{ "Event": { "published": true, "date": "2026-07-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-11", "timestamp": 1783814582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "47ed05ae-f407-475d-bb7f-6e5700a5d3cc", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf85b34-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753406, "uuid": "015b0a2b-7c75-4ee3-9951-0c3f33669d6c", "comment": "Malware payload (XWorm)", "value": "14f4375095a93238e819fcf003a5a98b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753406, "uuid": "8f5be03d-7a7b-454c-acdc-5571b30a0277", "comment": "Malware payload (XWorm)", "value": "00476692614820dd249ab8a9c77105b2d8220da994ffc98be7a6dc23576960e6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753406, "uuid": "14d4206d-fdee-4335-a992-915f13449619", "comment": "Malware payload (XWorm)", "value": "d5ad727f1e7a03d2fb7123fc04d62fbc228941a8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753406, "uuid": "ed01dc5c-5782-429c-9070-f8ad80985f23", "comment": "Malware payload (XWorm)", "value": "cd221655f6cb56acd313ef3d1ca731e5c37d21b458c6a2fef10df685f7a35418584b010ddeff49e6b5690c82ca6d7adb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753406, "uuid": "ce506ee9-8012-44ed-a789-6400632b4f93", "value": "T1D1F2CBF749385BE306714D3529C48B4C9586DC2A4AFCF420FE1DCB24E7F116666A922F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753406, "uuid": "d204c76f-af6c-4539-8e8f-9d77fbe1efef", "value": "192:FpIx/Pa/dF6jFFPaxR5C0oHx/bKR+y6/L:Fs6/dF6jyxR5C0oHx/UqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753406, "uuid": "978f4e82-3cee-443f-ba40-fd80c94c9ba2", "value": 34333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753406, "uuid": "cabc660a-e1e7-45f5-9f2d-c44ca20a0d3b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753406, "uuid": "deb32b7a-03fd-473a-ae9e-68dbca2c66f4", "value": "USD5704.05.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85d5e74-7cdc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783742312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783742312, "uuid": "cdc1673f-feda-4408-8638-51943a9e5aee", "comment": "Malware payload (Vidar)", "value": "988f31002a91d3415e2b893175585cba", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783742312, "uuid": "9095fa2e-4a4f-45a6-8c4b-12e8c63b031a", "comment": "Malware payload (Vidar)", "value": "004ef0c7343d95409b3d44036052ed9eef38ad153311313c53260ed6adb47819", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783742312, "uuid": "3c9f2ca8-95a1-4dd0-8200-1b60682a6939", "comment": "Malware payload (Vidar)", "value": "f40e2813b084e5a5879b32ef1c016882335ebed9", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783742312, "uuid": "b4f058cd-9ec8-472c-860d-2f82d0ce613b", "comment": "Malware payload (Vidar)", "value": "195e18d980dded2a260e58784e3fa7480c57f0cf2b19f6745be3a46cfed6f1c3ea0a96d731c6e7ada92a6bc1c35a16ef", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783742312, "uuid": "42bbacf6-4d88-46b9-b812-127dd1f3c901", "value": "T1DF7511109658B9DAC56895F7A0E33B1D4862FE0434C46CCA7ADE34381E3ABC1EEE7D54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783742312, "uuid": "0d8601bc-17d7-47db-b9a5-d0425093cefe", "value": "d9cf11d5ad37e7ba4c5b3ed284f1150d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783742312, "uuid": "26e8b37f-2187-426e-a03b-6e22e4e6b878", "value": "24576:NqPUZawJLreAe7J3v8Z229tvu+fcIEvKrHqcT/iCzksg0G2IA:N40aKeLnQSMbbzdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783742312, "uuid": "ac9dec3e-71a0-48c9-9459-c3e5a3df2500", "value": 1657584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783742312, "uuid": "119acf5e-7145-4f08-8038-4f5dcf43ec5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783742312, "uuid": "34a1cd9a-c4cd-41ca-ad2f-6ac9d39e6b3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e27dcdc-7d55-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783794156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794156, "uuid": "f3130afb-52a3-4dc3-9b1f-29b4f36477ac", "comment": "Malware payload (Mirai)", "value": "e3a63807a3feb84f880449577dfc4b71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794156, "uuid": "6f160698-8ad9-47c9-b557-f936f63f03d6", "comment": "Malware payload (Mirai)", "value": "022ecdc03e542dec7f460d92692009bd9dd0fc3ac1eab9593945c84ff0a4fa30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794156, "uuid": "f2fd03c8-4312-495b-b753-229f7c9cbb94", "comment": "Malware payload (Mirai)", "value": "fc020e42fe719cd2e74c726c8547852b8c870124", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794156, "uuid": "dccd36c5-b8dd-4c49-8e25-dd5209a117b7", "comment": "Malware payload (Mirai)", "value": "852475e7f0ad6227a3ae30ebc62de271ba0dea7a956f6f53a857a6d3fffc5cef0446ab80b1ed6ba18eab95e3b0f0dc87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794156, "uuid": "b3d69ed6-4f76-4292-b834-b258bccb5eb1", "value": "T101C3AEC3FA8714A1C86206F013C70BAD6B93A112CF5FE4E7AD1DB53B5A7A0DA19167C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794156, "uuid": "c4face57-1f55-450c-bb98-6f3e2918ceea", "value": "1536:xPcakPsaaavKaicvcmqiCvyzwwsWdoPzaDv9tlakCJcTxs559gFSmE3/LWE:dQsQvKqNnzwHA+GDv9tnCJcaggq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783794156, "uuid": "b086f751-742c-4014-8a25-86c04fa8545b", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783794156, "uuid": "70ed4db1-a821-442c-9a01-d686e17287e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794156, "uuid": "48fafc54-7a99-4138-abba-fb928349b157", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6308f44-7d17-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783767595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767595, "uuid": "50b2a28e-3d53-4b73-a496-cc505b4b0d28", "comment": "Malware payload (ConnectWise)", "value": "5fe6f33b10b8b0189af54bb5cb7a4fa3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767595, "uuid": "d230e3eb-b0f6-4299-a067-b648e2a497e2", "comment": "Malware payload (ConnectWise)", "value": "036a405f677aec5077d9c1d8e0cc1972c344c6cbe29fdcfbee671c7986d26a73", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767595, "uuid": "78735794-da4d-4b53-a6a5-35670e15616b", "comment": "Malware payload (ConnectWise)", "value": "968c57d55617d16beda33e10dd0f4d62422b6792", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767595, "uuid": "e4eb8861-9dc8-4cc6-ae1a-e24b8b6f2e57", "comment": "Malware payload (ConnectWise)", "value": "42d80e5e5885c3fa7a6acf7d4eee80b90d53ae1929d189e9b72b129bc1541a8667296f137ed391a4242eb7a94dce32cd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767595, "uuid": "ec626887-61af-417c-b502-8497a6e40ff8", "value": "T1FD646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767595, "uuid": "4cf8f50a-dec7-430b-a917-4a74e531c510", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767595, "uuid": "088a2a5b-c4dc-4fbc-afc3-f273f601d0e3", "value": "6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783767595, "uuid": "4677eaf2-8f08-4a70-a707-afc2f902f5b0", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783767595, "uuid": "998d16b5-2900-472f-a45c-3428ecdde86e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767595, "uuid": "6882af6a-9d16-4fbf-ab51-ec9eaf644824", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83421274-7d09-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783761523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761523, "uuid": "2ef5fd80-a6a3-40a8-bcdf-139d8eace581", "comment": "Malware payload (Formbook)", "value": "91bb5d18f7bbd586157f93ca0c37e5d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761523, "uuid": "6534246b-98bd-4f5c-9292-d54aa962e503", "comment": "Malware payload (Formbook)", "value": "0708ae4eb0d2957b40f9162d2fb35cc94a334a6a039860034c27e99b92c8f6e3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761523, "uuid": "a3fae434-deac-441a-afbb-ffc798089d0a", "comment": "Malware payload (Formbook)", "value": "4c857e5dd9e4b7d07c8f9a100bca75d7f4aade4f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761523, "uuid": "00a27240-8676-4396-b8df-bc5c4674bfce", "comment": "Malware payload (Formbook)", "value": "055feb35ee28f05850aab0665af099a8f9c8e54c3db10bf2b4d3b553be3a44e1b3ba28a7577b901b7ee32a5e54a907e2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761523, "uuid": "38923519-b687-4779-bf10-f46edad76398", "value": "T151F1DD8D8572BF3A0D2733953A541044E687244B832CDAE8FD3DA9D6EF9826193D06BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761523, "uuid": "c65a98da-fd56-4552-8b0e-2c20889c13bf", "value": "192:FpIX+MVSM0dICMDm2u+2/1HrQmh5nGoSiIp8Nzi1ZD9Qv/3sS9k:F1MJgVMDFe0poSfp8NH/3fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783761523, "uuid": "4ecfb8d9-3728-4426-ac01-5afadf90f89f", "value": 7494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783761523, "uuid": "2647095d-d2bf-49d3-acc4-2bf5d2337020", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761523, "uuid": "a0c76e2a-a44a-41be-a1b8-a7ce6c8ca078", "value": "weneedgoodthingsforbetterplacescomiginthebestnetworking.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefd1d5b-7d54-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783793809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793809, "uuid": "dbbbe25f-223c-4f65-83a5-5668e395dfe8", "comment": "Malware payload (Mirai)", "value": "6e853cc6af1c8e8d6099e1a6c26d72e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793809, "uuid": "9250b5e4-e985-431b-a366-aacdada09a52", "comment": "Malware payload (Mirai)", "value": "0731276bc9222d86586dae368226ed3945430aac4d2025e9275e0b5f503a4c05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793809, "uuid": "15ff6d97-b348-4c0d-9bab-ecf3d7ff14a2", "comment": "Malware payload (Mirai)", "value": "e55ab8c31b04c44078e9808cff55604d6ec1346e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793809, "uuid": "bd21fc06-8345-4380-b22a-ef658c72f4b8", "comment": "Malware payload (Mirai)", "value": "a178d81ce6c1dfb0d7aeb640f0d30696f9d1db02b4730905fa02a4b35fe31728f8451f9346ed1c289d58fe2046701733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793809, "uuid": "5eb48466-5860-4aff-8ea6-564fbe853fa9", "value": "T169737DC6A683D0F4E8534573217BF7325A33E53E1029EB83D769A932ED13541AA1B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793809, "uuid": "22e8ec97-2f8c-4df0-a6cd-1edf7be5571c", "value": "1536:yrGGVUzXByEGID/jM2rrWpVb/03RqQGhW+NKzhsIMcHM:yqnAyD7M2rir/03gjhW+QNbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793809, "uuid": "3f4f8af8-ed1d-4d90-8cc6-8f41e3fb5cae", "value": 80720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793809, "uuid": "5eda4ac8-1ed9-4e8e-a358-c7196dbc2744", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793809, "uuid": "33df2612-789f-47fd-a24d-0c08ffc70b87", "value": "titanjr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd7da69-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788812, "uuid": "a2022a2f-8ffd-4565-b52a-0845c20a0dd0", "comment": "Malware payload (Mirai)", "value": "883e91e165f5233d3b570d4435bb39c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788812, "uuid": "d93b6c07-5008-4776-a8e1-e9b635ac964b", "comment": "Malware payload (Mirai)", "value": "082b1860bb35d7730671367077fc0bc64e9a576b4c08a9a8e1d67b311580ca45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788812, "uuid": "76d92778-8da2-45cc-b30d-66be5ac18af1", "comment": "Malware payload (Mirai)", "value": "1ba81dc65a6bd8a7de9199a2cee36a95b8df0245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788812, "uuid": "857efa01-9514-4d56-837f-4ac81f56e53e", "comment": "Malware payload (Mirai)", "value": "397cf0e5f2e28d1e8783ebdffb4fcedefe1dd6dec1cdeb7337fdb03e8daf68fe5f285339d34ca98ebe28042358686b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788812, "uuid": "f19f78e1-0da4-4c0d-8cc0-817f1fa80437", "value": "T144735C32B9750D2BC5D5A8BA61F30325F2F2478A24ACCA1A7DB10D4EBF2564032577F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788812, "uuid": "ebff188a-fedb-46a9-ad0e-4e42b1810bd1", "value": "1536:X4YS2EBCq/5DA0jl1u1Q9tnZTgN95BU9bFU51jt2rF1/A+:o9HbRbFuNPWxbM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788812, "uuid": "4dba8212-a9ee-44f6-8f3a-940c3056eb62", "value": 78792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788812, "uuid": "d8ec3a52-fdc8-463b-8cc7-c54b5af9fe2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788812, "uuid": "d2a209ea-1f99-4ea9-a274-142f9af675c2", "value": "XDspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab7d0f5-7d38-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783781534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781534, "uuid": "a31404c4-38df-40a5-95fa-87f614f56d17", "comment": "Malware payload", "value": "b69ae1a5bc3092b286d6f47c48566ce2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781534, "uuid": "32d37fa9-7725-408b-b810-67e87b4eba0e", "comment": "Malware payload", "value": "08db493f33654c7b2f850eb64f12ac148dab7c60fdcf428b6f3c407847710c68", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781534, "uuid": "b938dab5-1ecf-472c-936f-3ce6d449c4c9", "comment": "Malware payload", "value": "a14b04a0901e66222bc6dd9b0812ee213b4f8dfd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781534, "uuid": "42d07d1a-8991-4439-bf82-dcb55b9264f2", "comment": "Malware payload", "value": "ad263f0fecef0a9e2398683bb9c930f269a5643740672ada3604a8da942fbb1125b516899e89ee74a379ded61805d94a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781534, "uuid": "ac5fa5e7-28f7-4154-bc36-90663ac136b8", "value": "T172E6331469E102FEFAB3013DDEA1555AE2A7B06A5370C9CF0BE853A15E171E08E3D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781534, "uuid": "77980078-437c-4f0a-9bc7-aca56c5e444d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781534, "uuid": "4060960b-d517-48e7-b3f2-001f80d6775a", "value": "393216:w0ekHEw93qXtrxXMCHWUjXlcuI3/PGTAI:wJkOxXMb8XSH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783781534, "uuid": "79f96cce-7dc2-478a-8ef9-e38472e5576a", "value": 