a1bf", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763820743, "uuid": "e8b9dcde-8daa-4a74-a92a-3bc40f6e238b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820743, "uuid": "01ca810d-6d2e-4be9-a302-63651185f1b5", "value": "output.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392a2ebc-c7de-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763841770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841770, "uuid": "d6488c56-349c-4be9-a1f3-10180912f339", "comment": "Malware payload", "value": "23b8683bc96d784154978e6b672ab058", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841770, "uuid": "dc45e4f7-2669-4c79-954f-f4cbfd760d2a", "comment": "Malware payload", "value": "9e65eca49315d1425c7d8a156202fdb0629d1557ed1102bc960991a34d565651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841770, "uuid": "30124c96-f100-411b-9de3-b08903b6c840", "comment": "Malware payload", "value": "e8a91d92b306a07fdde90ab39a47c2fb81539204", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841770, "uuid": "6ea50c73-225b-49da-a3ae-b086c0f2fb0e", "comment": "Malware payload", "value": "ce5fe42d39066ae9f5350e99e708f540b49367e26071a9aca3eb5fb27c249a906a818de86242fd254ca08ce809c13511", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841770, "uuid": "427cf8ed-4421-47e9-ab16-4b340e1a91a7", "value": "T18A637CC1DA43F9F8ED5616B0107BA3198E7AE43A113CDA51E7E46A71EC22F00DA1779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841770, "uuid": "286895ff-c7ad-43f8-a918-48ead80566e0", "value": "1536:aNLdzOgLgeZY63Ry88HEvoi0efKErtnCp:ahdzOgMeZYLXEAixKcCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763841770, "uuid": "c1a87176-131d-4e85-a781-5cc640e33703", "value": 70924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763841770, "uuid": "a6a46997-5c6e-42b1-aec5-c055263e5cf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841770, "uuid": "5b8a861c-542f-4667-96e0-997fc8d3e721", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41926e3f-c761-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763788097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788097, "uuid": "524666af-6999-4f6c-b6d1-b0b7a12d21e7", "comment": "Malware payload (Mirai)", "value": "4eea8d653aa00115d510474a5737ba51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788097, "uuid": "ad02cbf1-c0d9-4f03-b9d7-b34fda5e3a68", "comment": "Malware payload (Mirai)", "value": "9fe41548f51d3c8f0359562bd8230b3e5637f577ec0f3d314662e9985d0fcc6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788097, "uuid": "a76ed4c5-590f-433c-b413-a92a51823c80", "comment": "Malware payload (Mirai)", "value": "c8cfacd283f6c963ccc6a39ec9b8baa788d70952", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763788097, "uuid": "e77205fb-f453-4a05-a537-a050a111f946", "comment": "Malware payload (Mirai)", "value": "483aab70db5eecb80d26ac8e0601e0e3f8b09266607571bc8a16f533563d85f7edf4e35e0a29fc5a1a3c7c5abb5e7453", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788097, "uuid": "5b6fd423-bb1d-475a-bf6d-3582af774a27", "value": "T119A3B087A260BDAFE4546D3F85038F36BA159F640F832B25B0BDF990663D3907396D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788097, "uuid": "82409cb2-d526-48c8-9c30-20ba6723495a", "value": "3072:MCCIGuAtf3GkW0HZFy7z2clez2ClvIYUSW:wIPQf37qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763788097, "uuid": "470d9ab1-380c-49c0-8b11-7041b8225f69", "value": 106968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763788097, "uuid": "9827c42f-03c7-405f-af10-c17ffd7dbb83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763788097, "uuid": "3ae2e212-a0aa-43da-85a0-cae6560a5a7f", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de85f75-c755-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763783044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783044, "uuid": "eb143372-7572-4bfb-ade6-0274b22919f7", "comment": "Malware payload (Mirai)", "value": "6448ba970b4c9c0534cd6c44c5454e7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783044, "uuid": "a3bfa4b7-a91c-4f50-9ac0-e12f7bce944b", "comment": "Malware payload (Mirai)", "value": "a140a60a86ad970055b153978dde4d89c76beccd4df2167ad610b5c462ef01b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783044, "uuid": "fe1cefd5-da1b-47bb-8921-87c8307719f3", "comment": "Malware payload (Mirai)", "value": "bf62fb7d0b361c36ba75c1082bff0aa4f30f5391", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763783044, "uuid": "93030104-a345-465d-b552-586d45e38ec3", "comment": "Malware payload (Mirai)", "value": "a286d43b77cc1324c81f5b0da08830a4d360eb1bf528c3b5ae270fe263981c1c21ceca9a9a9cf5ca76316fdb374ab942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783044, "uuid": "a616bf75-4550-4170-bfe6-86667b3963f9", "value": "T1EBC3124590C42B64F3148A3F86D976DAB519121E6078FE706C79EFB883EE730C453A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783044, "uuid": "8fb1af9d-6c0a-410d-8c93-5d678df19c6c", "value": "3072:yP3YaaFi8Qunt7rbUnxbozlSSEnYVQZRuv9qFheZdao:yPIay9v7rbUnxboxSSEYVQa9SSao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763783044, "uuid": "d01aa8cf-a2b5-4ce6-9977-0d86095cd8c7", "value": 129700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763783044, "uuid": "2c0081f8-18bd-4bfd-be52-82dee44df336", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763783044, "uuid": "b062eab6-578f-4722-b961-18caf80392cd", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d591f843-c795-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810679, "uuid": "5aa40b83-c347-4652-94c0-73639726410d", "comment": "Malware payload", "value": "8a6d715d998459360a3a230711bef80e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810679, "uuid": "4732967b-c455-4dc1-83df-ff337e7e57d9", "comment": "Malware payload", "value": "a1e2620cff9e1612e0f50d13b3d9f0295079cd4e7b6b8a338a3a39aa8fd2c7c2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810679, "uuid": "89dfe91a-64e5-40c6-9cc7-07ffbb6e1d7f", "comment": "Malware payload", "value": "2ec60b598afbf860f633bec88e906e3bd71b9929", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810679, "uuid": "3618a991-4113-4aea-b1dd-4d9d1b5a1dc7", "comment": "Malware payload", "value": "08bf5ed081adcd1bc7a1afe728b70148f4e0bb6c8ffa58ac6ffca6f3030a2858cb43a1fa3d49a9485132101d0b12cc53", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810679, "uuid": "1d237f23-466f-479f-a625-0a152752bed2", "value": "T109A4E024A3F51F08F1B7AA7E9D7A2B5888727B1CDB21D74C0214A0891C71B54E835F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810679, "uuid": "4e1ff690-a54d-478c-a9b1-0690f668e430", "value": "96:Yc3+udf7i4A268YY+/+udf7i438Vhka+udf7i468F3G+5kH:Yo+udf7i4uxL+udf7i43Mb+udf7i46o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810679, "uuid": "57444c1e-7051-4aa8-9c4e-72cff0f848b3", "value": 467049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810679, "uuid": "7a0fe421-09bd-42a6-a3bb-08ae14a4a017", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810679, "uuid": "f0327ed0-6187-4674-b80c-79d38a0c90c2", "value": "Dodatok_do_zapitu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38639a27-c768-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763791088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791088, "uuid": "1d018b6c-6c3a-4e99-95a2-cecb12ad1b71", "comment": "Malware payload (Mirai)", "value": "e27a497ed48c2b393790941c4939709e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791088, "uuid": "4947df1b-af34-44da-b9f2-1eb6aa86a506", "comment": "Malware payload (Mirai)", "value": "a5a11553bccc0619f028faec9c7fd4b9441d14e5ab298bb9971bca24abc9072e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791088, "uuid": "b74b727c-2484-43d7-8e34-0938a4dd8c48", "comment": "Malware payload (Mirai)", "value": "7071f8b0500a5cb906b12cffe95cef284392ff9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763791088, "uuid": "6e082e63-99cb-45ec-aecc-7df1300cc2a9", "comment": "Malware payload (Mirai)", "value": "d1346e8ca319926b0d7618f2e888917c48f572d0219f8487c40073fca08700946d3fe21087ed8858b1f1b30eee8970e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791088, "uuid": "09b9d4ff-bf17-46a7-8557-a300f0f4b663", "value": "T108C313001DAADAABC375CF6B7B025E26D900603F2B14E395AC60ED77DDE88C12647E1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791088, "uuid": "748c8c9c-af82-425e-9f2f-c5798cbc74a5", "value": "1536:TcKDOVR7N0xoT/g63cX5indnMLTOHqlP8NULz4ca7znu74zT9vkPl1QHQ/HkBBG6:eVRT/WydMLTOHqyNDP7NAkUEBBGVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763791088, "uuid": "86ae9c4c-7682-4c2b-982e-0ec86a65d910", "value": 121244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763791088, "uuid": "f8560c51-7709-4426-87c5-ee97821f004c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763791088, "uuid": "24e659b6-0a2c-4c06-bceb-24d0478be7fe", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1460349-c7a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763817087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763817087, "uuid": "ac0e33ce-741a-4190-8135-6afdcd950995", "comment": "Malware