14320482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783781534, "uuid": "10539800-8434-49bd-bff3-5026785d6b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781534, "uuid": "bf09c366-1940-4e35-b767-d44c8c47a2f1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e62c288-7d57-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783794881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794881, "uuid": "38fb4f04-bf8f-4fc4-a6cc-789446f2fa73", "comment": "Malware payload", "value": "ed7cceb2da43d17aa8275406574c1d8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794881, "uuid": "c138cddb-275a-489f-a574-cf5c6a78d8e4", "comment": "Malware payload", "value": "09553506b298fd49150090669238577ce5127b53d70718c2bbb7b99b0f74e257", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794881, "uuid": "8a965e6f-797e-40a7-a020-2da8ed5a6983", "comment": "Malware payload", "value": "7ec2546408381b4105a6edd51a40a2cbc512ef6c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794881, "uuid": "372df9a7-ca96-43dd-af32-2889d340e98f", "comment": "Malware payload", "value": "bb2a5e70a76d978bfa88fd289e5e43d0949787f0bd7e59108c5fa29eedf730dc424538394baf64030577fed4e1e9f6d5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794881, "uuid": "76ac9dc7-c18b-4176-9951-3128cb20dcbc", "value": "T13D11198B425873421B588D98BD7BC8BD7990C2E771F2F5A1F114CC6496C92087C56B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794881, "uuid": "0ad9fcfc-484b-4b49-accf-2b3223ddb6a6", "value": "24:3J3UK/9GBKqszKYNIxOKYXKhKRWKIfh+KiTks2UKGp3IKCZkKXSKdhO5KChlHA:1ldq/z9YX3R1QXiTkx7GxCZLXJdhLChS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783794881, "uuid": "8123c380-cbef-4ccd-b10d-2c18ba139c0e", "value": 912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783794881, "uuid": "9cfe0d2d-12cf-4730-b637-aaab5f3af38e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794881, "uuid": "68554813-86fb-4b4f-b572-fc0a13438eea", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cd5859-7d7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783810898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783810898, "uuid": "2d5d04d5-5fb0-47f2-ac91-542a1d20d45a", "comment": "Malware payload", "value": "05ad15b0439fd395d7228fe76fc986af", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783810898, "uuid": "b7ef592c-e5eb-4f15-8f38-706d6c2880a9", "comment": "Malware payload", "value": "0e4931df7ea30255b2820e6bd65b43477897c5c20b0d1ba34fd16b4063d92ebd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783810898, "uuid": "221e07b7-bc04-4289-8312-161a480abd42", "comment": "Malware payload", "value": "1dd7b107e45ad76c1e1d9d1f0ae641a197255b7f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783810898, "uuid": "715679ce-301e-4de3-94ed-10f5f1618fb8", "comment": "Malware payload", "value": "58c0b04cf01546868026a6b9b6a243e3aa1297471884d3d6afa769854091af6d5230025c841416aabadfcb94fe0e8bf7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783810898, "uuid": "0fdc40bc-d925-4ecf-9416-45ee9c5e5c06", "value": "T17DA63391B6CB0570C01BC7B4964A927E702C3FD51FA00D266BD8BF489F73A642E776A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783810898, "uuid": "199862cf-b5d4-42de-aa2a-ab37e46486b4", "value": "196608:iEXfU34m3qRRF+vyt9WGcRNtCKmyLOS+GKe3nGVaOR4OLqgY5fV:iEXfpL3F+vy2RCK+S+GKPVaa4OLqgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783810898, "uuid": "032af7f8-515c-4f2c-93e0-bbea193220fa", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783810898, "uuid": "53e9b4eb-62e2-4670-a926-45f892b2ddd6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783810898, "uuid": "9bea9992-30b2-4d12-821f-82d4448aade0", "value": "app_setup.6653008.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a69cbe-7d11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765067, "uuid": "30482cf2-a836-4d77-8062-794abd74bc43", "comment": "Malware payload (Mirai)", "value": "8da8ddce8d6fd3cc026faa8350e0974a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765067, "uuid": "23d48b29-c1d0-4f1c-94ae-ab6550c3ab81", "comment": "Malware payload (Mirai)", "value": "0e5feb405b0036216e1c55cb822a5a655331675f83e0c50556be420dbbfe0711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765067, "uuid": "d25858ec-87b1-474c-84bc-0839f3cec772", "comment": "Malware payload (Mirai)", "value": "28f91e523fdee7268e770efa32d1b4c992e99038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765067, "uuid": "200bd469-25d7-45ba-aaf2-191007aa1823", "comment": "Malware payload (Mirai)", "value": "fb8b4c0f1ac50a64098115c261cd97d1e453d190cc41c36af69a8aba2170403dbcdc70c57b27b320284ec5c4c36d0274", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765067, "uuid": "fec008aa-04a1-46e6-94cb-d2818ee0fa3c", "value": "T12AE3E70AAF611EF7E86FCC3701B95B0525CC655722A83BB97634D528B60B50F4AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765067, "uuid": "e0f0f7e6-db20-4c7b-ab74-06f9f2ca2132", "value": "3072:v19Jl8U28Geum8BIMI4cyrsZwUASnbtI:tJ8UOeum8BIMI/yrsFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765067, "uuid": "96f682bd-7a33-4f2e-a2d9-2b7fa8f89674", "value": 147036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765067, "uuid": "4ed2198a-bdb7-4232-af8e-73c911cae8ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765067, "uuid": "64f9f457-0526-4eb7-a9e5-0b770041efcb", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ca967f-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753306, "uuid": "4c08dcd7-2f39-4756-8afd-51efe953b2ad", "comment": "Malware payload (AgentTesla)", "value": "9af1aa8f9f5cc4fa52233eaed5689c3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753306, "uuid": "3cb02e08-c2cb-442e-84ff-689b49565234", "comment": "Malware payload (AgentTesla)", "value": "111d3f9a2deecf5bfcd4a5104c312325ae4a9599cc9ff0953249d15f2854136e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753306, "uuid": "c8dfffc8-1612-4507-b478-f78a25e414ae", "comment": "Malware payload (AgentTesla)", "value": "3695f0f4f74174b91c2bbb60d15f4b3160c8e9f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753306, "uuid": "2b3ac53b-5773-4db5-b4a0-82a257a5c4b7", "comment": "Malware payload (AgentTesla)", "value": "a4d9bbabaab9b5b9729ee1ab08aa23862d3a6117105e370b00c6aa34a3bccf32377347287d004808dcbc94be6d38ccce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753306, "uuid": "3565bc37-7b1a-4fef-b3b2-5d88f77a5ed9", "value": "T18B65F1105BC46F7F869C1618E07F26AEF3E10A89156678CAFB337D49EFAA70052135B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753306, "uuid": "131a8c5f-aa66-4282-8a50-5d309a322bcb", "value": "24576:1OjfkQ8/IpiMIkdhvcw4wZvny2wVUTcoZKjCl1goJ62R:1lQjpqaNwVUCuE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753306, "uuid": "ebd879f9-54d5-4be0-b080-ddbd541fe3b8", "value": 1497212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753306, "uuid": "4eb36c9c-e072-40af-9f50-69dfebc7a63d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753306, "uuid": "a4cc8063-8f4e-445f-97e3-6a9ccb298294", "value": "vessel particulars.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f1e8f4-7d23-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783772862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772862, "uuid": "50298935-a565-44d0-a472-5eb2c6177c25", "comment": "Malware payload", "value": "1f93dcfd4057c54005c6601529a9b535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772862, "uuid": "e5321b9b-3fca-4dc4-a72d-bd62e9205ecf", "comment": "Malware payload", "value": "1162457ce6539b56e7784f961db4d4f7cef42f9ac1b3232c1656b6534fed9917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772862, "uuid": "cd7a833a-d332-44fb-b557-d20b35437884", "comment": "Malware payload", "value": "0b291570fb63ccc43d4e7d93d041ed952448ca19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772862, "uuid": "930e5b96-5d06-4e3e-8894-94e06df98acd", "comment": "Malware payload", "value": "f1f7995ab574060c4186fc7e6c7d7e59206dc468abe930aeba59b671285877c0d6a3cc1443648a78f4a6ad307ef6f028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772862, "uuid": "86b79204-67e7-4a6a-845e-e6387a4d9580", "value": "T1EBE33903B2AC10FDE1BBA37889A21902F77678594B7197CF0390C56A1F67BD09E7A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772862, "uuid": "bf71310a-c8ef-49bf-894f-a6361c2f3d2b", "value": "6a91eb82bfd19d2706c7d43c46f7064e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772862, "uuid": "25e0a13b-1880-4211-95fb-4ef8f0914282", "value": "3072:g+f4nYTC3LwjBzaQhlG4a7qWdCXcXxuZjwxBBOql/m:g+f4nKvaQhcF7qIBxuZjw7BXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783772862, "uuid": "ad497bb5-b85b-4d0f-a69e-c39be40c35bf", "value": 146288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783772862, "uuid": "188110b9-7dbf-4c20-8d80-a03df89fa583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772862, "uuid": "3439a743-5a13-4a3c-90e4-f990027fa517", "value": "Streamzyra.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f6167a-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748243, "uuid": "f501afce-f81e-43c2-a8c3-891a0a156584", "comment": "Malware payload (Mirai)", "value": "8e31f7cd991025f22b12b10b1de76844", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748243, "uuid": "7263ffbe-9d1c-4f2d-9a39-9b48e6b29a2d", "comment": "Malware payload (Mirai)", "value": "12ce9af80d7bda29cc946c03ef0378f09fb76d2807e901866416de88626d9df6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748243, "uuid": "6ae3070b-3dc6-43d2-b8b0-bf6c08c73c3f", "comment": "Malware payload (Mirai)", "value": "4096bd879be0686a45c9480262a0a4c6385a7c5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748243, "uuid": "658c539e-e78f-418c-9348-24e9ff00a5e6", "comment": "Malware payload (Mirai)", "value": "015c74f8123f77561db42d83cb5327c278bb7afbd326d75d6e280655b68d985c9789d320aebf8c5e9681b253352d6fcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748243, "uuid": "b23a8ff7-b67f-45a4-9ab6-62624c97ae55", "value": "T1FF9423141C33C3A5E66CCC3421FBC95317846A122BE6E95CD97CEE4D869C4CA25C5BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748243, "uuid": "5cf7313b-ae74-4573-a44c-0b9d8ca6dee8", "value": "12288:WkeG9jDDa0RyBR5bW+gwmWrPt7ZzCGMf54NaDr:Wkk0PbWrjC554Na3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748243, "uuid": "79976f52-7e1d-4563-a55c-08d9005e9126", "value": 408564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748243, "uuid": "8a8e1949-a90c-4b4f-9d6b-265ab7bace8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748243, "uuid": "ff86dd6d-4837-43f9-98f9-73d8f59c857f", "value": "kworkerd-netns-rt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca1c687-7d5c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783797214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797214, "uuid": "1f6afcf0-81d5-4300-ac1a-18788f043303", "comment": "Malware payload", "value": "631fed927ce34aae17569b0238d9f51f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797214, "uuid": "8f6256ce-2d1b-4489-bae7-67bcb57f9085", "comment": "Malware payload", "value": "12ec85335eb93017704668019ec603db69d3703573301278e195f904872032bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797214, "uuid": "71734019-20a0-473b-89c1-7716abdf9160", "comment": "Malware payload", "value": "defd375d4aa7c3e705f9bc5b315e3271b9122b52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797214, "uuid": "d43e24b9-2cd8-4f18-bb49-126aa3f56470", "comment": "Malware payload", "value": "4046c57f5a0094b728621df91572c55d358e5594b5c3d862311f91a240ddb7567f674611d5954cb99e1e6f129e20cfca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797214, "uuid": "19bced39-c2d6-4ec0-96f0-7b671eab19c9", "value": "T1DEE42D0BAF540EFBD82FCD3705A91A0635CCA58732A677363538DE14BA5A50A89D3C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797214, "uuid": "2ea48125-dbb7-4a71-a5fa-f2fa7d49f60d", "value": "12288:yZ97saPL1A1k4AD0BA9MCS4HwnIBR6iu:yIaPBA64QuAMCSowIBoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783797214, "uuid": "dcec2c5f-9752-4fa3-bcd6-73d7800cfd9d", "value": 664300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783797214, "uuid": "3e6ec08d-8923-4793-a61c-40aca91a086b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797214, "uuid": "aeccf723-3c11-44d0-b0e7-5d99c430117b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807b6177-7d40-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783785141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785141, "uuid": "22fe96a3-a718-404b-a259-3e682a04239c", "comment": "Malware payload", "value": "81d3da10224886bccc41fc8c9826963a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785141, "uuid": "7b029595-687e-417d-861e-6eef6779e45d", "comment": "Malware payload", "value": "13ef08faa437a06751eedeb6ba64c1d0edcfb8d381524855cc86b12d9220bbca", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785141, "uuid": "ac4e812d-6397-42b1-8132-35941a6cc4f0", "comment": "Malware payload", "value": "8cb50613ebce1660c914dc799103ede272a38be2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785141, "uuid": "8d04a792-189a-4d2d-a21c-3a2a2fffd365", "comment": "Malware payload", "value": "e726227fc1e7012509a44072d9af0b4673cd3151e72a065058d24e2273bfb78994809bc54ccf160b25dcdf062123221a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785141, "uuid": "f3449fc1-ac64-4196-afdb-3f488e25c2ac", "value": "T196B5332986E92547D8714B3158B1813746313CB16B3589EF36C5EBAC6F722C8A731F2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785141, "uuid": "315c8a5f-0e14-44e0-bfe1-68e3fd86e773", "value": "e387f9bdbdc891a56417c52c45ed0b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785141, "uuid": "3b16337a-7136-40cf-8e77-ceacd6cba547", "value": "49152:54Nrfxh6jYS3ieJnZ4uHEVGPPpm+b8vUyud+1D/7td8Fyx9J+uoAySS6S+E:54xJA3ieJZeEm+b+hudy/BdKSqSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783785141, "uuid": "bbba3da8-f17a-41bb-bac4-8d8ec35732db", "value": 2367488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783785141, "uuid": "72ac5210-93cf-405c-800f-918b33e1de99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785141, "uuid": "e384977e-bf2e-4236-b553-f79abf708f65", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd3876a-7ced-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783749330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749330, "uuid": "dfcf7b9f-f6d1-45c5-b79c-7cc7f70f2ef4", "comment": "Malware payload", "value": "e836c431a0090e181ae454f62c42d9c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749330, "uuid": "b895b2eb-a313-46d1-add4-1bb433b5d627", "comment": "Malware payload", "value": "1435cfcbd10da79db0bb8c9019f3e1899d7695036c09a8396da8e3b42ba291f0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749330, "uuid": "7ff5ba36-2159-4992-a6cc-dd6d11584c4e", "comment": "Malware payload", "value": "50b94745ac8b1a70620dae7fe48460d374d809ce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749330, "uuid": "01ad65f2-4f07-4ab7-ab69-84e0f1c41c29", "comment": "Malware payload", "value": "71e3884a1af951c4a5dbf30b1d86eac5e74a5c9999e2f1a604d3bd0758b580100bb8753a344bbada564c57ddce78f730", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749330, "uuid": "71abf0b3-83fd-49e6-9796-b626c682d79f", "value": "T109C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749330, "uuid": "743a6017-c129-4286-8c34-db3de3809f12", "value": "768:D8vCB+25j6es8Rr9FYpMSUpi+20qUpi+20YQX:D8l25J9d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749330, "uuid": "e20950e6-36b7-4a27-a5b6-633a953fbe4c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749330, "uuid": "b10cd09b-227f-45d1-8f41-1e78413d5465", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749330, "uuid": "05323d4c-221f-4ed1-9ee6-1b02c59bd94b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2585852f-7d1e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783770385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770385, "uuid": "d6815ea7-32fb-4148-b361-c7fb1319e575", "comment": "Malware payload", "value": "5c37dece23cd71c31c8c38d7878ede04", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770385, "uuid": "46444b34-bdb2-42b2-975c-639e47ff42c7", "comment": "Malware payload", "value": "158f392e6e08aa1964fea96bd191bd1e8276d775b369eaa44002ad5dea655a15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770385, "uuid": "c09ccaee-ddc8-4a8c-834d-a8be61603a96", "comment": "Malware payload", "value": "e3c56ef5baff610a8f04513e15afdcbc5e42bf2d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770385, "uuid": "b8f4b702-e1f0-4492-9f51-a56888114c37", "comment": "Malware payload", "value": "448c48ce5952b42edd0a9aee1928ea917f315feddf71dbadd94728720770b984fcd1506d8fcedbe14ffd1d580e81b172", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770385, "uuid": "ce113b06-bb96-4e8b-8448-c7e38ff5b31f", "value": "T144336D6516857C14AA99C8365D7F2F0CBCAD43E6314492DE7FCE3CF28C4AA9CA21961C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770385, "uuid": "b5e2ccc8-6bfb-4c37-9faa-b05ac714f60f", "value": "768:Gnr9NyXsZztCs8M9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:GrHusZD8hcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783770385, "uuid": "6f1ea5e8-1867-4b8d-8ba4-4c43134ef3d3", "value": 50382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783770385, "uuid": "5eb96a63-1d70-4eca-bd92-cc6de8106f7b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770385, "uuid": "6c84fe1d-9e81-44b2-bc07-6bb3609c0783", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e1be2d-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766955, "uuid": "b53fd7f7-aaff-4aa1-b812-c49cc94c7a4c", "comment": "Malware payload (Mirai)", "value": "1a26745a7157f936de61632329d750ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766955, "uuid": "845ef48d-f838-4192-a505-a1a417dec69b", "comment": "Malware payload (Mirai)", "value": "15a00d70e86cd61835f459b0f4c49f7743d31f0d1adaa7f1700988de500766fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766955, "uuid": "82ba527d-9727-4ede-a623-52217e67f439", "comment": "Malware payload (Mirai)", "value": "beb8e0dfacad6b045a6e83bdca0956450fdc94eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766955, "uuid": "cc17ac90-ae7a-4711-99bf-fe9a605ebf7a", "comment": "Malware payload (Mirai)", "value": "356817e38b7dd0565c9919e99ca170f8d9b96c7991bdfae803c411f5925445b58564eb95641342cbd32f5bfde7070464", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766955, "uuid": "154b83d3-aded-4412-b22b-719242757a6f", "value": "T1D4C31999FC929A12C6C216BBFA0F42CD772663A8E3DE7117DD155F2133CB52A0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766955, "uuid": "f57e8f25-fd6a-4c44-8b9b-5c425e95cb26", "value": "1536:As77KwxrbDSFXPRvM9IqwuhhGK5+qLxeHOLqoSvpOtyb0xqI2ozmGOi2FfE+aOLM:/73xre6VhQYeHF7v2xqI2IL+zXnbzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766955, "uuid": "77a247e5-f449-4631-b207-1fe1610c9479", "value": 120180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766955, "uuid": "7dc593cf-04e9-41d3-bff1-6463ee6463e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766955, "uuid": "28b9c93e-adac-4878-87eb-fe6647333745", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e280763-7cf1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783751260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783751260, "uuid": "b81a7c14-f57d-447f-bc4a-865d36ff0f87", "comment": "Malware payload (Mirai)", "value": "1bc6172025bff84b6aad9b795b2c0189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783751260, "uuid": "e047f58a-e006-4192-ad3d-576f30953509", "comment": "Malware payload (Mirai)", "value": "18f44fe627a45956bb39f2d7852d04d21da70270edd4871cf1e73ab672c96d39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783751260, "uuid": "16bca552-28ad-4eb1-b143-e96ce020e715", "comment": "Malware payload (Mirai)", "value": "0ed17bc18d481920b8c25565809c6719d6af61cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783751260, "uuid": "f2d79342-d201-4317-b0b2-100b79ceb6fc", "comment": "Malware payload (Mirai)", "value": "99e2e02855d166e7f908fad596b8f70744ad646ffcaa75a88335ab2132d50f1346e8efcc6a5d64f5350d51e7beaa9c58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783751260, "uuid": "1448ae51-07b6-4bc9-bc33-6a6e330b6ee9", "value": "T13754F956BE419F17C5C226F7FBAE4288371A7BA8D6EE3153DC10AF50329A48F0D36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783751260, "uuid": "63779a47-f444-49fe-9e0c-787609269769", "value": "6144:LSDiUDeThot/+frSnyYtCxeaUwdzoo7FAgfAhawUhg8oyqxAdnFq9Vrk:L6Uha/xGetwddRCQhboqq9Vrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783751260, "uuid": "410696b4-aa6e-4c0a-a416-59d597908458", "value": 286840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783751260, "uuid": "421fb8db-9992-4d00-a3e3-67f4f40d9fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783751260, "uuid": "03345984-7a49-436b-9c83-0c1f4de68298", "value": "kworkerd-irq-bal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec47c51-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753570, "uuid": "3d317ce6-a511-4b5c-afb2-25958bbf2b47", "comment": "Malware payload (Formbook)", "value": "b8c53210251aa2af1085a533f23a45d9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753570, "uuid": "bf12b634-b574-4e82-9254-5bfd50b29983", "comment": "Malware payload (Formbook)", "value": "1a3ea22e0c4a68379e164c35d8d5bc438d9624fb575756194c8419121e2d265a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753570, "uuid": "9c22e28a-ff77-48e2-a6ba-d1a7048de57d", "comment": "Malware payload (Formbook)", "value": "c1ffa03cc32bd676c92ae8648f8aade466ff804a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753570, "uuid": "182b5bf7-9c3f-4e09-ad70-13226e0a2bc6", "comment": "Malware payload (Formbook)", "value": "0fd3ee000d5119e3b3837ba7e2528c5813f3c4a0205ef2eda6898e67cd825ed0a9a84b07f32fe1481f5448bcc1ad63de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753570, "uuid": "5b34759e-62c7-416c-af94-a6c7c0398d60", "value": "T1CCB2306CEB17B0F48E96578C9C67096444DDB32CC576A8B0B3AB73782902598E3F4339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753570, "uuid": "af5613ad-22bc-447c-bda2-f6f0cbc55514", "value": "384:iXMQEnyr/jkIJcDcE+9CnXrAUh07oddoLD5xBk/RbVlu98Gn0O:Fyr/YvcwXrAE0EDwK1nu930O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753570, "uuid": "24b0608b-a3bb-4f25-a70d-0c10987844ef", "value": 25488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753570, "uuid": "d6880497-f58f-475c-8793-4b3d201b776e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753570, "uuid": "9f04799f-7ba2-48e6-b85b-42a79b9fd8c9", "value": "UTEC 8578\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7455ec1-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783765503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765503, "uuid": "87ddc883-03ca-48e5-988b-43f9dd65b542", "comment": "Malware payload", "value": "dc0d74eabd6c4d0f0e618268b26e8e77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765503, "uuid": "842f9726-8695-4e26-bc32-1af0a1b53426", "comment": "Malware payload", "value": "1ac45ed3d1239470aadfebf11b5d6a814140ad0e5dba1d0b98533e2a56c943dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765503, "uuid": "d30fcc6b-9957-4574-b470-8cd7e502f1e6", "comment": "Malware payload", "value": "b804241df8f99f5d0d037a511767aa04996fc083", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765503, "uuid": "044c964e-c3a2-4102-8a6a-938a51d564fe", "comment": "Malware payload", "value": "4f19169f819806febe6d42226b0f009415609a2964c62a86dc757d527b3762afc1565529de8536b3815add4c1b6dbeef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765503, "uuid": "741286fa-c9bb-4802-87f2-638728103fb7", "value": "T1C71184CD3AF1A123098D4F6E7126C2D65C85D4F0F1E201EAA40ECCB56ED4D29619BE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765503, "uuid": "3ae1ac26-0c72-40f0-a707-69ad2490c3f7", "value": "12:NbKMBNrbA8KEGjtrxuOAKKYHLkxf2KAwfe8aMNanJ0kGRoKBzYSVmtSuwsxmvcAR:hBNHlKLQtKPJsnee9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765503, "uuid": "ec3f94db-3a2d-4980-9816-d7e82b96e487", "value": 1049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765503, "uuid": "26f21cc6-cc86-4aad-bb34-121357837ff7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765503, "uuid": "4b4c81b0-a55a-4dcf-bea2-09386c4b05ef", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b29b54-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788802, "uuid": "7eb3ffc1-2d1d-4120-8d3a-4c085ca62304", "comment": "Malware payload (Mirai)", "value": "bef3632f8260b104d76eebf0511ca5c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788802, "uuid": "f5bd47e9-1c74-49cb-9240-403553b701af", "comment": "Malware payload (Mirai)", "value": "1b5a0c31851a8634ad66da58977355dddeea043d286ebdae0fc92ea2420d0c2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788802, "uuid": "f66b68ec-df0e-4ecd-afb2-de78d227154c", "comment": "Malware payload (Mirai)", "value": "2614258e87b7ba44a24570e1e160fb59d05b925c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788802, "uuid": "3da7541f-59d8-4b6f-a65a-78a8241001da", "comment": "Malware payload (Mirai)", "value": "2c55e6dec6fde35391da3f7db21caf005ee664abe5c58c0a8f6162b1872b0adc1d2640cb7461160ea79f3812fd8302e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788802, "uuid": "a247fbfb-5b70-42f1-a776-ea86f6b66677", "value": "T1CB930806BB550EFBDCAFCD3746E91B0535CC650B22A92B363574D918F54B28B0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788802, "uuid": "b3168129-92f4-4ebe-852c-375426d18ff0", "value": "1536:cpikwRXiybTnHezWe7Q9ojjWszWlEyWtZ/gKe0E9a+0jBkmV/RAd:cYkwRX7ybbzqENtJ+Hjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788802, "uuid": "c37f3be0-322e-4cf9-9474-7e5263220a66", "value": 96744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788802, "uuid": "e4cb5635-d12e-44f5-90fe-5697c8ca65a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788802, "uuid": "2d011206-03bc-4fdc-be43-a9a1cdb151e6", "value": "XDmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca326295-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765508, "uuid": "e9db4371-b097-4fee-a914-ebf5bdea5db7", "comment": "Malware payload (Mirai)", "value": "a8099d87815cac818a7323c50f45b319", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765508, "uuid": "45172ca7-9347-49a3-b12e-bfe3bbc64696", "comment": "Malware payload (Mirai)", "value": "1b86a52a3006089f4b6e85ec714249f096d47d4bbae12891ef89743612cd645f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765508, "uuid": "e353f692-f7bf-4c80-a9a2-956fa256ea8e", "comment": "Malware payload (Mirai)", "value": "c40c1bed60ca9047191445f264c2aa2cd76e5e40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765508, "uuid": "c68c2c5d-9762-4a06-ab95-937efa639c29", "comment": "Malware payload (Mirai)", "value": "beb1b5a26a4f26e91d3cbfe637268c9c8079cac40b9c5d21309672dd32681e16800b91992d107fa6be4f7cdb56a1d099", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765508, "uuid": "27eda6ad-956e-4e07-bfdb-683ab5608279", "value": "T154A33C02BB594A87F9930EB5253F2BD153AFEE8060B0F2C4798BDA0E4171A772556DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765508, "uuid": "7bdb291c-68c0-4239-8c57-b383afd0a7bd", "value": "768:43pClI/O/jlBQH1SwyGOH5ODtQYtXiNHX2kyxGsDk6BYndrx490JbeLSH7SnK7gR:kYc+AA2ku4ZhEL2ShvQkXvbApxQ80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765508, "uuid": "12bd1e34-7942-4c06-9bd2-74a471fe51be", "value": 103704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765508, "uuid": "f481f1d3-293c-4250-8256-a6fd23321b06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765508, "uuid": "32150211-ace0-4591-8e1b-29e5d13d7f78", "value": "Ares.