payload (Vidar)", "value": "97004a47bf69a2644a2aab6aa11f563f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763817087, "uuid": "feda4083-a640-4e11-8125-8b4a552808de", "comment": "Malware payload (Vidar)", "value": "a5f1009246be49726ad61b5883b727e0a1f29e8ca57011c73396f1e4b06f3150", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763817087, "uuid": "0bbfce9e-33e8-430e-a70e-de31f8e74f50", "comment": "Malware payload (Vidar)", "value": "3638b97a3b97f6b97e4153a577b66419158663f5", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763817087, "uuid": "5477ac9a-de5d-4e04-ad5e-2ae2bee5fbf3", "comment": "Malware payload (Vidar)", "value": "d207822d0f1075694b28785f1f76f9e17d40deda75c3a57691f816cbe7f9b91989cad09c363b19f4e60db344d790dac7", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763817087, "uuid": "cc68ec31-c81d-4054-9e2d-5f3a7d3c8720", "value": "T1C0A57D877CA014BAD866A7368DB315C27671F8190B3623C33A68B3783FB6BC15A35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763817087, "uuid": "9e451517-0341-458f-8d71-fd6f59a573ce", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763817087, "uuid": "4b740a61-a33a-41c5-a2a3-73ea854939be", "value": "24576:sz+fiQC0v7N3SFIwf9ns9LtW9WCA+0TGEzbk5gN2gf:sz+6D08Nf9ns9LtW9iFaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763817087, "uuid": "f0b452e4-f2e7-43d5-8ffa-518bad50b176", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763817087, "uuid": "36ceb191-9475-4a56-be73-e75d0a42742f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763817087, "uuid": "7dc1eb6e-b3bf-47bb-9aa9-15329cfe060b", "value": "download autodesk fusion 360 full crack_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b363c30b-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763853571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853571, "uuid": "04d9525a-1b9a-4041-9cac-2614b546cae4", "comment": "Malware payload", "value": "85a98d0f58cf08cb7206286b51312661", "object_relation": "md5", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853571, "uuid": "447e061f-d42c-4e01-8ba9-481515c98f5b", "comment": "Malware payload", "value": "a66bb6fbbedd9d46e3580fa75c25e29a0baab9be5769faa5ef73d341fe5d8ba9", "object_relation": "sha256", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853571, "uuid": "bda508df-20c7-4df0-99a1-b8f76b8b7c3d", "comment": "Malware payload", "value": "441e77c90f3e04fd5be8b5b9cbd5361ec236dffa", "object_relation": "sha1", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853571, "uuid": "a1b3aa82-2770-4211-b143-80de11f4471a", "comment": "Malware payload", "value": "8a08ba5a9be5e27a7530fa292c6af8578fadf34eba0597ea9cdfca4e84c7b2d06f4a95285c0f1c5fa9ab619e967fa685", "object_relation": "sha3-384", "Tag": [ { "name": "github-andezzzWW", "colour": "#473309", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853571, "uuid": "84dd7483-838e-49de-84ec-a5c39c63a4ff", "value": "T128916314619B89DA12687116CD08BA0DB89B01FE3B7E132634EC2D3F3FF3528C66D609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853571, "uuid": "3e358094-9791-41e4-8b92-f3289f5a536c", "value": "96:URxJGBchsRAjPFALGhp+gnhw2iaPAi/Jlf:aLbjNrhpnexaIihlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853571, "uuid": "3aa8997b-d760-43cb-9422-5b70df898922", "value": 4545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853571, "uuid": "a0102ff1-8aaa-48b3-9a78-d7678f5ede01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853571, "uuid": "2c355687-b90f-42fe-96f7-dcbcf5510de4", "value": "ego.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45414b89-c7de-11f0-a129-42010a9c0007", "comment": "Malware payload (Heodo)", "timestamp": 1763841790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841790, "uuid": "2a075582-3ddb-461f-b8f9-33a5ea1633fd", "comment": "Malware payload (Heodo)", "value": "221542984b95256351d0e251425da884", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841790, "uuid": "f16b2ec1-e19b-4ac1-9383-b8ca0337b0c1", "comment": "Malware payload (Heodo)", "value": "a75f3ce815f0618fda11c8137011ebc03dabf4822be8a712223f9246d95e4e15", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841790, "uuid": "26aaf63d-744d-4115-8c15-8653d91349b5", "comment": "Malware payload (Heodo)", "value": "61bcd94a3e28d5589208dfd130dd4bae8c07d0dc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763841790, "uuid": "36bf4ba4-9268-44e3-b3a9-cb6bdcb2b56f", "comment": "Malware payload (Heodo)", "value": "c4886e1c3385e399b53da410af91712699cb24ae68e07c338c6b37bb7e824e2d232cd29fd2fdf5f55e7af6351855ca05", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841790, "uuid": "c884de83-f5b9-4e2b-9c30-23884819240f", "value": "T1BEF76A4267EA04C5F9F7AA3589E65213D673BC067F3086CB324C172A1F736E09976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841790, "uuid": "327b4c6c-d89a-45f6-9828-7d5eb060930e", "value": "98aa68e4d11d1d6caaff2fb7a8208443", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841790, "uuid": "20f0d3fd-f55f-436d-953f-7aa408e7fab6", "value": "393216:onh2M1/XytnhNh07I7fMzW2CQZr13j+F2g0VMRQu58EASEhoIaE2lShglF27TDUn:otxsoIRQJhXnGPX3UvxOOxoam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763841790, "uuid": "64ae156e-ea57-4917-ba58-5c8e8a0c47de", "value": 77021493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763841790, "uuid": "d0a78f4a-e4fc-4f98-88ab-49365ff13eb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763841790, "uuid": "a8e4a8d9-a768-44ad-baf0-8ff3d99a9dd2", "value": "update_version.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b10430-c759-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763784940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784940, "uuid": "d5220211-e732-43e5-98c8-3efe5fd4a70f", "comment": "Malware payload (Mirai)", "value": "cff70abd8c58851ed162413f478c8341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784940, "uuid": "e951209b-35ae-4219-b367-20867b69dabd", "comment": "Malware payload (Mirai)", "value": "a779a45b4124bb14874a80ec2e52cbf9c2392310e663ae95223188b6a3ccc0a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784940, "uuid": "e7174058-1332-4275-956f-6330b68f55a0", "comment": "Malware payload (Mirai)", "value": "702f9bdc2037d42eaab54174ffbdd92c12fbc2c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784940, "uuid": "5a199189-da1a-4fa4-aeea-7711097dd618", "comment": "Malware payload (Mirai)", "value": "b380d98449840f84d3783f640cffe307b1fe22c86443d8e040c2fbd36ac26457bb406263b43caabb22400b63fcf8cddd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784940, "uuid": "9c117e37-ef24-491a-8df3-01277ca66639", "value": "T1DFD35B0A78D230FCC687D130566F9F21EA36749C42187DABA782BE711D36EE12E15F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784940, "uuid": "973d51d7-67d4-4fe8-9c02-a9900bb4db62", "value": "3072:0CiPYWe58owq9hOl2p8V3U7607cq61yJieC5:LP2RuV7cqCOih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763784940, "uuid": "033a64cf-1311-4cd2-838e-9f35fab1e308", "value": 132064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763784940, "uuid": "aeb232b8-ed2a-43c2-8195-dd537d5c504a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784940, "uuid": "1f3b43bc-60b6-4d1a-8603-69a5b02172e1", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981ce8e7-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829474, "uuid": "0a4aa688-2fa6-4b56-9048-b6742eb8fe7e", "comment": "Malware payload (Mirai)", "value": "39da296c3338d9608a31d58f676224f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829474, "uuid": "2c586227-bc64-407b-93a8-6df0238030e2", "comment": "Malware payload (Mirai)", "value": "a7b12788a63857534734c84e7beae3e117880f5f23087db8e0a9af476b10a23e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829474, "uuid": "23854976-ea73-4950-9fb4-44ba0ff60c8b", "comment": "Malware payload (Mirai)", "value": "8bf79d7f294100e3c3582cde4a563997d655b89a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829474, "uuid": "b618afd0-db7a-4140-b73c-400d080eea08", "comment": "Malware payload (Mirai)", "value": "591229798ce0916e1fdfec78011ea8c83c95e3bdb73cd41117464954bc7c02e4ea7cdf2342909f6cfcd89a3a1251afba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829474, "uuid": "bc3c8c20-e9c7-4872-a8a0-a923e5e5b386", "value": "T1C8043A07B9CC80FDC8D5D1745BAEB136D931FC5D023DB26B2784AA222A9FE601B6D611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829474, "uuid": "34d64984-7f24-40e0-94bb-8c0feccdbb18", "value": "3072:rVgL0momuFYIoUlo8T51oOLwz9lUG0pElDFU1+C3lMycnLh7X5:IoyIoULN8SYCgLxX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829474, "uuid": "a7ec936a-6341-4a08-8018-a3ef1b75982b", "value": 173832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829474, "uuid": "b1501b05-6627-4a6e-85d8-936dd52fe7c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829474, "uuid": "a0b2e607-edc6-4869-80dc-d788a67ce8df", "value": "Polar.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436ccbca-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852954, "uuid": "6c5f0b27-59fd-4d66-8814-7f8b9b0d1a27", "comment": "Malware payload", "value": "8121122bf211099501c9cf4a6c84b8be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852954, "uuid": "aa08036a-da8e-4e71-bf7f-f0812120b1fc", "comment": "Malware payload", "value": "a7d18f0ef0ee06ae80801e4afb6cd6c2342dcf7b4a81e5c3ff8431dfcd5e7081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852954, "uuid": "acec1291-8b74-494a-a61b-80e765064021", "comment": "Malware payload", "value": "6651d7311034d025fb6b5a3fa62016fe30219f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852954, "uuid": "4478adbc-17aa-4b9a-b139-4307ce94fab8", "comment": "Malware payload", "value": "71e8e03ad4cd654af8639dab87cda7684969a5f8e2a819c7a7548db938bff156424d807bee7d628e9ee98be594d7cfd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852954, "uuid": "65cf2dfd-9629-403d-9a65-3be701deb4a7", "value": "T1C376BF12FB948F83C8DF2FBA10751385F774D116D352A7CB6114A2F8ACB23C50D5AA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852954, "uuid": "09095001-eb9e-4420-8f85-e1c46c4a89f6", "value": "98304:fte84UE0yq6XDe8isdu14rMTQektKgUOX32yn1lrGXms:ftoUESsdfeOUg35rGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852954, "uuid": "59808d95-0d93-4110-aad1-ab7d89e04bd9", "value": 7811368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852954, "uuid": "5f0e53be-8bf1-4663-aecd-3ea6a2aaa931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852954, "uuid": "2edf2b70-2dd3-4b00-98da-9b1b76263137", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1229963d-c7eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763847288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847288, "uuid": "2df9a57d-4b82-4c56-b55c-8584f3a3e2dd", "comment": "Malware payload (Mirai)", "value": "15ae51a8f5e43f1f838de150650f1e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847288, "uuid": "22d70cdd-f7cc-4bec-b793-eec6a68f87b5", "comment": "Malware payload (Mirai)", "value": "a8281ae1873e7525e81f4c74ab66dd5fe6c38321bfc2b4a51c0da7fa9b3e4688", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847288, "uuid": "06852378-bed6-4ac4-abd7-255407de2216", "comment": "Malware payload (Mirai)", "value": "b2b871a93ef93111c0cdc2b2d30c5e5aa5de8ff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763847288, "uuid": "544848fc-f498-4ce0-af8d-5cf1f94b8161", "comment": "Malware payload (Mirai)", "value": "f2a00f9501023f7b5115b9499fa78cc36b84bb37b8895f2a229a57a893aabb9510da0b0e35cf87f77f791bf3aa63d9a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847288, "uuid": "31c85419-4cfb-44bd-8cb4-d0ded3e63636", "value": "T1B0638E67C529AD94C54992F4B8B0CE750B23F61482832FF71A86C27A5043EACF64D3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847288, "uuid": "d131b2e1-6efd-4869-9711-92a406d32874", "value": "1536:WawwtcFJsypr2tAT2ozkyvlKhuXdXU8CBAHSug7RP:WrzJJpeIxtvshwU8jSugl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763847288, "uuid": "0558ce91-fd03-41c5-b4c8-ca7c3f90d24f", "value": 70816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763847288, "uuid": "6dda63ff-6202-496a-88f7-69d466d2c1f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763847288, "uuid": "21e8bc03-7afe-4f82-ab0e-65ee6123f04b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f774a7a-c7f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763853350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853350, "uuid": "443b50da-934e-44d1-a42d-cdf7185f7a35", "comment": "Malware payload (Mirai)", "value": "4864cb1326d507ac428ae38024d9ec55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853350, "uuid": "1c2f2971-405f-4f70-9ac4-cda44b56050e", "comment": "Malware payload (Mirai)", "value": "a8766d27f7c2cba0880c4c87f82a5ccd6408d2ce51ec55d55763fb79b51dc47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853350, "uuid": "9662fd2b-6697-4cc5-9663-d012352b06e5", "comment": "Malware payload (Mirai)", "value": "afb2b8646046c29893092f10c4f7bf0876ea072e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763853350, "uuid": "ccfcb8e9-11df-4d58-aba3-478c8cec885f", "comment": "Malware payload (Mirai)", "value": "451a375981ea0943b54016ad5fb07aaf8cced4508875c78af426c44b626c468b58c063d1b8921ff5a551a72131a2fa4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853350, "uuid": "766d6a67-b463-411e-a6ee-d872d0652bce", "value": "T11E343933FB0C2422C8D29FB05D7B27F69375D5E25176A00964192F2D2A33BB4698776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853350, "uuid": "a9cdd817-9418-43ba-b1f5-b70549387929", "value": "6144:S9Phx5Tr6wYiRnpRwDaJKnFFe4ZA0rJzOK7fA:SBhJZwW4rJqK7fA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763853350, "uuid": "14325221-d6f9-42d0-8c4c-7483f07ba428", "value": 245256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763853350, "uuid": "704c40be-7f76-4ffe-b62e-23e0a0999350", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763853350, "uuid": "8d201faf-5e80-4dde-b361-69ddbc2e1f71", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fb7105-c7ad-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763820738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820738, "uuid": "cbeadb37-7874-4ccc-81eb-367b8c218abe", "comment": "Malware payload (Vidar)", "value": "b98defca160c559b155d30388eed7248", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820738, "uuid": "7d70954f-b262-4e02-8381-38df3c8619c0", "comment": "Malware payload (Vidar)", "value": "a8e7980ed4dbea8bb5ceeca4b5fef3c8aa3a76d1b933ca94239af3efd5ba2a3e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820738, "uuid": "65e1d60a-0131-4e32-aaab-ff241f80ce14", "comment": "Malware payload (Vidar)", "value": "3373ae3663f1827478cf6648461e19d434b88ea7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763820738, "uuid": "e78553d6-7df0-4303-82eb-45a49c8c16ae", "comment": "Malware payload (Vidar)", "value": "67ddda2b0cc321f524c740c1b8d7f2a8b0eb9775dae667ff33f950d84cbc1ddbe3922769c9762439ddef1e3cd3a25ca4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820738, "uuid": "05a5981c-38de-4cfe-be6d-632e7e1d45b3", "value": "T115147D46B3E5006BE8B79234C9635916E773B85207309BDF03A443BA5F277C1AD3AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820738, "uuid": "0a0fc587-8a16-4e55-a1c8-76e2b4fc3cd4", "value": "a7f7752d6202c6b5602510cb5c8c7dee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820738, "uuid": "e3287124-01cd-4fb2-aecb-e382947a987e", "value": "3072:rgzS+ifKpC0MhKoLKnvjF5h6EaayygyEcu1IxWJ4PPLTb49I/8UiUnJ:reS+ZpC0EW55hjBzV57TUK/8MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763820738, "uuid": "d3e7ede4-a057-4502-9697-596d0b632544", "value": 192616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763820738, "uuid": "d321f57d-7aa0-44ee-9e4a-6446f4695c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763820738, "uuid": "afad1261-aaa3-45d2-830e-df740da94e70", "value": "vcomp140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230ecdd8-c754-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763782462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782462, "uuid": "0405bd08-e0be-4c1e-bb54-db7a73401c71", "comment": "Malware payload (Mirai)", "value": "b69317739664c9a60ab84e39c78651c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782462, "uuid": "0b471085-1a22-40c9-b665-bc4f87de0c41", "comment": "Malware payload (Mirai)", "value": "a8f0e40aab457c75ce43f9209ab4ed153e179c88563982403782a15cd630754b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782462, "uuid": "4c1c5a51-cb29-4888-be95-e51b41f060de", "comment": "Malware payload (Mirai)", "value": "3c8dfc27ec8a31ca31e76735c1f7f7d98a18554e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763782462, "uuid": "f506b08e-cb8c-4f38-aea1-56c3efd4f13a", "comment": "Malware payload (Mirai)", "value": "5621871a57379609dc436316c7206bcf178203ba5bfb8bf5c31808e273eb152c59617547039046c880377441c9568025", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782462, "uuid": "82c6c2cd-d830-4c31-88b1-f66fbf95cf93", "value": "T18824F819F4508B3AC7D1227AF755028D73734F68EBEA730589396B383BD66259E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782462, "uuid": "3bcca243-b659-47e4-a9aa-94118cf105d5", "value": "3072:IhgParRy7p7O9VJeh3e1mPdMN6fTU8xr4EWT56kiXKbGkvl7eu:IhgPKs7pndegPdMN0TU8O6kbGkvl7eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763782462, "uuid": "293d49d0-2f5b-473b-a465-10635c55631c", "value": 225864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763782462, "uuid": "84a27288-5f53-4d51-a938-af24cedff9c3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763782462, "uuid": "937a6aee-1a00-45c5-8470-13665256fda0", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a17f47d-c777-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1763797614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763797614, "uuid": "371ab984-387d-48f5-82ca-47478f762492", "comment": "Malware payload (Socks5Systemz)", "value": "543d1f6a2bb5279cbaf70ee54a41aedc", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763797614, "uuid": "3907c1ea-b838-49f7-8b67-f7d87b49fbf1", "comment": "Malware