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4118b57-7cdb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783741929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741929, "uuid": "d28d3515-1332-48fd-8f0e-8bc2d4c74911", "comment": "Malware payload (Efimer)", "value": "d281654a507d9669f8d21ff728056159", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741929, "uuid": "c9dc3853-8784-4335-bcf5-b0187e8cf592", "comment": "Malware payload (Efimer)", "value": "1c557c460fcaf8b1d4ca72700ba8cfd1784257bb8b0a4fb4c2461afc7a2d9e46", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741929, "uuid": "4ebc2102-1a2d-4262-ba28-a24edb31b882", "comment": "Malware payload (Efimer)", "value": "d14c396a17bd751073dcdb37560bec80c5af565e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741929, "uuid": "a4076070-c835-4970-8611-7f0b39834223", "comment": "Malware payload (Efimer)", "value": "5c15bd0709ef1ebd97bf59fdcb3cd5718599bfe356f75c6cf27a24555cca388f8b1514fde27292546d364226cf178e38", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741929, "uuid": "88a0abf1-e95d-4c9a-9c38-d7e357e8c056", "value": "T1B7E6335459F012AED6E3407CFCD25695DAB5B0AB0B36C58B17A4CBE16EE32F1083C687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741929, "uuid": "cb2cea1a-74eb-4f14-9c04-9b5a7f16467a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741929, "uuid": "fd73dd7f-6112-4d24-bb4c-19a9c18457d6", "value": "393216:kL2B6ePHFz8Hvpwu3OTpA5zMgZmKlA9XMCHWUjX0cuI3/PGTAI:kg69GhpwzQKaXMb8XhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783741929, "uuid": "254d3eae-d380-4972-a520-4e8900b32540", "value": 14276195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783741929, "uuid": "a8cb769d-b201-4347-a038-94ac078d0b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741929, "uuid": "24a50627-c0f8-4c2b-ba12-522c809d0708", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64c3922-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783753475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753475, "uuid": "43e32acd-a855-4353-b287-1cbe4d1f7880", "comment": "Malware payload", "value": "1ba829325be8e61704c09e2b7f9ae1ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753475, "uuid": "0a09a3e4-0dc2-4d17-a73c-e91f544d6a38", "comment": "Malware payload", "value": "1c71ff59af4b95f4805b5610b7cae1356f8dc5015d3ec025841c4dedfde97165", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753475, "uuid": "2aeab4ab-2b7b-49f0-8988-1724e816b131", "comment": "Malware payload", "value": "48a2facb33bfacf7a04983eda209ff1e228786f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753475, "uuid": "6e070e77-421d-4d68-a9ce-544174e767e1", "comment": "Malware payload", "value": "58deee295941372dff8d39f30e91dcab64f209eecb27dcdcd1a5dd2a0211bf9e29c55641a4388a81b9d78b122dd0e01a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753475, "uuid": "67584cb8-fda5-4830-9db2-3ac3d1037ceb", "value": "T118A4D1482FC17AA6C66C613B687F625DF3A10EC6E195F4CDF722B80CEEA430441676D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753475, "uuid": "b8144a25-aa02-44c0-878b-ac4db8ad648f", "value": "12288:Xv8VYaWkXDK3qZYfdBw4F5wFbySmSAx8TXjj:X0VYNMUw4F5s4S8IXjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753475, "uuid": "07e83050-ea1e-4f8d-b2e2-5cd2860d5f19", "value": 481791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753475, "uuid": "b4d4c373-75b9-4cfa-85ef-a47e493b9f41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753475, "uuid": "6cd6b606-c524-4ff4-854f-03325433aa3e", "value": "HBC987654567899X.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f093e062-7d06-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783760418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783760418, "uuid": "80fce863-7456-4b41-9d1f-1deb12e87351", "comment": "Malware payload", "value": "3329c3cb960e2525078368a84faa545a", "object_relation": "md5", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ogstealer", "colour": "#8294E6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783760418, "uuid": "fc4feb42-f144-49b4-9702-a379d0c592ee", "comment": "Malware payload", "value": "1c72bee27bc88563e9f74a46dcf7d119e8ccc4c8801231af5cd293c5f593105a", "object_relation": "sha256", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ogstealer", "colour": "#8294E6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783760418, "uuid": "66762e08-2293-42c8-a789-4870906afb23", "comment": "Malware payload", "value": "fc89313c0ca3c45a1f542c82e55aa0a3443fff4b", "object_relation": "sha1", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ogstealer", "colour": "#8294E6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783760418, "uuid": "5b365685-8988-40df-9060-c01a27890df7", "comment": "Malware payload", "value": "9fe8e57d74bb8b1b32d184b600117a0609ed0c6751343ddf4551db11a88e15f6fc0bb9dadeb5b363e9e0327c540a426f", "object_relation": "sha3-384", "Tag": [ { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ogstealer", "colour": "#8294E6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783760418, "uuid": "d5f88014-12f4-43d5-9a9f-e3acc87efa13", "value": "T1C0E501037F18D842D55A1E318934CBF96361FD98AA59438B34DABF1BFDE81D2AE021D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783760418, "uuid": "413ba5b9-330d-46f1-91e0-411e9c882ed1", "value": "00bb7fce5ec272a3f42206b736cf4a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783760418, "uuid": "ea394e20-b25c-4961-897e-1a8489fa76f4", "value": "98304:T0MjhwCO55NRhueydKoRHcT6DyUT0DyBEK:Tn965NRhPyoo5cT6GUTwy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783760418, "uuid": "da56b70e-844f-4359-96ea-bc8367528528", "value": 3316400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783760418, "uuid": "8787cfc9-564e-46f6-9749-cd593b956568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783760418, "uuid": "602e8805-3e1d-48d2-9eb6-edf74e7a2800", "value": "b8drttr7dp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c340f35-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783749754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749754, "uuid": "1082304c-2971-470e-aca8-3dd453038839", "comment": "Malware payload", "value": "533a095a04a1c075e711897a11c783cb", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749754, "uuid": "bf2f7d22-e86f-4c9e-818f-6cb02b5d4c81", "comment": "Malware payload", "value": "1d882d1222af79dfd7e8df2209feef3c990d0937ab7715c1cf7ea74a009dc6fb", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749754, "uuid": "ed2cad7d-d023-4486-a6d8-8680ce386288", "comment": "Malware payload", "value": "64f11494ee3796fbca0032d7984794f8756c05f7", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749754, "uuid": "86202ed8-b13a-4c1e-abed-094a40e04aff", "comment": "Malware payload", "value": "70c993495975a34d240f2b58e6aaa4e1d422783f2cdc18ed1c60efb8e888610d3675387eaed22be6c308e610eae967c3", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749754, "uuid": "7f5bfd29-3de6-452b-9428-9e0be3f09d41", "value": "T17A0178DDD1A9DB400AF8C486F6F18449C490C0C3A1F6A3DAF28E0926EF28D4E385320E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749754, "uuid": "5475a33d-a2a6-46a6-92f8-518358633b6a", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+QDjfTkKylkKdhjZhG+E6:FH8j/wWi2jz8XfAKySKdh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749754, "uuid": "46f2abe7-bc96-4f12-a296-28a319c21336", "value": 689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749754, "uuid": "5a068a0d-58c9-4a24-939e-10e46f779c46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749754, "uuid": "63ca2b15-9cee-4149-8ed3-361bd2b1d93a", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2e7bbf-7d38-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783781541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781541, "uuid": "e9e966d3-f195-4eba-8c35-4096b756f54d", "comment": "Malware payload (Stealc)", "value": "cb3694044c8b3850ec1414a2bb56e5a9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781541, "uuid": "d17184fb-f95c-4792-b169-c4fafc55f138", "comment": "Malware payload (Stealc)", "value": "1d9b44ff02821dbe186f121b8674e5e621d0e7ba9f876e3cf1e918f15817f13c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781541, "uuid": "fafbcbf2-8e09-42af-aa4c-5a1c613dcb41", "comment": "Malware payload (Stealc)", "value": "43fd56c9e7a3eb8be334ecf36cd58bf176651b09", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781541, "uuid": "af8f7cc5-1b79-4471-8ea2-b16e385efc69", "comment": "Malware payload (Stealc)", "value": "699d52b2b05e52620b89297ef906f3a52e084dd8c1485bfd71165f564d37b709ef9ad12ce2336f3175da2de20c15cbe6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781541, "uuid": "b35ae8c0-c519-4e46-8315-0a8e36f8b075", "value": "T1A695235223D8A465F2BD577488F38A934532FC629B72A5EF33E4AA3DAD724C14534B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781541, "uuid": "8b554f4d-dbcc-4971-a340-45b6fae0f3a4", "value": "e387f9bdbdc891a56417c52c45ed0b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781541, "uuid": "b8706f98-c64a-4a29-a8a7-49458eb686b2", "value": "49152:O3Irbeq0vxB/E4SGiSP7jrtIQ3L7rwTg:O3pqiEBGiSbtl3XrwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783781541, "uuid": "b93b90fc-59a2-433a-a645-321343c477a6", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783781541, "uuid": "f87f94e1-0204-459f-97c7-2d3dd92620eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781541, "uuid": "6d66f63c-61f4-401b-9208-b5f843c9c89b", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d28a0c7-7d5c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783797161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797161, "uuid": "f12c0111-7975-4cec-87a8-d7ed25ba2966", "comment": "Malware payload", "value": "cf138eaeef51de564f7c97c960ca8810", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797161, "uuid": "8738f9cb-473a-482a-ae31-8a1c8de7e692", "comment": "Malware payload", "value": "1dd0d38cd124cc1704d8d73d35752d3784892a88aa087e10d544782cdf232b47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797161, "uuid": "278662bf-badb-494d-bbd4-4ffe0a3f5c81", "comment": "Malware payload", "value": "8904a1c1a2459d99d9f30a0823a3a252fd9ecf08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797161, "uuid": "e971ad76-685e-4898-9931-ecdd8c156a8c", "comment": "Malware payload", "value": "ee1d00675ffc71858394e574951cc7f8d9fa935426deecba6e24b21808ea3701d0d5cb7dee68d94a1165fd01a76f2a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797161, "uuid": "e0233bce-599a-4e1b-b3cc-e865271fabd8", "value": "T171542334C83732B4D4D3EAF54E4EAB739E9845759BFB4190476C86D250BE18CABD2328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797161, "uuid": "fb1335ee-8618-46c5-845f-0c58556b1670", "value": "6144:3ormJZ4ENvZTmAg97ss9LiJQCtRpk5D8L74PUH:3Dp2AcN9WrYY74Pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783797161, "uuid": "89e70fd0-e707-4950-a220-6d2bca220895", "value": 281856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783797161, "uuid": "edbe6697-a63e-4325-8a8e-52f3ca0f9597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797161, "uuid": "d8cb2425-27cb-4b9a-b72d-be351117363b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa1301f-7d38-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783781910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781910, "uuid": "20d3d537-fc24-431b-bd97-e9e0e31d1877", "comment": "Malware payload", "value": "3d625ab0fb7e527f9f17050f94ba47bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781910, "uuid": "cc2a67fb-93ad-4985-9457-ef43e17f8a2e", "comment": "Malware payload", "value": "1e2b91d35f297b7cb34abe360a1df8ac37c08d3f6d776ecfe8a64e20692597ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781910, "uuid": "9e4d6a6a-e5b7-4954-a877-4bfb97274321", "comment": "Malware payload", "value": "c027b95ec5deadaa61029eb5a6862b22c963d278", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781910, "uuid": "cd6c5ab5-d752-4081-9060-55f0822a778e", "comment": "Malware payload", "value": "26b7b85ceff86710cbb240dad6d38502f1a1e25f12eb94634c55057c14826a3c35884ac88197d3ede70eea3d178ddab4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781910, "uuid": "90f08a7e-4095-4adb-b78c-cd181424ab77", "value": "T14308D043A6F1082DC562D232459B8232FB73B455133556EB734D03A23F77AA18FB6BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781910, "uuid": "5a1d0906-c8be-4f76-bfc9-8e9b9611a919", "value": "256f62cebbdf487a51266276ef16169b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781910, "uuid": "1a4eb5fd-ea5b-40eb-9cc5-d60c78bbd2be", "value": "1572864:0UD9SwhtDrZi1QJFl3jYyGFPZ+BqZkPgdYWChrj5X:t8mDrwSFl3j7w+BqZ7irj5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783781910, "uuid": "1c825c68-235c-470f-b035-ada0135090ec", "value": 79800099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783781910, "uuid": "09ce54c8-86b4-4c4d-ac2a-b7e9fc305279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781910, "uuid": "366a209e-5804-4897-94fb-458ac4cf6cd0", "value": "download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8976a5-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753544, "uuid": "a860b907-2e33-403d-99bf-ee10ae84a3fe", "comment": "Malware