payload (Socks5Systemz)", "value": "a92d7d68c22fb47b286c04458077b23a12ad5306c19800e3e1d5aae0b4e1d0ba", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763797614, "uuid": "501125c8-545b-4357-aa40-71203ed04f68", "comment": "Malware payload (Socks5Systemz)", "value": "2092899dffed3f4240bbfb36cfecd3e4130ebe6d", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763797614, "uuid": "3f7e8074-ad50-4ccd-bbd6-a2fe22ee5c75", "comment": "Malware payload (Socks5Systemz)", "value": "d11eb199636dbd4747c784a0bac81c4e3c2604ca75f132195b74e315e6b692eb06c2de48e71c4f40fa8c0496d7a052af", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763797614, "uuid": "19de2b77-69ec-4db7-95c1-b3c6fc576551", "value": "T177F5339BA3E20279F43473F2FA78C55A6477AC207D212344B34D5EAE9FA50C16963F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763797614, "uuid": "83ffdc89-b542-4d84-8498-85c2c8edc036", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763797614, "uuid": "1cb29420-d07f-46f0-a970-436c56f23ec4", "value": "98304:MqwyOFWhH47oTJKz5vS2Y4MJkFSxmwk2d9VO:ROFKtFKzRv1FaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763797614, "uuid": "07221130-a921-4a57-b612-b044b99b0e1f", "value": 3553965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763797614, "uuid": "245779bc-e7f8-4630-804e-521d51ec39d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763797614, "uuid": "a996eed2-da58-4aad-8007-d6ac32123bc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4bbfba-c748-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763777649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763777649, "uuid": "30f4db48-a35f-4f19-95ef-3193ab5b6470", "comment": "Malware payload (CoinMiner)", "value": "f89ecfc9bbba5eccaf2734f66fa866aa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "digital-marketing-pro-365-com", "colour": "#EB7CBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "softspace-space", "colour": "#E05E30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763777649, "uuid": "f2a7f2f0-2cd3-404b-92b3-6aed623a38a0", "comment": "Malware payload (CoinMiner)", "value": "a9be8c7b5b9bcb1f87ed8654831c5c08d0137d2d5be21baf849869b8def84ff1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "digital-marketing-pro-365-com", "colour": "#EB7CBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "softspace-space", "colour": "#E05E30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763777649, "uuid": "8cb8106a-cf26-43ad-aa03-11097a62c3c6", "comment": "Malware payload (CoinMiner)", "value": "84cceb1e6fcfecc950cdf2089fcb2976c91db627", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "digital-marketing-pro-365-com", "colour": "#EB7CBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "softspace-space", "colour": "#E05E30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763777649, "uuid": "ecbca721-a3f1-4121-924c-c8a03f6a4442", "comment": "Malware payload (CoinMiner)", "value": "561c3467a57cb274b731a520f3550b0758ea682f0144fa92784a9e61ffcfb0981cd5a53f00ff238a061bb36e3e2d33ed", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "digital-marketing-pro-365-com", "colour": "#EB7CBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "softspace-space", "colour": "#E05E30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763777649, "uuid": "5c94085e-2f59-4489-b182-9bfbde0b9a33", "value": "T153085A42B7EA04D6F9F79A3499F65213D633BC166F3085CB2248172A1F737E089B6721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763777649, "uuid": "c5d598d0-c52f-4a17-9d27-87d5f11335df", "value": "35686f86a183dc6a9ec694033bf670c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763777649, "uuid": "ac4715a9-d79d-489b-b8a6-f46cb93196e7", "value": "393216:sfNi8x+zds3HSSf401gqNQK5plBRVz3xWE+xQSI8w5SvDazn1d5VRYv4LWoaM8+q:sMdCJmQlR4Vu0C1SpgPVlcmLy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763777649, "uuid": "500d1e9d-87c4-4ecc-a98b-2f5e34cbbc80", "value": 78432423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763777649, "uuid": "57c6e950-dd4b-4089-b621-5a240ac1971e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763777649, "uuid": "c36646bc-c144-4cfc-9c83-119e6c119f4c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41a3bdb-c78f-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763808126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763808126, "uuid": "8e24485c-0813-4bf5-a7dc-6c845eb676ae", "comment": "Malware payload (Vidar)", "value": "103278bf53288ae0815a0dd304f0cd1a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763808126, "uuid": "62555702-68cd-45d0-8bca-c1233cd94421", "comment": "Malware payload (Vidar)", "value": "aa704746a206eb17238fb1510567ece0e89f8f0e151e8fcefd5b1c8400a9de71", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763808126, "uuid": "8bcfe655-ccd5-45bc-bac5-66e1e41cc613", "comment": "Malware payload (Vidar)", "value": "d1cdf6361e6d8ec6f5e7d623810d2aa58a80846e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763808126, "uuid": "9cc5cfa6-2f38-4657-bc6d-5f8d3bd32421", "comment": "Malware payload (Vidar)", "value": "d8b900401148f769c0590b18db237d9101af4fbb59584d97e33d3ee0404b191dc0a4a3ec838e3f4961eacd82be4c0fd4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763808126, "uuid": "f3f926fe-fc09-46b0-850a-04469ceacae3", "value": "T110C58E837D9484F5D099E23488BE9196A7A1BC185B3277D31F613A3C9F727C01A36F1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763808126, "uuid": "768b46ba-d48a-4902-ae19-ab21de0356c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763808126, "uuid": "41db48ed-f7c0-4d25-a91c-e2ab40ea3336", "value": "49152:iArDO4kNbNH3BVHOOtIGQrrV/a1gY8IvSfN66Qnx5qomOq7/q:iAs7IGQrQ1gY8IvSfN66qx5qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763808126, "uuid": "29af875f-8db9-41db-817a-a9aa96496c14", "value": 2741976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763808126, "uuid": "0850535d-9056-41eb-ad53-a6ef9e7b0abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763808126, "uuid": "ea47f0c6-9db2-4d08-b0d3-df3aa018a936", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87f44af-c757-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763784001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784001, "uuid": "4413548f-86ef-48fd-9faf-942948925e5c", "comment": "Malware payload (Mirai)", "value": "8eacb38226e1bb2c34683a4b7866c9dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784001, "uuid": "f4d67296-ecb3-4962-a3ba-29dddc2b4e61", "comment": "Malware payload (Mirai)", "value": "aae9860707ad578a69e391f7265eb07f3009d1a4f18f9359477555c908ddfd70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784001, "uuid": "9a7d0389-8163-473d-bfd0-0aa22bc8767c", "comment": "Malware payload (Mirai)", "value": "a29c43565fda5acfceae050f5099d05fd3f6cfab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784001, "uuid": "117a4759-c3f4-4e30-9566-070da6c63e07", "comment": "Malware payload (Mirai)", "value": "5cf56013b0a0def33d47a9f1e9ff3d319d10de8180264dc4d06ae2d3b7f4b377c7f24be6d629fd8fee3e7142530383f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784001, "uuid": "f7d27aa0-f76b-40c1-bce6-790d3feb9ee2", "value": "T1BE6312B9014C9438FEA42BFB88C11160538FCD61CD958258B987E3C535EA8C39A7BDCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784001, "uuid": "54f380e5-c738-4e5e-b9a6-1b49fcbc7b42", "value": "1536:zShbqqzzc8eJHv7EBw+KJ8EQ2tMIoXEdTMWrPf:WqOY7Ew+Ew2iIrdTMWrPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763784001, "uuid": "f164e6b9-0760-4082-9ec8-14ad6f8ce3b4", "value": 68816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763784001, "uuid": "75e5f2a4-cf62-4aec-a616-452d1a8d0bf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784001, "uuid": "a24d8b96-ae2c-4990-b28a-ce6210457cc1", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4720c5c-c794-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763810167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810167, "uuid": "a0b914c2-9eca-4d8b-84e6-59329d1f805a", "comment": "Malware payload", "value": "c14b8a808192b77cce41db452bef7294", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810167, "uuid": "36db24a4-c3a6-4330-a7d3-7c623f5e8a3d", "comment": "Malware payload", "value": "abbb809594dfee8ad6a7fd61a4e9c1b527ef6c700ab82f3644e07adeedb58839", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810167, "uuid": "fc527aa5-53b5-4451-9981-ec5e7528745f", "comment": "Malware payload", "value": "0aae45f22b72750f1366d8867c022854ad70dd70", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810167, "uuid": "19c42084-dcf2-4ded-a8ec-e13dc4311007", "comment": "Malware payload", "value": "0af59eb6c00a189eba691692ca33fa522e9bdd3d1212580ea7a14e4bc3bd53eb829b288661b7fc2310760182acbbc8a0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810167, "uuid": "4e540487-03d5-47d2-83c2-98595968ad99", "value": "T1804633D986B7A6EEFCB94CB78C75C94E0C166AE70A3D737A08193FDA801D148E2C7511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810167, "uuid": "f22a2d17-b96a-4aa9-bae6-6839a39694fc", "value": "98304:Zv139S3iGTWtkGjVLW9KlvXmkNoTLBNhSp2vcpHiYs1Xf841kCCS3dGl3OSmnx5y:Z99S3iG+Vw97kNoTt02vs4b7HNPSmxNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810167, "uuid": "0fa4920c-14e2-4ded-80be-2771ec3660cd", "value": 5851492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810167, "uuid": "a6a91fbe-6b6d-444b-83ed-4e1310e87d35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810167, "uuid": "5c3bdf18-cbbf-47e1-840f-f6946d230464", "value": "voisp149.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768497ba-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829417, "uuid": "c427f409-f1f4-4a12-8910-afcd71d52d5d", "comment": "Malware payload (Mirai)", "value": "8ed47e43aaeb1aaef6130099effa68c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829417, "uuid": "75c87ac5-7fff-4edb-a236-7192d8744c39", "comment": "Malware payload (Mirai)", "value": "acc9ea729fb577311870758f13e08f838e1e658d3fcf1046682667331426f223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829417, "uuid": "bf75e4f6-415d-4dfa-a5ba-5fdca42330ed", "comment": "Malware payload (Mirai)", "value": "fe4c70632132f383bf05f0e44526734ebd96819e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829417, "uuid": "bed3e575-0538-4a04-8270-26fa573ea576", "comment": "Malware payload (Mirai)", "value": "e2218ca471311fde8a4da5b9b9b00b1364f655a1e73385ae78d17e74a6e9587d2d6ac5366af727f34fcee2c0aea8320e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829417, "uuid": "7135e1c0-9d9f-401f-99aa-845627cb20a9", "value": "T1FB6302BA41EDD79CD1996230827927B8AC04D2FCA3551B0DB251CC82B75EE4379D78B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829417, "uuid": "6356d6db-c783-4a38-9176-97923c0a0b73", "value": "1536:+aGIiWZq6pTsubcEOd+2nmqPBnFKU77nwcpd9pGAvotzlBQrgN:+iRpp4Dhn0U77wcprxoFnQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829417, "uuid": "6a0f4dd9-2e0d-4a17-84a5-807299cb0e57", "value": 69664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829417, "uuid": "27343a4d-db41-4345-9bf8-de5769358d3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829417, "uuid": "32dae2b4-f662-4008-836f-e89afe8a6cb8", "value": "Polar.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82785f7-c759-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763784914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784914, "uuid": "bc6c45d3-449f-4725-8732-7255d06a01c5", "comment": "Malware payload (Mirai)", "value": "0c7b0210b52e256af884491932a008d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784914, "uuid": "d56edd7a-fe22-4f4b-9198-3e43f0682eca", "comment": "Malware payload (Mirai)", "value": "ae093903334c0a4e338ee2a1319df33a50061464d0fc9224e11495c79e56452e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784914, "uuid": "cfd9c35b-a18e-4a63-8500-fa5261d1bec5", "comment": "Malware payload (Mirai)", "value": "22b316a7cd6d421028d52efe0689fde5d0ced0aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784914, "uuid": "a22ae97a-1b93-414c-900f-698896972a2a", "comment": "Malware payload (Mirai)", "value": "5100b4d569c3c3734297504f592e2b7aeadaf812bbf8397ae768e31d3623d95c45a52117c61e39646d3a4ff85a90c85b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784914, "uuid": "650a13c9-f995-4b67-9c7a-96dfdc11f048", "value": "T16B53F1C6DD5947CEDDD6B331024807DBA3BB42505E1C9C2AA7B874CC8E99A64BA7130F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784914, "uuid": "9d3457ed-9f79-41bd-a4f8-6b230a796d0f", "value": "1536:cOIN+zR7wsLUPYLqt+5HieVKrkVlqChbAKIaaHOxVAQDb:cOIYdwK4MCeVMkXhbfa7QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763784914, "uuid": "82842283-7a42-4bc1-a8ec-0a1b4422c359", "value": 61732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763784914, "uuid": "1094f189-cb77-4022-b8b3-a77787b8e583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784914, "uuid": "46a4b1c0-c0e8-47a9-8b46-5e1190261a3e", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cde149f-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763850822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850822, "uuid": "e8cc19be-7b4d-4bb8-aa66-79170a55e842", "comment": "Malware payload (Mirai)", "value": "88e6e2336b8a028c1fe8f54d84b6a5fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850822, "uuid": "f61d7497-7825-4bf5-ac90-44bae014097e", "comment": "Malware payload (Mirai)", "value": "ae7a161e0d51467dbfcd77c0cc53e1342882d615b178eb530830bc885571001b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850822, "uuid": "2d9c9e41-69a9-4f60-99e2-5b2c87673d4c", "comment": "Malware payload (Mirai)", "value": "4b849cab95d5ee7adf673040bc3112d7955cd04e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850822, "uuid": "b56d12b4-4f87-42af-bf2b-761db325dfb9", "comment": "Malware payload (Mirai)", "value": "b0419737c0161bd12adb65fecdbdbfff2d60b19322f9f68289bac87d832b8344175880a71032ec286d6030018164ebe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850822, "uuid": "1b455c40-e320-453f-8902-b0429de1369a", "value": "T11F042926ED50C0AAC182C1B8A7DBC1F2F731F8B90231365B73A96A322E65F505B5D747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850822, "uuid": "b4dac011-70cc-45a3-af19-84bda64d3c72", "value": "3072:/xm8aZzCRW7xzjRcpHrEN1+3uFbqbLuUMbAUVGEsdrl9:M8aZzHXcpAjZFbqbijIdrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850822, "uuid": "438ed985-1ded-4b00-8751-36d96b76636b", "value": 173536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850822, "uuid": "19b10c94-e052-4190-8c8b-8a4a40a3ff50", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850822, "uuid": "0f0e9bc0-0a09-48ee-a5fd-4c565a5eb843", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0994911-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763829515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829515, "uuid": "f4de8bc4-4c14-4b1b-98dd-fb2db67881de", "comment": "Malware payload (Gafgyt)", "value": "8876f3fac72c14eff3dc17e481425725", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829515, "uuid": "a6034bbb-a39a-475d-a5df-c241380b2ab5", "comment": "Malware payload (Gafgyt)", "value": "aea0ce10779d01873d93629bd14e0fbd9e194b124f6b7811d0ad93eeb7477b06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829515, "uuid": "416ff34f-df4a-4d41-974c-f2f38b7dcb77", "comment": "Malware payload (Gafgyt)", "value": "275bde7b3131a66f2a5542a22d3f77125e82a035", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829515, "uuid": "fdcdb07a-c01a-417f-8589-e7e96e6e936a", "comment": "Malware payload (Gafgyt)", "value": "f89b54934541dbfad2f23c85bd1228f2838b9a25436996de4ed854b10efa8afe806df93b407b7dece42e66bf9139d0fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829515, "uuid": "0fe0583c-659d-40fc-b481-3f0770f5f38a", "value": "T136343A46EB804E13C4D627BDF69F42453333D79497EB7306A9296BB03B837AA0F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829515, "uuid": "56dda2e8-6a36-4e9e-95b9-a05931e04cc6", "value": "6144:oKZdFUOi8hY+pHa+oUslYE98pkdYK+Em6V/GS1oX:QO1bpHaRUslYEmmGA/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829515, "uuid": "eaae5eda-a288-42ef-aaa2-8732d1c8175b", "value": 243508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829515, "uuid": "118a8625-6a20-4dfe-bc49-403806a160e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829515, "uuid": "f7beccd5-46ce-40f2-b3d1-3964484a6c9c", "value": "Polar.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b71265-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852956, "uuid": "63e2e923-bc77-4bcf-aa29-642a69a8ccf5", "comment": "Malware payload", "value": "1327970e265f34555a6bd1b087c2b2ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852956, "uuid": "0cb49fe5-e836-404b-ac44-22124c09528a", "comment": "Malware payload", "value": "aead247067b61aca1a46a33029b5715d5a5eb645b509f2b6bb34d42675d1bb01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852956, "uuid": "9eda8dfa-55da-4358-8215-d68d012f41c9", "comment": "Malware payload", "value": "c0f56b9505556e84dfa70d42f37db2014307eed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852956, "uuid": "8fe67e21-e0a5-4c4c-9f77-bbd3e16e1da5", "comment": "Malware payload", "value": "1fe68c42949efdf88b1bae2212c89b75b2f28d45b86a913eaad9297515b6bd37ec2319cfccfac2206a683927ddd4b092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852956, "uuid": "9b507712-e815-4e82-8b3c-2208d9dce8c4", "value": "T16376BF02FB848F83C5DF2FB610751381B770D257D796A7CB5104A2F8ACB23C54D5AAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852956, "uuid": "b6ef59e7-5d73-4c0e-ac99-86fd96074f52", "value": "98304:ee84UE0yq6XDe8i37du14rMTQektKgUOX32yn1lrD:eoUESrdfeOUg35rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852956, "uuid": "59a065f6-941c-493a-b4b9-7149ccb8f8ed", "value": 7813928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852956, "uuid": "a6ac7d60-7ca2-4707-8916-91da9c002e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852956, "uuid": "d654b2ae-2c80-4dee-925c-ec7777b14dac", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9067025b-c7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763829461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829461, "uuid": "cf2e01c6-450f-40fb-b7c4-59a83a23ea5b", "comment": "Malware