payload (AgentTesla)", "value": "763453850aa4f1fa01036902b9f4453e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753544, "uuid": "e082847f-c856-4df2-9f05-57de8c0b1690", "comment": "Malware payload (AgentTesla)", "value": "1fe1d42d293627441517749d73857f49a27224933844bd9cf512de12045e75ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753544, "uuid": "c5bc0648-ead2-4412-b6ac-35dfaa50f96e", "comment": "Malware payload (AgentTesla)", "value": "b2fc2098ebb4980f5518baa1c6ca09f01e93b9f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753544, "uuid": "9e990786-0f72-4904-bee4-cfa1fdf8fa4a", "comment": "Malware payload (AgentTesla)", "value": "6fd08f05d79d41444bae458e84343039b89b5fdd7503faecada3c6ce6a919d28758d060d541ebe2a72092ec2b8987208", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753544, "uuid": "8fa5d4a9-437d-403a-bf4f-cd4501f91107", "value": "T191850A7F0D9C18427174B92DED96CB59FAD4429B697F184E707AB601AE330924AF0FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753544, "uuid": "5c6c73ae-c1cf-4410-aa0e-a43edbd1080a", "value": "384:RD72JisS0Hz2H2hrY2200MyniddsSGxcuNkOyRFdIudYH/twxt+:MfPXsZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753544, "uuid": "f3e68a47-44b9-4c45-ad09-fbff4f4dfd9c", "value": 1780155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753544, "uuid": "7cb7544f-3316-4b25-8ea2-356f3a509d2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753544, "uuid": "bf2254b4-6e9d-4dcf-b00b-da19d5ade51e", "value": "Detalles del pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe02876-7d3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783784844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784844, "uuid": "eba727d6-3d6f-4ac1-8ff0-5a950a04e767", "comment": "Malware payload (Mirai)", "value": "db686bc0c65f44daefffab4a6566b0a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784844, "uuid": "e5e52d42-e9f2-4df9-9240-b773d661d4cb", "comment": "Malware payload (Mirai)", "value": "205a9f2d7953870fca1855feb3e275c2820789c899404a0ba700e110b6b319bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784844, "uuid": "c0edfe04-da31-46da-925a-8a36543a7384", "comment": "Malware payload (Mirai)", "value": "9f355d6c337e122b140f9ae72254e98bb963eb3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784844, "uuid": "dbaf4c04-254e-45b1-905b-5fa3a81fc5c8", "comment": "Malware payload (Mirai)", "value": "ce2df04acc9ff28de56d50261ccbaea97042f06ecf00168071b0204a2c4164024650016d7a8405121b4e1c51895e903f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784844, "uuid": "19ee2405-4ecf-48dc-8dc4-e69bb2cb8ee6", "value": "T182732A81B982966EC2D013BBFA5F528D337563E8D2DE3123D9218B1537CE91F0977A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784844, "uuid": "ca812d3e-1353-427e-82aa-9460d837e76a", "value": "1536:/L/rvMagRBSpor2c0rgqo1txH9tsHcXXi2mWfRIyd5tZ:/LL7gRBZ2c0rgqo1Hye9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783784844, "uuid": "44e3c282-6a5b-4cb8-9083-8c0f3fc93ecb", "value": 80616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783784844, "uuid": "fab1f80c-1ce7-41f3-b934-d63a9ab71bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784844, "uuid": "425b9be2-60bd-42a4-895b-fee9e119d9b9", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5245a732-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748126, "uuid": "aaabe69e-c20e-4713-9e82-ffd88fd8be67", "comment": "Malware payload (Mirai)", "value": "bce1200734bf8fb3973b4fc1274fbdd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748126, "uuid": "01ae034c-58e2-4e6e-8b61-19a411c1c794", "comment": "Malware payload (Mirai)", "value": "21f220ef118fc887169ee1e134987551bac58868fbcdad95e14c7fc68a3b053d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748126, "uuid": "8790d6d5-ea61-4e8a-81ec-5514b231dbb7", "comment": "Malware payload (Mirai)", "value": "5791d38d719e534e9a114ec2506e631448b5518f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748126, "uuid": "a0c2ebc5-b73c-4370-a950-771728ec2f63", "comment": "Malware payload (Mirai)", "value": "4644adef7c3340cfb1a65c2a477dfecfb42cfd757e139aebe27325a7f288cfe6fa3f38574092b652da890e6441b1e408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748126, "uuid": "21cd584a-cee1-4fbf-96d6-7bd3191a7aea", "value": "T15AC3285AF8819F21D5D622BEFA4F518D332367A8E3EE7112DD245B2037CA91B0E7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748126, "uuid": "87174c5c-5618-4f0e-830c-43fc4dfafdb5", "value": "3072:TOjgZiW94ZIxKTO8AroWwZknlp5/WJsMOHa+lPsnGom/OM8dhKgE9Nvnb9+:TOjgZd9KrOVUW9n5ILwa+lPsnGokOvKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748126, "uuid": "3efd0477-086b-4dc0-91c4-6afd8b283e5a", "value": 129064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748126, "uuid": "1fd63a41-5c74-40cc-870a-e3a937af4c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748126, "uuid": "96287c9d-7b5c-4cdc-a3a8-6100b8b02aee", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c6220a-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788807, "uuid": "9dd81ca6-8c15-4f9d-a12f-2b7a5c581a7e", "comment": "Malware payload (Mirai)", "value": "20c708e0a7957e53880fdb01fed31d16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788807, "uuid": "53f5e1ed-906b-42ef-a9c8-ae3a78112921", "comment": "Malware payload (Mirai)", "value": "230bfc4605e6aa5ab39f7c5049f246360a6edc6da1fb7209957bfa0dc4163aa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788807, "uuid": "0c7f5ab3-a9a5-40d6-83f4-c65184f57ed1", "comment": "Malware payload (Mirai)", "value": "b50a9089ce475a8c25e98d19f91dd129fb871303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788807, "uuid": "ad99cd01-0bcf-4e35-ad9b-4b6ef3fb72a8", "comment": "Malware payload (Mirai)", "value": "8f761713aff49dbee81f154d17a08bf8dbace701d607448721b01b01b7e4f40fde61b420f462ea148fbefab24d8ec1ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788807, "uuid": "87c268a3-af55-441e-a8c7-73b07e3176b7", "value": "T167733991BC819713C6D012BBFB6E028E372613A8D3EF32139D226F21778795B0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788807, "uuid": "ecbdbc19-11e3-432b-ad3e-4b55ea3ed2d2", "value": "1536:CnBtsMBC0J/L+HeCx1Ol1QS0XCSkdOLcpvDV/hVd:CnB9J9aOl1QjSDlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788807, "uuid": "52df9581-4be5-4b79-93ca-2cb33226335c", "value": 75472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788807, "uuid": "694b3554-621c-4522-922e-b2ca43b601d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788807, "uuid": "69e00a63-2ff1-4ebe-ab6d-66d229509fc4", "value": "XDarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be13210e-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783753461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753461, "uuid": "6e5d7767-b049-4a26-9e37-42f841dc9582", "comment": "Malware payload (PureLogsStealer)", "value": "d79ba46991aa32b507a43d1f9e1b5164", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753461, "uuid": "99053d75-f087-4b93-acf3-22a72f1f7fa9", "comment": "Malware payload (PureLogsStealer)", "value": "23ac49199d2dd8bd67f71c43afe84526efe5cce2c1fff478b2b0db24a91f8a77", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753461, "uuid": "c19a9654-af78-4622-a3d9-b14211d25a64", "comment": "Malware payload (PureLogsStealer)", "value": "8a7b69f08a7baf3067306cd5dc1268f2f4ef7ac6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753461, "uuid": "5d61d1d3-5628-4c7e-a2cd-8410b361443b", "comment": "Malware payload (PureLogsStealer)", "value": "53cd8e6c6c899a0275a22bbd47a1fe240aa0ccbe69be59f05c3e90bc09a6ca61555cd691ed283852893226a0e820c577", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753461, "uuid": "f5f637b2-6ac3-4ccf-9774-5d4149d39330", "value": "T1C9A537D4CB56307DB1B64384ED498219A70EB6D413EFA82C31B56EEE577310A1AF932C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753461, "uuid": "19bbcda6-4014-47af-9abb-760ab09e36e5", "value": "12288:WiMXvQPlvaXXh36dwrMQVL62yBgvNcan5:YtTIan5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753461, "uuid": "e7d71d86-c623-49cf-af34-79bfe8edc304", "value": 2151638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753461, "uuid": "6ac676ad-58c1-4105-b7b3-0ca21c9b9d81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753461, "uuid": "118c3e6d-4bc9-426b-b030-9c9c950846b2", "value": "Requisition_PO-260000710_2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55efd1f2-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783783351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783351, "uuid": "15c77cdc-13da-458e-bffc-a318a9d678ee", "comment": "Malware payload", "value": "afb638027b08ad1eade161500f137d3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783351, "uuid": "5ab493e4-2432-4a2a-9e3a-0414445f9d02", "comment": "Malware payload", "value": "23e104fb19d9af0b1146f54915f2bdfb3f88aee0db18161b6a9e9e20a7af9ac8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783351, "uuid": "34e2d9ab-0fae-441d-bb08-3a1f721a4823", "comment": "Malware payload", "value": "2da7c2f0e434b4b887a162f5b733e405246a4b87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783351, "uuid": "13fd4ea0-26ba-4960-85ae-0ee016bd1cf7", "comment": "Malware payload", "value": "2b9539f4b26b7b278e687a46689dddecc7c21cc93e607f6a235e9b5e389b9c4e7539a271ef0c9fb3e32f37c5da1b0357", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783351, "uuid": "2832ff3f-71de-4fb0-8ab4-662ab4532bfb", "value": "T170935C42B70C0E43D1675DF03A3F27D1D3EEA6E021F4FA88691E9A4591B2E325586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783351, "uuid": "e08c2110-1e31-4e62-ad05-18142b36d8d9", "value": "1536:BvkOWUiQ3mTX/rL98ylqnVR4TfvS1H1Kz275ArK8G24vNMWXyCYbDRLDRAlFZL:B8OWXkmTvh2HTArcZMdCYiZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783351, "uuid": "c51ce07a-eb66-44ab-887d-1a3972ec116b", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783351, "uuid": "26a6aed1-a350-4a4d-95ad-46d70c762040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783351, "uuid": "692fb7ad-87fd-4382-8c8d-85320261f80c", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a758b30-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753348, "uuid": "952085a3-020c-4da9-acbb-acbc9ad04d34", "comment": "Malware payload (Formbook)", "value": "19ec7d044d316975cc1c72e7cf258ffd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753348, "uuid": "b6a41bcf-969a-4f4c-8bd7-73fc4f2768d6", "comment": "Malware payload (Formbook)", "value": "24d107d2614fc2b42de13e05062a3dcc2de1d1525ac51351758ac515fa2637b0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753348, "uuid": "fa0fab1c-fea2-42ed-a3f3-eeeafdff635d", "comment": "Malware payload (Formbook)", "value": "86f89375eda7bc4ddef1df4ae6fd5ed88e1a6c1d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753348, "uuid": "ebd93823-9d74-4b6c-ae3c-a62093d7e80e", "comment": "Malware payload (Formbook)", "value": "82745284cb5f400a58726af8f19140d35f49093c50548cf8bb740520e7f20c589302a036a5266d981f01bf3568fbd6ca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753348, "uuid": "405862e5-9a3d-4a58-a509-8e97f3269ce7", "value": "T102452310ACB9AF26471C5327642E2F0C77B14F8A188D51D223F2D59B1FA6B25D3A793C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753348, "uuid": "a5f0036c-0110-49b8-8fa1-786a468c157c", "value": "24576:lotKgNDhIgaNwuxt0049YS2lVsifBeHn6xibmh32TBwzFn0t:GpAOLWYi/6a32s0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753348, "uuid": "4a60b56a-d109-4936-9f16-f1517c8e082b", "value": 1280207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753348, "uuid": "99457f2c-3a7b-43ab-8c51-0b1517d08fcf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753348, "uuid": "d5ee4589-a8f8-4b43-ab8c-60e58dbd8ea1", "value": "PDF_INVOICE_893458548_PAYMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b86d659-7d23-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783772543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772543, "uuid": "db42b9d7-bb0f-44ab-bc62-2fe1f2d7ab38", "comment": "Malware payload (Mirai)", "value": "2b11e2a1a34f186e865f9246fe798203", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772543, "uuid": "de89fc6d-06cd-499a-8055-482641c859a2", "comment": "Malware payload (Mirai)", "value": "27abf201d34e868c4b9db621a0557abb4d9fef2ef2e38fe2961b90404f1e53ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772543, "uuid": "81fc2977-8fd8-4234-9340-ac7fe093dfea", "comment": "Malware payload (Mirai)", "value": "eb6cf56e36a08a9d7a446544ffc75ecdb0fb93dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772543, "uuid": "73cbf06b-6d17-4f7e-8a74-60655f05bea6", "comment": "Malware payload (Mirai)", "value": "e5ccb8f6ad64d382fdf3cfadee2e07d35ffd3d0d709580d0466b70e8fdfbd43b827726f8a374317e8151ec6e20f8d817", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772543, "uuid": "da0f7f58-363b-46bb-a100-addd7c8c71d6", "value": "T15EA3098AB891A724C2D216BBFE1F018E33134BBCD3DE735299145F64778B95B0E3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772543, "uuid": "08b24478-a8b2-4bff-9971-ad730d05073e", "value": "3072:rTq7BV8Uf9WMXRtAKcOfhIH8k5Jia/DvALYvv/bvSw3:rTqF3WMXRtAKFuH8Cia7vAsTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783772543, "uuid": "e174a3e5-e1bf-43fa-ad73-86b40db3b512", "value": 100340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783772543, "uuid": "54e154a0-14a5-4273-af72-e63907baa243", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772543, "uuid": "f6d3dc7f-33c3-4b54-9e25-4e24b25d0e40", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dad544-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753369, "uuid": "5f2e2fed-cfdc-4d3b-9bd1-c43c2b17725a", "comment": "Malware payload (XWorm)", "value": "734c99409334b17410f097536858121b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753369, "uuid": "a5aa5275-2933-4c63-8f3d-902c3455fdd7", "comment": "Malware payload (XWorm)", "value": "287a7ed1e02784380cccc542572a77088038703fda097fe0d9861e6eb8d43525", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753369, "uuid": "11945252-3093-4639-b8b1-4cfef50b2105", "comment": "Malware payload (XWorm)", "value": "9df83579c0e39448f5559cc901035d9dc42d5109", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753369, "uuid": "91f44015-3de2-4cf4-85a0-456a40005c3d", "comment": "Malware payload (XWorm)", "value": "e77ceff9c5234296662cfdf68e372d184b7c241aeb034d73488901bac9e35dc7c27e760647e17444a3c59b750460aa2d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753369, "uuid": "2cd379b4-2441-4bc2-a798-df55e2bbb323", "value": "T18EF2074EA67BE06452E77E8CBB3DF0102D5CBE7254C1706D385EF4DA6936B8A118F40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753369, "uuid": "f38a9abb-10d6-47e7-8c34-aa9355daa565", "value": "192:FpC29sCPUnNoXRHmfB7a6QQq3TTp8TdePEh956:FEnKhHkB26lqjTpiY46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753369, "uuid": "5c2a5abf-8123-4e60-a44d-cec6cccbe321", "value": 34311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753369, "uuid": "1c4621bc-edaa-489f-9fb0-deb99afce6b3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753369, "uuid": "9d842291-0f2c-46a8-88d0-b69f61251e8f", "value": "remittance.