payload (Mirai)", "value": "949c68bf27baf7c646a2280b737ce4f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829461, "uuid": "a8a9e008-ee99-4a88-b271-3b4cb5b9beff", "comment": "Malware payload (Mirai)", "value": "af6fdb318566b5f74c0c2bec9b0bdce5e3b6e68cc5ced58fa007c0d15a235614", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829461, "uuid": "aa6c7ba6-6a3b-4209-b331-3eb27144e925", "comment": "Malware payload (Mirai)", "value": "d4adeb3c4fcd623290bbe2004c0ecf7412394b97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763829461, "uuid": "f1b820af-70d4-47e5-beaf-dea2a4fb29f6", "comment": "Malware payload (Mirai)", "value": "dc92e19f5db1a57d2b1551df9d44a7f41e5d59122c3d3fa5086d6d06523916cb7c45527e1a626a7a1d67e6117eac9ecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829461, "uuid": "c1af5981-85b6-459b-bf51-dac262889686", "value": "T193630882F8D2955EC1D423BFA66F659D3361A3F4C1CA3603A8A74A1137C716B0F27E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829461, "uuid": "a3b206d7-376c-4e29-926e-865a88f82762", "value": "1536:ge7IR/BX1zOtVSxiaFZksy88cz5Vgt37aSTtd/RnB:V7a/BFRxiaJ8UYltH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763829461, "uuid": "360690bc-8331-4523-9386-1b317aa02239", "value": 67060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763829461, "uuid": "3dfc9666-6fa5-441f-9979-322a6e136dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763829461, "uuid": "e1dd7754-eb84-4861-a4ab-e753beb39efd", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16734031-c7ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763855885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855885, "uuid": "3ec46849-04be-4972-ab1e-bbff92255159", "comment": "Malware payload", "value": "f51f7a931360ce0fc4a9b22da16682c4", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855885, "uuid": "f4eee478-33a9-49d5-8223-b899d2c88161", "comment": "Malware payload", "value": "b09eddd6e8feb6d9c0496762fba34f76a021131a7e6ed24e231368bc8004e029", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855885, "uuid": "6d13f0e4-a516-4691-8302-5f5cb9993b46", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763855885, "uuid": "28996bfb-ae8c-472f-86be-00d139b5e89d", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763855885, "uuid": "aa6e17fc-a75d-41e1-acf9-7453172516a8", "value": 3460876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763855885, "uuid": "bc4f2d66-c6e2-4c11-b1fe-c16c91f2667a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763855885, "uuid": "fd43faf6-5089-40eb-a1cc-b707e4c7fee0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e43ac5d-c7c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763828920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828920, "uuid": "d86e6100-7d20-4960-abf8-4f580a2fb1d6", "comment": "Malware payload (Mirai)", "value": "9ad9bbc272701df81d40fd0bfcbb38b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828920, "uuid": "2b77de81-291b-4443-b262-fb1b18fc34d0", "comment": "Malware payload (Mirai)", "value": "b176c79bacad986cc1e71f09782e67173258aa3899d5fc53a1ba76216569effb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828920, "uuid": "18ab1ddb-47c2-4d8c-a731-21cf9123a121", "comment": "Malware payload (Mirai)", "value": "dc765cd04648320f82b38c1b7fb4fc10f94badfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763828920, "uuid": "3281f802-dbd9-4e7d-a644-0def4f5ec7c1", "comment": "Malware payload (Mirai)", "value": "50af7d18c40d99f42b927b952aae673e96dd54aecd77d098f384f7657ae1e539de2b9215db7cfc6d57303363b2689794", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828920, "uuid": "befa7097-467f-4d33-be95-4625b2f9db33", "value": "T17AB3E094BE11FE4AC12213FCB5C54980E3B16DB94B57160B8073B9787A79CD83E0AED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828920, "uuid": "d3bd8ba5-a77b-45de-8a4a-9343e2068541", "value": "3072:cFdAvhTg3djOtEgQT0xhch75FmgYPQbVfwuG:cLuhTAxpgQWcB5QoBfwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763828920, "uuid": "d56021dc-b5c7-4c09-83f2-4bc7ee2352e1", "value": 107768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763828920, "uuid": "5352e1a7-09f7-409d-b270-e0cb74d55c87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763828920, "uuid": "051ff066-09d0-4f0a-944f-7776ea3a9b15", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88233b4b-c794-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763810120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810120, "uuid": "69630c64-a1f2-4410-a5f6-fa614bed801e", "comment": "Malware payload (ConnectWise)", "value": "a310ab8534b3501499bb141f3ad333c1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810120, "uuid": "3545796e-c0e2-4c5e-b724-301dfbf7cbdf", "comment": "Malware payload (ConnectWise)", "value": "b1978688891fd36ed3e215a5b496b0500db7f238aff6176d87613c133249e5b7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810120, "uuid": "63008dbf-5ef8-4ce0-bf90-d7216693ccac", "comment": "Malware payload (ConnectWise)", "value": "912404f4155153ba2cf28a17d3d84cab596d99b3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763810120, "uuid": "ecaacc07-bc94-4ce8-adcc-bc926f51faec", "comment": "Malware payload (ConnectWise)", "value": "4cdb57a58265d2d91d27f8ed9bbb27f86afb08cee8917d7bb26b7ead5da006cbf537d73ecf6db66774b42a2eacc0f00b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810120, "uuid": "c6abcf05-6961-488e-96c2-39c1afda6a0b", "value": "T10D56F101B3D696B9C1BB0638D8799269A774BC009316C7BF53D4BD796D32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810120, "uuid": "6ed1787e-803c-43e1-bc02-00b8e80e43e6", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810120, "uuid": "87f5afec-6077-48f1-9db3-2f84e9556a78", "value": "98304:sGs6efPMjb2w6LeJR+WJ0dX2DSQG1oqryAqqlDQg+lF5:NfefPMjb2w6L4Rr0AP0yANlDdK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763810120, "uuid": "0f164d83-af06-4976-a8df-d0fc1ee0ccb2", "value": 5979944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763810120, "uuid": "d7c55a97-efca-4840-99e5-397e881d70c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763810120, "uuid": "dd693f5f-35a1-4693-9d04-3779aef8fc4c", "value": "SysConfig1753368342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a450d0a-c7f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763850764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850764, "uuid": "0244d998-866c-44a8-bfcb-3e6e273002b6", "comment": "Malware payload", "value": "11881cd7b276866540bb9835aabaf4d5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850764, "uuid": "349981be-69a8-4813-b783-5ba57f01d896", "comment": "Malware payload", "value": "b19cff68215f532ae4196b0e3504aeb0c7e8768a4218f7d4b774acf0b5e9a8f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850764, "uuid": "ebcf3d08-fa9a-4ca0-b800-b42ef8c810b0", "comment": "Malware payload", "value": "1d9f3a119c8503d8d17353b20bbfe286c7ef63ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763850764, "uuid": "29dfd845-9c72-4145-a313-2a3a6d76cf5b", "comment": "Malware payload", "value": "e10da0b6f37d1247bb31a7a1bc51926b4d486fd6eb093d8f2b186403e843c663525d71f634d3b93513dc7b2a460143fa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850764, "uuid": "89ffe1b2-c42b-4b51-bfde-0cbc1dd71a09", "value": "T126F00CC431D114BC3DF47073607F445031F0745919C07D0510DC3AF5514EF445441257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850764, "uuid": "9cc96ab5-111c-47ff-8ee9-2c43743972d0", "value": "6:IOnFf9OnFf9OnFf9OnFf9OnFf9OnFf9OnFf9OnFf9OnFf9OnFf9OnFf9OnFfv:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763850764, "uuid": "3bc3c2b2-e56c-4391-bb3f-2babe24fce5d", "value": 564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763850764, "uuid": "f1a98bba-e83e-4f39-899d-b615f7ed986f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763850764, "uuid": "561736c2-81c4-4b9c-ab40-4d8fd2499bef", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f83169-c7b7-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763824957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824957, "uuid": "5ffaa79e-037c-4738-af89-a1707ba90de6", "comment": "Malware payload (SalatStealer)", "value": "d3e445f2a02554b35ee84f4b714be3ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824957, "uuid": "9ead3db8-96fd-4032-ab83-0e3beff5114d", "comment": "Malware payload (SalatStealer)", "value": "b2dc910d8f6f08ebcdec2b6e4af704a87f0199c25a82418a2fd79ea5ec386886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824957, "uuid": "12b94c96-98f8-4613-8943-4d983ba133ca", "comment": "Malware payload (SalatStealer)", "value": "3ae688bba6fadc89f79179bb42c7e8b0abfd8e3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763824957, "uuid": "db16b9ff-ea17-4a62-8211-6c1a50ccc9bd", "comment": "Malware payload (SalatStealer)", "value": "e9aa36b6e155ecdcd03206606a63c3a7e52f9720c2db999a4c1de00753703f150c3979d1178147b85041fe1bdac7e002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824957, "uuid": "bd17b9ef-a356-4811-a7e1-f32ebc6a1eae", "value": "T163E53323818A6B1FDDD905B38D92501C2C6D9364981F6A8B40CFF6BB5374E336BE509D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824957, "uuid": "b6fa4c5e-2744-49fe-af19-f7223ab3f6c3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824957, "uuid": "286c55b1-f149-45b5-9029-48171452c836", "value": "98304:sgtfp1+2NYr4v7tYQb525GWFISXBE8lh9M1HY:Bb+nkjmQY7FISW8q1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763824957, "uuid": "c1b98a68-d013-4d35-bb06-607c5d3e69f6", "value": 3289600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763824957, "uuid": "ccae7ebc-b4c5-49d2-a9ce-ed6785147571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763824957, "uuid": "cc4da597-3fe4-4b35-a3f4-5107014c823e", "value": "CRACKSKEETFORCS2FREE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745722cb-c7ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763826407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826407, "uuid": "98e3efa3-43e7-436c-9832-9435b7ddff48", "comment": "Malware payload (Mirai)", "value": "e25739c8b909b557dc0d3a82b37eb4e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826407, "uuid": "9d76a38d-e86a-4989-897e-ccb6f3be13f2", "comment": "Malware payload (Mirai)", "value": "b33cfe13f4cbce51d368f758484de5f1d84216ace16c08bd5ac8fb9489463057", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826407, "uuid": "0e76d65b-a60c-47c6-8580-90bc5fe827c1", "comment": "Malware payload (Mirai)", "value": "4d42cf3d1e8cb59d7200851496395868fea31447", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763826407, "uuid": "aa9b18fb-e514-4e88-9e42-c32826f45b33", "comment": "Malware payload (Mirai)", "value": "2ef31b71cf6599581a3bca1fc802486f2413a1d5c0edda8627d6b6b73be1acca14eeeed83ab385433c21cdcf374a0854", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826407, "uuid": "f2c0c070-2284-4559-9ed2-6069b4170580", "value": "T15C5301BF86F3C7E8EC744870722E4E42D8EE2634D48197E6928A7EF74A27C10C04B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826407, "uuid": "0cf37ff8-cd57-4110-9508-c3ba9f26f27f", "value": "1536:tSnwqXuWX8E5i37JCN8SOWM0s52w5ODwIsAQX:UnreWX/w7UNogwarQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763826407, "uuid": "cd8875a4-f7d7-4dbe-be57-7958f97fff0d", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763826407, "uuid": "3b90d128-5113-4593-b36b-44a8f53aa5c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763826407, "uuid": "35b4addb-c7e4-4f19-ba7c-3dc018559ce8", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32120e7-c757-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763784046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784046, "uuid": "cd1908cd-d868-444e-a71e-21b86a79b5df", "comment": "Malware payload (Mirai)", "value": "f79e7dc9280bc0331daa55a4768a17a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784046, "uuid": "3c51423d-4503-4d2d-9c93-feaff49edaa7", "comment": "Malware payload (Mirai)", "value": "b3d90ec43a987e3f6d12afbb0477eaeb85949e9d1ee08b7fd6fea773ad4121db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784046, "uuid": "e51bd866-8142-414a-abd0-267842b47bb1", "comment": "Malware payload (Mirai)", "value": "5a020f75364a08dfab6252ce3c1bb8b11824e1f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763784046, "uuid": "c8f28776-a94f-4947-b035-f4765c378fe0", "comment": "Malware payload (Mirai)", "value": "d040646bcaec8edc64f4759f5371e537a351019689dad380856175d66627c0cc846c5c43f9c818251659e4ac703d1709", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784046, "uuid": "68087b83-e107-4883-8c8a-c1ea99602c8e", "value": "T117149D69FE5FACD1D2CBE33EED460FE2741778749651C0B14A00929FC5EAED889A0217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784046, "uuid": "2995d93c-85f1-4bcb-aa06-93d34ec31351", "value": "3072:T8sAqB3gXRikyTHdItJzR8GNNr6cFNNazPx0:TWhyTHdItxRFrnAbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763784046, "uuid": "ca16f521-fc9f-42ed-9c90-ec9bc841a213", "value": 197584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763784046, "uuid": "8ce7f28e-74d6-49b7-9fa9-ec8360dfb24a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763784046, "uuid": "834b9a5c-03ba-4312-8305-d9638451b290", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ce0718-c7b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763825918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825918, "uuid": "4d0d9e24-e65c-41de-9ef9-270555599117", "comment": "Malware payload (Mirai)", "value": "1ab6d60276682da27e12b18525ce36f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825918, "uuid": "deb36c54-0a83-4b0c-80a8-3b69b4f17868", "comment": "Malware payload (Mirai)", "value": "b5169c67084b39a852e10ba6d702a839051cfbc3c978ffadb10c4b774bbffd35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825918, "uuid": "9b3b2177-5fd2-4cbd-893f-d9065f9e4006", "comment": "Malware payload (Mirai)", "value": "4eb0b3f26d528580731e51619ff86561f7374a60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763825918, "uuid": "93260a79-9d53-4cd0-9033-4cec7f776daa", "comment": "Malware payload (Mirai)", "value": "8bd7f57d41ac8e4ee220d6b2c0d0c87e1ce9a3dfc55b01f8394bcc8b26f64ee26378bfef591f63bd99e0c279f0ca7da4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825918, "uuid": "4e987137-6fb4-4c8a-83a9-f1957782e54a", "value": "T137D3BE31E0296CA1CD5007B83876927C1701DEF40BE51293EEEEE5AE1C77D94B9ADB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825918, "uuid": "509e450b-eb18-4020-86aa-186f17c549ac", "value": "3072:GDgjgXI9bMUBgd19RHNclWRR9GJQiZJINOiZK:GD3ibM2gdhNcQ8uQJIgIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763825918, "uuid": "623c95e8-d151-49a6-b06b-5cdca68814e8", "value": 131700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763825918, "uuid": "74d1663f-e5ba-4c9e-baaa-c9c94be65929", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763825918, "uuid": "17ead11e-8a1c-4d31-bd0f-b4640e827800", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47917403-c736-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763769639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769639, "uuid": "9622b2ce-52db-4857-8efd-b164c0585116", "comment": "Malware payload (Mirai)", "value": "7c432715e7643148f207bd3589ce28d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769639, "uuid": "e2589a6d-285a-44c1-87be-72dd752f0387", "comment": "Malware payload (Mirai)", "value": "b59346dbb41e7c8f8c7de2eb2239b85bed0db731cf50e4461e77509db012b5ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769639, "uuid": "a4bc6ab3-98d6-4eec-9501-2da6b56baa22", "comment": "Malware payload (Mirai)", "value": "53ebaec512ff5634c9358866f927d26d5ae2f93b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763769639, "uuid": "e97396cc-3358-42e7-aa73-853c887df7e1", "comment": "Malware payload (Mirai)", "value": "6df5b54047cddb662eb4e25f691457aa893f5fcbc4453e9dd0b7f813c8ae15f0c67f54936c7ca52054017f5e8afae724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769639, "uuid": "0f9fd767-6d58-48a1-8106-9501fde91ab2", "value": "T16EC31986F9824A22D5D7127EF92E118E331317B8F3DE72129E245F2133C652B0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769639, "uuid": "d6c97789-5dcd-433d-b17b-d7546161b7ab", "value": "3072:HDWrFoeatGA59EvP98nTma9uk4cIXEuNGtr:HDWJoztGA5O398niat4XEZtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763769639, "uuid": "37942ea4-85c3-454c-9e58-a93c0b90c34a", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763769639, "uuid": "3f1086d4-fd7b-4426-9fa1-b25d7a114fce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763769639, "uuid": "3f16ee39-0de8-4a8a-a7ce-7f0d49994bf5", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a113f1-c7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852371, "uuid": "f414b2f2-530c-4d34-812f-c10c8dbd2dec", "comment": "Malware payload", "value": "fde87972287846af2bb3b339247cccc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852371, "uuid": "7ce2592f-d3af-4eae-85e3-2a01c7f59198", "comment": "Malware payload", "value": "b595b6e13ece475044bf8105cb3870f9a35e7b6f3b949e3e815657410f9c7cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852371, "uuid": "4c554368-4c51-4059-8de3-c15b84f355f7", "comment": "Malware payload", "value": "7b63491df7b34cf2b818f3e9ce71c40969714376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852371, "uuid": "514da6af-a37d-46b1-adf9-7d36aee24cfd", "comment": "Malware payload", "value": "62c26b51fe9b307c2c5829655688767c0572a45ebf30332fc81af3047fb86738bcf1550b8214a4821d290aab5f7035c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852371, "uuid": "cbb46349-aecc-4d8e-a299-29fae7edcb9d", "value": "T13FB57A92B212830AFD0F19F5E6D2B363E332AB41A61391066634255CCB5FDA43FD619F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852371, "uuid": "bdef40a7-8c8c-4f93-832d-13533596572e", "value": "49152:7h3Z/5f/udkucTST6APcCcXm90ywBQ2+ZP:jx3cj2AkCcXI0ywL+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852371, "uuid": "02b6aee9-a492-41e3-b537-51a2dc9ff0ba", "value": 2303192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852371, "uuid": "34d5b66a-12ec-4835-8055-f633f9606bcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852371, "uuid": "f16db0c4-9da6-42ce-82b0-98cc874176ff", "value": "PDFSkills.