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da3e663-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749756, "uuid": "e844e4ca-3c89-44b4-995c-8ece68a51ffc", "comment": "Malware payload (Mirai)", "value": "e3ce48fcbc399938c3b1b927fbf02618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749756, "uuid": "96bdca24-1582-4165-a589-f0c48b64d390", "comment": "Malware payload (Mirai)", "value": "29cb91509e46e64b294da34d918f81e2133df0cfff3bb600897f7533b93aa068", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749756, "uuid": "310fef75-118b-458e-b882-5b0e1792149c", "comment": "Malware payload (Mirai)", "value": "aef16fcf0b972142f21f8a023a65230fec4a8f88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749756, "uuid": "2b944ad0-96d9-4aee-ae66-ffeb9c9ed739", "comment": "Malware payload (Mirai)", "value": "11178c59a5bbbaa22f38dfc3cf9da0c2895cd612079072968bad91d248207be5f88fadd4a7cdee8dd0baa0013033952f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749756, "uuid": "d77a3f76-8a20-4005-b257-b9e576de03a8", "value": "T12E2301A6527DEB3DE053D6B3689DCB80FE3A9F01D5888F4D4D69321B4E2BF421D21980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749756, "uuid": "801b7f67-62a6-40e6-8918-a7dff942e2ff", "value": "768:K+an3RY7qKS4o2SeAgPBOAcLo2IzGv0u+X08lhPwSNIlDGGf2Auix0Yb:i3+7k4oZCAo2yGvB+X5GKe2Mxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749756, "uuid": "372f34d1-5723-464f-945b-e359a6b870c1", "value": 49500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749756, "uuid": "9d32564a-02b1-4aa5-8144-4694875f5c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749756, "uuid": "8a11c1d1-11b6-4ae4-8812-78f1e77e9a78", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35eb8ad-7cf2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783751806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783751806, "uuid": "ee3b0a39-daf2-46e8-9fe5-d72e98fa9c9d", "comment": "Malware payload (Mirai)", "value": "5e3593a9dd40d667f6d7e5b8e7007840", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783751806, "uuid": "df104feb-03db-456d-94dd-7ae52ef53da0", "comment": "Malware payload (Mirai)", "value": "2b98f265098d19b9d749ab1c5db9036edbf93128900fe4f12e21f87ed8d54f5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783751806, "uuid": "234418a6-2174-474d-8ebd-072064231abc", "comment": "Malware payload (Mirai)", "value": "fc6f549347e4699dbe82b1fde7b75a55fb76f2c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783751806, "uuid": "834c6250-d4ee-4a9c-94b6-a2706951b8d5", "comment": "Malware payload (Mirai)", "value": "85516f7376c047907cea6f49db28b2a59bfc497344f5e1fcbeb15fa48f9fbc8b29e036e227466126cc14a2c7408d4e51", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783751806, "uuid": "1b60a6b8-a4e4-4da8-bf36-5456fd0858c0", "value": "T16F21275D509727774601DF68F66291A7B03BFBC81255F72CF3593A799C9C5003820AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783751806, "uuid": "c46eb679-1b60-4538-a402-ddac3d54363d", "value": "24:QvQhBh9M0o7tvmtdtJa8tJQYetJxKxdttMtvRtwtJavtJQYJtJxKxwttY:QvQhnoSEmaHmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783751806, "uuid": "d773f8dc-70de-42ac-b815-3c75155a1576", "value": 1234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783751806, "uuid": "3e555ab4-f51a-4a5e-9ab6-8c005033649f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783751806, "uuid": "ac34e373-3ea6-4406-87ba-0b15cd5989a1", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f20b7ae-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1783753356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753356, "uuid": "1eee60bc-0c47-4109-9a32-9036933f2e33", "comment": "Malware payload (PhantomStealer)", "value": "757cec626f994de3e65d82ce17a29d14", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753356, "uuid": "5baad455-76ce-4e56-8560-59a8a9ae4f5c", "comment": "Malware payload (PhantomStealer)", "value": "2bfeca0ba891310daaf48750cec82329f5c8769d29384ef3799c0d5fbc1d8788", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753356, "uuid": "6ff8dd2b-87c2-4776-8990-bb3b0ce147df", "comment": "Malware payload (PhantomStealer)", "value": "66db2f408096d07db2ad13b0b6e031e6c7f38b36", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753356, "uuid": "df2ad617-0a0a-4ec9-a3fe-59eb60812d4b", "comment": "Malware payload (PhantomStealer)", "value": "20633d2b41803a43cae5e41b8378bda46930ca7826b66932125c76299448bfc2275c2a8442c4cebe769edc16d2b885b2", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753356, "uuid": "972c2066-3a73-4af4-90ea-c1e0b2e45a28", "value": "T1B835525D9E0E63226E0C18DD320824E1E5683936CCD92F9DF8055FF879537C6B6EE891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753356, "uuid": "294e6d2b-9009-40ad-a774-3e9225909242", "value": "384:HrFGR/bjLUK9QSEUZjMdEwKCRPAJ8HNBDdh8hWDGo0BDdi/mEzeHmUTN:mWKCFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753356, "uuid": "ca7cabea-ee8e-42ac-8924-1d4d517233dc", "value": 1133379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753356, "uuid": "77f97ad9-21b7-42c4-af24-92f0cdbf9fa1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753356, "uuid": "4349931b-b436-4af3-91a5-3d826c90df6b", "value": "Teklif_Talebi.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c952ae62-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1783753480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753480, "uuid": "ffd3d49b-d94a-4f1d-be32-4d1415ea5e32", "comment": "Malware payload (PhantomStealer)", "value": "2588878e151f154c12f26334bf9905dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753480, "uuid": "34868e7a-0f4e-4c01-bde7-01bc2f6559e6", "comment": "Malware payload (PhantomStealer)", "value": "2c00df08acd7500c2cdf62c40aad9cf5996a2c14fb985192fc639f8cd835e380", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753480, "uuid": "d3757643-fc55-47d4-a0fa-50066df9d9ed", "comment": "Malware payload (PhantomStealer)", "value": "c3f27a31f3dc87e990d8ca4a4ecb5eceb1374fa4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753480, "uuid": "27ca8161-8022-4856-a9ca-d8cfde9eab35", "comment": "Malware payload (PhantomStealer)", "value": "a00204c47d194a6351019de0eb0e5b4269c7cc0217fe5619ef9a79e0919d874d74c5add19ad0f3baf9f256090a5cefcf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753480, "uuid": "0573428e-8f29-4913-984e-ac1936987a29", "value": "T1FA26F2205F882FBF89AC1A18D0BE171EF3E106854167BCCAEF737D499FAA7404527199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753480, "uuid": "38fc9404-0ef7-4e3c-89cc-09a7e665c544", "value": "49152:v7RxxsqfVTrEaLnQplc8UKGiN7iidd5s5CY7EEP+I+q5Z7eR9:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753480, "uuid": "cb79ce49-85da-4a50-a9e3-339d3c59d812", "value": 4814232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753480, "uuid": "73805e96-d003-46ef-bb78-0e7c99cd2b47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753480, "uuid": "c4c3c87e-0d30-49bc-bbea-7d6b566f0f13", "value": "2606251QHHJ9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fd56be-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766953, "uuid": "e15b23aa-f629-43d0-926d-a936cacc397c", "comment": "Malware payload (Mirai)", "value": "b75ccd27ea0f2eb5dfd3fe65c2a12142", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766953, "uuid": "120c863f-aea8-4293-a5a7-64889461f70f", "comment": "Malware payload (Mirai)", "value": "2ce459b1173b13ae5b2fe54d35a269b989cc8d4d290b7b3cabb221665744aca6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766953, "uuid": "b5fe928f-987f-404a-9c3d-f861fbd2d7d9", "comment": "Malware payload (Mirai)", "value": "5366f1e5c8611579c716c2f84a3ba990716434d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766953, "uuid": "488d765d-20c1-4e6e-8c4a-e12098e41f76", "comment": "Malware payload (Mirai)", "value": "a9966f9ea4e7145dd438c574bd9e59aae2ca09f29a0e9a92b7bc65db3033a450c87c405980da498341772ae2302bc6fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766953, "uuid": "440a0867-f63f-47df-a0ee-d300db300d49", "value": "T15AC32959BC929A13C6C616BBFA1F42CD372623A8E3DE3117CD155B2532CB51B0E3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766953, "uuid": "dd0b5444-4dce-40d1-a393-cce67b795eed", "value": "3072:UwoFKkcytgEzeoonj77Z9jSQtCPsOnbX8:UwOKkT5sjSQwEyX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766953, "uuid": "412bd9d3-c8eb-41a6-85bf-63c67a1b373b", "value": 124276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766953, "uuid": "27386deb-0137-46f8-9544-c28ba1b603e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766953, "uuid": "1b491e19-d93b-4b23-b241-057ca3bc601d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4f5e6e-7d3a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783782508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782508, "uuid": "59005575-7b20-4e4c-a3bb-d586eb4a1eb7", "comment": "Malware payload", "value": "59817a56b8d7bef7341f44d692f2d9fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782508, "uuid": "08b35b3d-7ffb-4c50-835e-6138a4c6b45e", "comment": "Malware payload", "value": "2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782508, "uuid": "6e3e225c-a964-47e0-9ce8-c95173eac968", "comment": "Malware payload", "value": "2a15f715883f138a5583ddce00f5b958cdd29953", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782508, "uuid": "fcaa667c-202c-46db-a340-d515d6e37b04", "comment": "Malware payload", "value": "4ad3dff1abae0dc1c816468672989c2d596dbbb871028d0d91f3670a08dd6cccbbaf67e6419df04a8e00a561c2c78d13", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782508, "uuid": "30e1eced-bfe6-425c-851d-47ca59fd419f", "value": "T1835166C422A22D703CE69D2B71698864B5C676C1EDC24FC1A0DDF9F568CDF09B905AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782508, "uuid": "f5c3cedf-99b7-4bd0-9a92-7927cd363eb6", "value": "48:2RKhEcfEnsTE1hxQfw9DpuOqCdH+3snlFvOuRX:2RKhEcfEnsTE18Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783782508, "uuid": "7a3f671a-92bd-4d4b-9c30-994b840957c4", "value": 2997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783782508, "uuid": "7d1eccd3-af3a-4bd2-b0f6-ae7379f2353d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782508, "uuid": "8a20455e-2a07-48e1-a0df-48b148a74838", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dcf022-7d1b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783769421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769421, "uuid": "7a10a922-2a9f-4f26-8d8e-51570d4831b8", "comment": "Malware payload", "value": "6b196a72f39964a5b2e532d2fab6820f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769421, "uuid": "63d7bb26-0361-4671-8bbf-d46b41331b6c", "comment": "Malware payload", "value": "2d2c5ca24b90ba9d895dc4b19bb7e4a44c11265e028d334febc0702276896509", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769421, "uuid": "6da97d1d-4af5-4d32-99c8-147aed47e4bc", "comment": "Malware payload", "value": "1d947d4cdd0c23cfbc4a101ff957384503ebd313", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769421, "uuid": "e56de32a-5c05-4bb1-9894-8222fbde6ea6", "comment": "Malware payload", "value": "f2839193127f8f3353e65df2912a431febc63bb2d693c0c4adb3554cc6838e8fa9fd00e5540c4c2c9bf3106dc693d589", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769421, "uuid": "fcb7f6af-982e-48ec-8383-d480eeb9c027", "value": "T11CC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769421, "uuid": "f1301040-15a7-4910-85e9-f7badb6c3b50", "value": "768:B8vCB+25j6es8R59FYpMSUpi+20qUpi+20YQX:B8l25Jfd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783769421, "uuid": "edd88149-2d7e-4317-a84d-9c7db00b4f9e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783769421, "uuid": "e921cb0e-72a2-4b5d-832a-ce408508fe3e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769421, "uuid": "e42b001c-7f30-469b-ba5c-b1b3a2e7afcd", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fba7c07-7ccb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783734727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783734727, "uuid": "082450fb-2494-436c-94ac-b5a2bd59fa9b", "comment": "Malware payload (Efimer)", "value": "f4c787bb3a1f5bf7c0824bf9ff0b9302", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783734727, "uuid": "a1e2317b-85c3-4345-9b4e-6b34a97ecf48", "comment": "Malware payload (Efimer)", "value": "2db0b1f45b14652b69ec0a626e0d21f33218dd5ef99017f80e010c7744a44b41", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783734727, "uuid": "93ebc273-2355-47ba-8537-ab6450936523", "comment": "Malware payload (Efimer)", "value": "4e13c20a58b916a79f40758ef991fbd5908fd180", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783734727, "uuid": "2a47a455-51bf-4969-a086-4b2a95b25352", "comment": "Malware payload (Efimer)", "value": "f72f8ee92a688e96f17ae4b0c7f55220c5c350fa90018ecefb40aae7adbe740b9719e97a987608d69ba981795b1df03b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783734727, "uuid": "9f8bbdef-b8e1-492f-bce1-3001eaae012c", "value": "T16AE6335876E411EEFCB3403DEDB285A5E12538721B71C9BB0798A7A26F271D04C3CB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783734727, "uuid": "e71f9452-9456-4610-ac31-4341e1c82746", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783734727, "uuid": "d14d33e2-97ca-4b98-8444-d5d3a11ef380", "value": "393216:7KTwXtEgiYt093MbHdMXMCHWUjXtcuI3/PGTAI:7KIOgiYtGaHdMXMb8XaH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783734727, "uuid": "a36273ec-d2bc-40a8-87c7-a57469d72daa", "value": 14293962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783734727, "uuid": "07870df4-004d-44b8-b18b-58eeee27f5a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783734727, "uuid": "83120ef9-90f0-4abc-aab5-cb541a627ae8", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23127e1c-7d45-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783787131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787131, "uuid": "55492d8e-768e-4ebc-83ce-ff5d0a1aace3", "comment": "Malware payload (Mirai)", "value": "78f6f84cd02a58dea313b50a1310ed26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787131, "uuid": "4ea67a77-3329-4b08-b0ec-f0a227b2fa35", "comment": "Malware payload (Mirai)", "value": "2decdf6773be550512179ea8a27f9bda88887649ec0872cf67efe00d99c0ea31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787131, "uuid": "14d07f40-77cd-40b8-aa11-e61319e9d9c9", "comment": "Malware payload (Mirai)", "value": "71458d1b506c6aa9dbf8d7ae2a9d037170cb76ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787131, "uuid": "7594db1f-9f64-4eac-ad37-cc634c1a0556", "comment": "Malware payload (Mirai)", "value": "9c8e62ca41f44c924f605c6d92dcde8ab219d6c37aabbbcb82f16507d5f893ae931175f76d39c3875efd60e9796a62f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787131, "uuid": "e090042f-abd7-41a6-ac48-1270d86f6c2e", "value": "T105E38EAC9E1E6D83C2C7E3BE9D590FA3312778B44564C2F61E00928EE5DEDD598F1422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787131, "uuid": "a1b1be15-8dad-4e32-878e-ac7c4229dea1", "value": "3072:2EKIoOxNCrs10ndVzYN6OS5YoqIXRcvblIZL8xFKhRYgAD:qI9qg6TWS5YoHX8lY8rKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783787131, "uuid": "c73e28c3-70e2-46eb-8eff-681e756b7c97", "value": 145384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783787131, "uuid": "98795288-9148-4d9d-bcd2-263f13e04884", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787131, "uuid": "62dc128f-34a9-429b-811a-b586875d70c9", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb32af2-7d83-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783813943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813943, "uuid": "19425d63-1c86-4e82-af49-651342b8c189", "comment": "Malware payload", "value": "1bfa77ff91405a0b1fb38457d8030ced", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813943, "uuid": "ddeb51bf-7426-4ea1-a769-05402a7e7c1b", "comment": "Malware payload", "value": "30add75b83a74e078a70e970d8ae2b604cac0d4a06e3e03bd61b9faeba64e5f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813943, "uuid": "98a04822-e5e0-4b73-810c-d6d56a31575e", "comment": "Malware payload", "value": "ff4ad7b3804b0a65e52af3b5d47f5c7ffabe1e96", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813943, "uuid": "1d2ecdcd-881b-4239-9c47-07487d3a5eed", "comment": "Malware payload", "value": "e3bb0db4f1d56aab39d4bd8ef0077afe5b9a5963faad37b9091f5500c6b7f819cfb452edc87241ea2ee4c48f7ca79610", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813943, "uuid": "7b518c1f-b669-490e-8ace-45262bb90157", "value": "T179C54807BDA049E9C09E923199B751A67B75BC090F3223EB2E90B7782F727D09D35B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813943, "uuid": "24a4a643-c0bb-45fb-a9c6-7f396bca4377", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813943, "uuid": "68257cc0-5f81-4d9f-a05d-346095e1112f", "value": "24576:tZZyVsLpgRbNQs+9S8pVcyvUmcDLfBC+CGVuuZyxYrzwckaq5vA2Bele5rK2y0HF:tZZqsdgDQ0uNVcQ+CGhcxYHwVFT84n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783813943, "uuid": "a50abfc4-718e-4dab-ab00-d11bdc18589f", "value": 2544008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783813943, "uuid": "6d49a4f2-30b9-4456-a6d9-289200fdd5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813943, "uuid": "9044f98d-3448-444f-8f10-31bbb18f69ac", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0665ef8-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748365, "uuid": "603a00a7-145d-4398-8de1-a99e20d5c75f", "comment": "Malware payload (Mirai)", "value": "9a60708d933a2a104c193bcc45351b93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748365, "uuid": "92a7e2bb-88e1-4b8b-a25a-0bff6a75f618", "comment": "Malware payload (Mirai)", "value": "31b5215d2bab7691c47f8e27ed17fcc99b20e74d56e3388987ff20ec92f70d97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748365, "uuid": "27b6ee71-b5ec-4566-a2cc-be83e4b26834", "comment": "Malware payload (Mirai)", "value": "a0a3c5838ab89c92e5695cb46cbca4cc4760e94b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748365, "uuid": "601897fe-0976-4f4c-be74-c27e17894ff3", "comment": "Malware payload (Mirai)", "value": "b1ec8aaa3181b698eafbc877b2e088f544ab1b60b3b63957a530d10e59e9587c53ba1a9fd3266b02687f65b32532bf63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748365, "uuid": "937c8ef8-3051-4e73-9a8a-5f1a29de36b5", "value": "T10C344D43AA43EAF2F01315B112AAAF635931EC3A4C2FC4CAE7647D71CDA11C4962673D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748365, "uuid": "326cabfd-b760-43de-8a56-f966677a00e5", "value": "6144:nQ6x6vsYVnxPrwTZ3nEFHs2IZzQvxqxAdnwqelrmt+:nr4vskxPs9OgQvAqelY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748365, "uuid": "fbc71e9a-d16b-4296-970a-645055cec7a4", "value": 245608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748365, "uuid": "6c2ef04a-7785-4451-b611-8b7780079e72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748365, "uuid": "f12f5bae-946a-46c8-841d-ae2d696d7676", "value": "kworkerd-events", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcb3f86-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749760, "uuid": "23fb13b8-de08-45f1-9ab4-06fd15b681bc", "comment": "Malware payload (Mirai)", "value": "73bc566f368dad5f51f1363dbc5efe5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749760, "uuid": "4710a7f9-d894-45ff-8e8d-3a1ab6ac4e5f", "comment": "Malware payload (Mirai)", "value": "32cc30b4815f06da7a99ab9a3ba22bd54e390686e5a652ad13a79fcc88302c8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749760, "uuid": "eb13d390-bc72-4203-9e4e-0de15648dc7f", "comment": "Malware payload (Mirai)", "value": "8fce6f83906499954450dd02b55319ea6d69d203", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749760, "uuid": "2695e2cc-4a0d-4b17-9e89-35c4d48b94bf", "comment": "Malware payload (Mirai)", "value": "a9704975f2cc5e4c66ac657fa986d780d87b02df1962f902c857d2997f2f006d4ab7ee98f85839a41f8c47a4ddbabdc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749760, "uuid": "a70dfc72-3acd-4b24-baab-bdb3ead010b6", "value": "T1CBC36C22B4791E27C4E0A47B12F75722B1F657D915A8CA4E7E720E8EFF112D02907BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749760, "uuid": "15568912-a052-448c-83b8-582c6669a90c", "value": "1536:eZiuQ4LdR2JrmiofE/Srjq5mQ14WrGExdZCvhnXAlQAM7+tIMPYm5UOhAtxftGb/:r3IbE/HPQfKKaYOUWNbX0sa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749760, "uuid": "fa677aa6-9c37-45a6-b74d-2f2b6a00f753", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749760, "uuid": "a25bad60-65d4-4bf8-9b86-b0c52c4ecbfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749760, "uuid": "d7f17808-6544-4994-b0bd-f632475ebe23", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbb87b1-7d34-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783780168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783780168, "uuid": "ccbfc182-aa5a-459c-a749-0d1b0778a9d3", "comment": "Malware payload (Mirai)", "value": "300dcd73582cb65e0dd212a4dc335b6e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783780168, "uuid": "4f6857d4-327a-4772-bb27-43eaa2806bac", "comment": "Malware payload (Mirai)", "value": "33e6400234bb98fb79e3432320011d45b94b212a898d0530dd9a330193824240", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783780168, "uuid": "2d99bb9e-c6a4-4d03-8971-98382d73216d", "comment": "Malware payload (Mirai)", "value": "29d3e4940afb86e8e2782d73c3a1b3b80bfa334d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783780168, "uuid": "5274ebe6-181a-4421-902f-bc8a6bc5907a", "comment": "Malware payload (Mirai)", "value": "101d73d539cad61d947ed0ca8bc0e1b238c25c23d17d75db7d89169d975f6ce1a2b460120b9dfbe8c3c473725760a058", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783780168, "uuid": "27102839-e813-4567-8f52-f19e57e2fe59", "value": "T19E833AED799C63CBD6C002FAA6C8E4266B5FCF2186E8533CD40447B06C65775AD2A1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783780168, "uuid": "a005878f-b8d2-4aec-8f82-c6aacb8e42f8", "value": "768:VORclSkxI06LpGSILAwTbjolTGnGKoyumGKa+rzmkOEmCUBi3adKGQVhRytzCo6:Hhxb6LpGPlbcl/KoyuCzDv6xs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783780168, "uuid": "4c4948e0-940b-442e-b846-3791839d6b50", "value": 81632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783780168, "uuid": "fa68ba99-4b85-4f38-8477-6416d712c970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783780168, "uuid": "4cdff11e-e77c-4989-b535-843df804675a", "value": "bot.csky.sighup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a28b7f5-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783752864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752864, "uuid": "9389d4a8-4481-4d6e-8021-2c3b1a3a0efe", "comment": "Malware payload (ACRStealer)", "value": "6f1cac94ae8d19156d4e5b9195dbc3a8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752864, "uuid": "37c4c0be-6271-47ff-801d-a946d71c3dbe", "comment": "Malware payload (ACRStealer)", "value": "34c37d16da934f0281861d55fd766ddac8e1860e9f62204bbb32cfb0052f51d7", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752864, "uuid": "5c3bc4e7-aed1-42b0-9c35-6841a430407f", "comment": "Malware payload (ACRStealer)", "value": "4650af8773928d573c84f4efe2930585cd1b4314", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752864, "uuid": "7e561287-e69b-4e59-89a2-b653b682523d", "comment": "Malware payload (ACRStealer)", "value": "0644428ef1493961e45a46f3a37d79691f2f2d3c9d923125989e1d879545ef8eb2772603e847da6455d614a618fb0089", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752864, "uuid": "274b4be1-5543-4b32-9074-9a45a274932a", "value": "T1C2F6D016650424AEC0EAC7768E27A417E736745573F1C9DB36AC8A0B0F27BD0EA3B711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752864, "uuid": "ebd7066d-8d2f-4e3e-90b9-cf70ff629425", "value": "16c8c7a62c852018ed02e453e144c998", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752864, "uuid": "fb06515e-dfbc-4f50-96be-ce1385210208", "value": "196608:BISaERQ63Y74SD9KWUIOLFQSxnwldbNgtz8C:ZRf3gX97UIOLFCatQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752864, "uuid": "2cbf374f-da3e-4755-85ea-c686d4517356", "value": 15294944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752864, "uuid": "459fda02-84d5-4b78-b650-17165d54299a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752864, "uuid": "5da0dfe1-935a-446b-8d6d-3b4a02e8d762", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0d33d5-7d43-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783786474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786474, "uuid": "dd944141-2802-476e-87eb-e67aadcd432b", "comment": "Malware payload (Mirai)", "value": "172a03978661f0d52e5a9c170b0ea958", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786474, "uuid": "f68cee56-27f6-4f9a-99b7-b559cec83805", "comment": "Malware payload (Mirai)", "value": "34c5914364cea48489d453a76641c05fff75e4f10108d6a3d2604501648bb835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786474, "uuid": "ec0b80b5-ca3c-4ed1-b2a0-01d7d8ac3538", "comment": "Malware payload (Mirai)", "value": "ac82a1cfc54f7b0fe5a1c998b5f282d21bbbcb57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786474, "uuid": "1cc76230-bd4e-4184-87e2-76e6e5ae7d2a", "comment": "Malware payload (Mirai)", "value": "f93e91c93d46f28fe434d86e8f990a0eed0e2c9f09c236d27f09226b5c8a42d5659a25c8cc2eeefdbc57f9d6895ef26f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786474, "uuid": "57743649-cdac-4776-96b3-8ee3de7647d0", "value": "T1BA457C57B2B364FDC053C43087DBD6A2A931B42542226E7F65C4CB302FA7E645B1EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786474, "uuid": "bffdc57f-1472-4abf-97c1-67df42e1670a", "value": "24576:dULu9U4krUOAItRTnY44U21Oz5xmHPKpM6XqvL/f:dUK9U4krUaWUHzPmHym6XqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783786474, "uuid": "f3bf4b5d-8f0a-45f0-a94a-f19a575281e6", "value": 1241016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783786474, "uuid": "1840ec8f-5a09-4d6c-8baf-f04614b8d513", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786474, "uuid": "5beac4f5-55f5-4170-b7db-8b35426c5288", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbecf4d5-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753511, "uuid": "4853d5a5-a17f-4604-84a1-61247eb7f135", "comment": "Malware payload (RemcosRAT)", "value": "081b22357849f8bd7ea2981fb84a9b60", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753511, "uuid": "415d83c7-ca28-4c7a-87c0-a6a914944cec", "comment": "Malware payload (RemcosRAT)", "value": "3682d8c438017249510aba8865e979b666265be3ffae760d503f17ccb391afac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753511, "uuid": "01185196-e92c-4233-ae86-b430ae71a1c3", "comment": "Malware payload (RemcosRAT)", "value": "175f7ff6d5ee95f332b93a7b6c88142845332d3e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753511, "uuid": "5a3ec8ef-8062-4ddc-9bf2-1529aba13221", "comment": "Malware payload (RemcosRAT)", "value": "0ed0fd315f7effb32460e359963ced7d03fc5bf36c5b071d00f767c1b03a254bc5c8d3d279f19e369ee992b0110ace3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753511, "uuid": "9f0114ce-bfb9-4ad1-a049-bf5ada666ce2", "value": "T1ECB503D3E35F920A296F293035E94660BD177E5B4DF72A3F221E21A4BF8844317B1D26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753511, "uuid": "611f6e8a-5f28-4371-bcfc-91e5f7e4401d", "value": "192:THqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqHqG:EUiDPX3w/IzH6J8F7cVQZgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753511, "uuid": "184e5cf8-bd4f-4009-b30d-f5e5bbc473b4", "value": 2301067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753511, "uuid": "893f800d-f809-4556-bb19-123c3e8b9f52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753511, "uuid": "8138c125-dce6-49f9-bc51-fc1db18a7ff6", "value": "RFQ M021413-054429.