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce65a708-c7c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763832142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763832142, "uuid": "9663d7d6-3652-4009-a65a-4e1e57be270f", "comment": "Malware payload (Mirai)", "value": "628d26030bd22e5bbfe9fdf0e331f134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763832142, "uuid": "4386554f-0f76-4657-8fd3-72db25ca2a96", "comment": "Malware payload (Mirai)", "value": "b5e882aad44584e7c9f375c322477164ebf78d84234a3f42bf159d3ff0e2a895", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763832142, "uuid": "3f33f6e1-8697-4f21-b917-8f06c0cfc37e", "comment": "Malware payload (Mirai)", "value": "f3edb9137681b8ac6014114ffcff150b17481ef5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763832142, "uuid": "2dd2913b-3a36-4d2b-9eed-00de36467fc9", "comment": "Malware payload (Mirai)", "value": "d88ee0937908835582a13e9c9df5be673c2db3adbcf2a961c7bb25cdc275202b4aab27d7918532262f76ecf6d7c37faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763832142, "uuid": "8d88e0cf-60ec-46b4-a1ea-528f541e1263", "value": "T115240959F4508B3AC7C1227AF755028D73734F68EBEA730589396B383BD6A259D3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763832142, "uuid": "8dd20e34-7641-4775-9581-ba7f3dd3729e", "value": "6144:q2uZfxT7va9h9VCOzMZUs+v44bcApvm7eu:q3XHvajpMKjQAI7eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763832142, "uuid": "3a59b7b2-f9b9-4d27-9f86-23beb6554a6c", "value": 225848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763832142, "uuid": "4f91e1e3-d164-4c13-b6c4-5f1fd94a94bf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763832142, "uuid": "d73b4c31-8f6f-4e65-9dc5-fe00af4a649a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773fd860-c7f0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763849605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849605, "uuid": "bbe50e2c-3fed-4596-84c7-e53e012dd4b1", "comment": "Malware payload (Mirai)", "value": "4eb89062dbe4acc7a126eae6a47c02db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849605, "uuid": "545a7d59-1edd-4ee5-b8b1-3a3ea5773185", "comment": "Malware payload (Mirai)", "value": "b67b56968aa3cd52b21dd35cdb3a05ce2d48188e41706aa2d659a6ff9d177978", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849605, "uuid": "012e2fbb-a30b-43f2-9e09-316101276448", "comment": "Malware payload (Mirai)", "value": "5163c71f9dd57552b014ee9a0f64a54fee469d33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763849605, "uuid": "e701adff-d8c6-4a75-a044-8ff92a7b2003", "comment": "Malware payload (Mirai)", "value": "867f6ffdbb3cd5f86cc3066ecf988b7bf8bbfb8201dfeb7903268cfd25c59be549a1c2ce50aa2a8f7668ea1a99e8a8f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849605, "uuid": "ec26a4f5-5dea-4f39-b439-9996e3109a45", "value": "T105640952EA412EBBC00EDE30411F87D911AE849953FB532BB278C56E7F8EA0D69C7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849605, "uuid": "eeab5396-69fd-4bee-80c4-a9a037a622a5", "value": "6144:+1YtauJka+q5EVZkD16Xc95wEljkp+PEcjHU7uNLjVz+c4sdoGIue0CPlPvw5SZ6:+1uXiutCPlPv5ybN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763849605, "uuid": "494b81f8-48de-4321-8c6a-92d3dc2ba13f", "value": 310312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763849605, "uuid": "5da6e84f-f5f6-468b-93c9-0b5e358dae96", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763849605, "uuid": "9baa9665-b480-4e9e-98aa-6952f7126e4f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fc13f1-c7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852958, "uuid": "d3b3a43b-5722-4be0-ac25-24738d57927d", "comment": "Malware payload", "value": "20e99466bdbcbd52123235bb09006c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852958, "uuid": "ccd56cf7-adb9-487c-9e2c-b8f61fcbe18e", "comment": "Malware payload", "value": "b6b633f32933b2f3001cc64c452c32dbda8478e6d7405f53dcde30f3630f0867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852958, "uuid": "30bf3b4f-bea3-48b7-9fec-52dc0bec611a", "comment": "Malware payload", "value": "5336f9edeff1d9005e3b8087a1cb55e03fee1fe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852958, "uuid": "82babea7-38ad-484c-96f6-8dea9b9ccab4", "comment": "Malware payload", "value": "53092082704cae2619ac90bf83cb66f7f94208d29d709522c36dff7853a5eff16af4db2b079d3feb0318f423bd245c27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852958, "uuid": "3deb1e58-00c2-460e-8218-c6c79530b4ff", "value": "T10866AD02FBC08F83D5DF2FBA10B55384E770E546D347A7CB5114A2F46CB27884D9AA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852958, "uuid": "601e7652-9f30-4d43-8a40-38b230b76f0b", "value": "49152:w0aAE+Re8KTTH9Z011NyPrdCaKQRDkkZtS4igUUBBbX3/+FT2eO1vN6iZeYTDjBB:DHe8Adu14rMTQektKgUOX32yn1lrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852958, "uuid": "a687f2c5-ea70-4d4b-9d66-5f82db5075df", "value": 6674728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852958, "uuid": "f0e62eb6-2a03-49c7-b899-19a437c67bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852958, "uuid": "675ca172-8535-4674-af39-cc24be3d3402", "value": "ConvertMate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d75943-c7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763852373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852373, "uuid": "58977efd-066e-4f8d-8f9a-b90d284517e3", "comment": "Malware payload", "value": "c0010b29a852a0fae8e15c81d17a6d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852373, "uuid": "7cb9cfa7-9903-40e4-a2c0-6e7b2b36a323", "comment": "Malware payload", "value": "b6e014cd6745a3fbe5110a85c2292f767dc806a80654d3b02f96771bc4313864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852373, "uuid": "75f34f20-26b7-486e-9fbb-284146bed33d", "comment": "Malware payload", "value": "9c56c5d4e959598fea0976dfa56c59fd7132632c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763852373, "uuid": "2644b210-ad21-4c44-86a7-4088492bf89b", "comment": "Malware payload", "value": "b8241f3b0dc14fddca08bc2821de8f8cd5e4c3bf84fd2ecffda19a4b885faa9aaf42801c7965ab737b16421730fa7e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fakeconverter", "colour": "#396D0A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852373, "uuid": "a1f2c934-2504-47c6-a378-359e2243502d", "value": "T1AC36EF82B291830AFD2F19F5E2D2B353D372AB41A60392866674251DC75FCA43FD618F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852373, "uuid": "09552451-a651-4206-b7fe-c231472b0222", "value": "98304:T+3cU2AkCcXI0ywLHBv9YMu5e1OS63zEAuF5olVxU52iVwDkuh:BI09wML1OSTDaU5Zw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763852373, "uuid": "3701dbc0-0301-4791-9e2e-0d57077706c2", "value": 4891632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763852373, "uuid": "ead191c8-f00f-40a5-944f-6e1654ddd67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763852373, "uuid": "41e9b1f9-b41c-411e-9a60-bfda9da38bd8", "value": "PDFSkills.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f7cb62-c7a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763815381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815381, "uuid": "16578871-cb05-49a3-add0-d16a42f0c8d4", "comment": "Malware payload", "value": "42b3a4ee4e0232863033d134f11e151a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-NodeLoader", "colour": "#45A975", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wee-wee-gachi-master-com", "colour": "#9B039B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815381, "uuid": "61f547f2-e296-4498-94b3-e3237a2b554d", "comment": "Malware payload", "value": "b6e3779e01406e59597ead9a50328bf6304dd1764d318c99de3d78b08dd4f753", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-NodeLoader", "colour": "#45A975", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wee-wee-gachi-master-com", "colour": "#9B039B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815381, "uuid": "a19c90d2-0328-4cd2-9c1a-41e049abdebc", "comment": "Malware payload", "value": "7d356ae603fbc59fa496aa1009e50d5dc0d8cce1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-NodeLoader", "colour": "#45A975", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wee-wee-gachi-master-com", "colour": "#9B039B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763815381, "uuid": "1bd208b0-fb97-4415-ad12-e80c932ba2fa", "comment": "Malware payload", "value": "ff9e76bcc9b666b3e8bf10334bbea29e473c1ad7e92694bdedd1f9ee3fd100eade451cbba01c3f9624925d63431378c6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-NodeLoader", "colour": "#45A975", "exportable": true, "hide_tag": false }, { "name": "exe",