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17baa45-7d32-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783779317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783779317, "uuid": "f47193cf-b628-4882-b5bd-d2882c949f5b", "comment": "Malware payload (WannaCry)", "value": "3c298db49e26f369e361ce7436a92a7c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783779317, "uuid": "8f94598a-ec52-4ace-9ace-906168cff3e3", "comment": "Malware payload (WannaCry)", "value": "368f45e2a86c0e2f36da68db00e55a1ccd1c4277fa41829500f27bee13a10be8", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783779317, "uuid": "010bea2d-a2bf-4491-9719-b6859a582f55", "comment": "Malware payload (WannaCry)", "value": "84821824b776123fcee239b05b05a972ea15db24", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783779317, "uuid": "521dae6b-e1ad-49db-b1a9-5e65a9073871", "comment": "Malware payload (WannaCry)", "value": "9955a666137e10bfbbcd663a0a0718f74236a652e3e2d00134a69473b917de78617ea4ccf559aebdc076e2ece40162f1", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783779317, "uuid": "4aa8269f-3465-4c8a-9206-bf8b79018828", "value": "T1C9366E2488C9E7C0D713A1B7473E46388A511095F3157B56B3B0ABE3E66B09E5EB02DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783779317, "uuid": "37292855-1ee8-49b3-9523-c8cb65de1bf9", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783779317, "uuid": "9113dbb4-0696-49e1-8289-9e45a0ce2ba5", "value": "24576:jbLgQbLgdeQhfdmMSirYbcMNgef0QeQ4kRiw:jndnjQqMSPbcBVQeRkRiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783779317, "uuid": "16dc839b-782f-40c2-8b03-d2f88f312ee2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783779317, "uuid": "f5b43167-e82c-46ff-9b9e-69897d387f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783779317, "uuid": "c521021d-47cd-40f4-9c8c-f676742a021f", "value": "368f45e2a86c0e2f36da68db00e55a1ccd1c4277fa41829500f27bee13a10be8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81334bc1-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753359, "uuid": "3c58aa98-ce26-4c9f-9755-1a2630a305d1", "comment": "Malware payload (RemcosRAT)", "value": "dea87cb6f0ba9e4da0bfbdc589c519ff", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753359, "uuid": "62bb096a-ff51-4406-bc5a-161de08a36b8", "comment": "Malware payload (RemcosRAT)", "value": "369478c13ad42c86ddfacd1943b4aa23d2451ff42d8bbe1a26f664f5d5748433", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753359, "uuid": "ea687ff9-e8ec-4e8e-88ab-68cf026fb177", "comment": "Malware payload (RemcosRAT)", "value": "7faf9d7f0b6999818f2b5ca91fd4fe119e841c88", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753359, "uuid": "5449dac9-59b3-4392-a516-328069eace17", "comment": "Malware payload (RemcosRAT)", "value": "824bfda50e63fe6dbd6f1c5ba378e6668c34e2caf465d43565978bc2557538706bca24e7bd61b343947e8b25735706e3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753359, "uuid": "39719cae-62ec-4d2d-a3cf-5526f6990946", "value": "T1E492E9DAC4D64BC59D173BF68CC4AE0066FA5314E2215084EDBEE7BB6006E6C97B097C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753359, "uuid": "91335394-93ae-4b0f-aa5f-f3dee0f9309b", "value": "384:s+p2IwI3TSbTxbtmekM7NUOFWv2/OcjOsccCq1akpz/QLuecRLU:suwbBpmlSXv/xcrkdni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753359, "uuid": "39d9c432-8859-43ec-b93e-3706587ee9ef", "value": 19407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753359, "uuid": "6a1707a9-9181-4aa9-b1e4-c4cc3b5ec43f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753359, "uuid": "5c36c48e-ef34-43a2-a891-62dd8bc6cf0e", "value": "PO PI CMI260730022.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c428579e-7d13-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783765927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765927, "uuid": "65343c41-8f1b-412e-aba1-bfba9081c78e", "comment": "Malware payload", "value": "3b8b585191b9bf71ecc2a66c91c0c61f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765927, "uuid": "e7b7a6f2-6c5c-4b00-8348-03e541ecf99d", "comment": "Malware payload", "value": "36bc9c03a537a306fa644f607600c2827a77449ba152564f8d33bfbc034d2948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765927, "uuid": "5d06042b-a446-4d90-a74b-05bfa87394d4", "comment": "Malware payload", "value": "5ef3fcbe46ac19cf562906fd79b247882ab30887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765927, "uuid": "1e55b20c-7f55-4a87-beee-8ce9517ee768", "comment": "Malware payload", "value": "d13730acc29882034ff93e30b4198121965790d811936362b1d055e24c04deb8fc74fb0f452f95df80567eacbf3926ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765927, "uuid": "1d6a1f3f-4b50-42b1-9557-64167528e263", "value": "T1F5D623E9A69062D0C4D309B0724793DE72D0B95E46E98D1E36C62C026F11DFF264ADFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765927, "uuid": "3e10c4af-24e7-4a23-ad55-0747679beb8b", "value": "e4a0e75aeb57111b791424e76ca67455", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765927, "uuid": "669ba504-df58-48c0-b8c0-9a1a23524aa2", "value": "196608:uMaPJgGyjJLJxVnbCGMxtN0x/vQavPh3165VW1noXr1cVZfaHOI5RQrQ7dCbD8KK:uMagGylzVqGNYgGrHHdRQqdCxbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765927, "uuid": "244a8f48-7766-497a-962b-1fa241507ec2", "value": 13865200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765927, "uuid": "e0f55b68-0a13-4cf8-a1dd-872416458041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765927, "uuid": "6048ee44-ea0a-4c3b-97bf-3232d78a8c30", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578b696f-7d3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783782925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782925, "uuid": "04406f68-710d-469c-b558-e1872bf8b4be", "comment": "Malware payload (WannaCry)", "value": "fc35e65dda5194a41830396f6e2b235d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782925, "uuid": "da8ce32f-0081-40b7-a8ea-9fb07799e56f", "comment": "Malware payload (WannaCry)", "value": "37c68330c2de182719a5bed679eacbd4305ce6613b2eb161fd50e362eaf6e4c1", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782925, "uuid": "e1806fae-be6b-4fc8-9cbd-50aae4850fce", "comment": "Malware payload (WannaCry)", "value": "b188fa25749696c5dcf1c1e3eaf8523fb890e2bd", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782925, "uuid": "83c7faae-e965-47b3-9c30-caa6f6d7e5d0", "comment": "Malware payload (WannaCry)", "value": "35815effbfffb1b91f173baff6152b49b8ef34ff7c5303b28ebc0b44d9205d8a3711d28ff69dd4918b502538e5453cf7", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782925, "uuid": "456894e9-6770-4299-b301-aa4de3ffc165", "value": "T1B6363354636CA1BCE0510E7484B38D2AF7B37C6A97BA4B1F47C0876B0E53B97AB90741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782925, "uuid": "17b55861-a1c1-49d4-a0cb-6e4aed4a1497", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782925, "uuid": "27a499fa-f58d-446c-800c-4d226a6cc557", "value": "98304:DyDqPoBV1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DyDqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783782925, "uuid": "e076f2ff-7dd1-427d-a980-bc2cee466989", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783782925, "uuid": "3a3af574-bcf7-4453-bb3a-9a75e8547b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782925, "uuid": "b315cc65-0afc-4ce6-babc-9f14829bdd20", "value": "37c68330c2de182719a5bed679eacbd4305ce6613b2eb161fd50e362eaf6e4c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982044be-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783752968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752968, "uuid": "ab6f15b9-a0b8-4dd0-a109-16894f7903a8", "comment": "Malware payload (RemcosRAT)", "value": "b2c830e562f88dc8dfa4bc410bea07c9", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752968, "uuid": "84dd6a74-3f66-48ab-86ff-689b8b25d530", "comment": "Malware payload (RemcosRAT)", "value": "37fefd2ad2ef806d5dd0858f7976a74e1548f99ddd634f9d46fb11b5e020808a", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752968, "uuid": "b4cc1ab8-c0e2-44f6-ac19-cea816cc547e", "comment": "Malware payload (RemcosRAT)", "value": "8534e8c1db0d11efc5328874f757b9431a4dfecb", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752968, "uuid": "03bb446e-f84a-4139-8022-2425172ca135", "comment": "Malware payload (RemcosRAT)", "value": "529ee1a97e9d62f8b8cb114ef90bac898f24fc061b64a667eb2417da7a6144ab705db6b46f88916ff8c20d6c203416a4", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752968, "uuid": "46f3125f-44d5-4309-abed-4a9d4b25d969", "value": "T196D28C653362D016E88589B28DD4E6CB2B66BC52FE53C60B31C4B30F6C399E1DC9371A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752968, "uuid": "ed509480-0c80-412f-a976-fe3b2782cd01", "value": "384:A9fxYtYSk3bLlTmOrB1OYEGSygNWvNXeZ:4poVmLlTmOV6PygNWvBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752968, "uuid": "5760e512-120f-4e4d-ba5a-804b31f0f3dc", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752968, "uuid": "ec323624-048f-490c-924b-8bbb9328bcef", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752968, "uuid": "6574bd14-1d2f-419e-bed9-e07f1ffafd63", "value": "Purchase Order Specifications.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5b6755-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749757, "uuid": "651809e0-35f6-4218-8f37-c002b4da98c3", "comment": "Malware payload (Mirai)", "value": "b759b96a06c16c4d2e62fdb9ada4f679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749757, "uuid": "0466e81c-b4b1-43a5-bf89-d124cddac0a4", "comment": "Malware payload (Mirai)", "value": "383086ae4d3173515be7e7fce8574960cbc0e800ebecc5cf3f36f5cfe395e2e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749757, "uuid": "f44dcca5-c220-4c5f-a467-d94665b5b8b1", "comment": "Malware payload (Mirai)", "value": "e037127a1de55332ced8e1634613a16bd62363d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749757, "uuid": "88f5a0f5-4ab2-43d9-87a4-06ac76f0ff20", "comment": "Malware payload (Mirai)", "value": "09910c477334442d2d9ee1fa19ea481c8f55801afe3b1495e9f46e2c2f7e11b36e2d20cf0e5204b93c86cbda69875189", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749757, "uuid": "3cf69dd9-8890-4d31-b288-16eb2fa9fe1f", "value": "T1D023F1359583ED568B3E9039F998274349261968F56ABAD30A3407BCEF60FD732F1284", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749757, "uuid": "f5211bb9-8a91-4ff6-8d93-bd332ea00097", "value": "768:Fq3Ikynz3NtRlkYAzCHGT/3RIZNN3nqhai9OADADcs1evPFZ6E87yA0TrUyJ4ZoH:WIXrkYs6Y/36Vqhai9ADcxSdV0B2TzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749757, "uuid": "73ca7888-f361-4a58-987e-46860c5181cb", "value": 49320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749757, "uuid": "5f637f4a-19e4-4950-a370-818a4e7ae99b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749757, "uuid": "b66860e7-67f0-4f89-9b36-8d15f05d9a1b", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde5b050-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783753515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753515, "uuid": "91a843db-c8d2-40cd-9b61-b89e6202c9c3", "comment": "Malware payload (PureLogsStealer)", "value": "af85c3fe8e30de2ec4d862bb12fee9f5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753515, "uuid": "e6ace6ef-2dd7-4ee5-a06a-8388a1ba965f", "comment": "Malware payload (PureLogsStealer)", "value": "38d8dbf64062747f22fd847354d4f74282946532899a3def1006004675a55d65", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753515, "uuid": "f869a119-143b-4a1e-8299-231fc645d9da", "comment": "Malware payload (PureLogsStealer)", "value": "1541b3491b5fcd3c349beff1d711e548491c618f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753515, "uuid": "9732c4d5-83d7-4b03-b058-673784435b72", "comment": "Malware payload (PureLogsStealer)", "value": "85291580c3acdf29d2b0ab07427bd9c3cfb27417862020933767ba9bc301055f301b453a1644a969b973ed49dfd844ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753515, "uuid": "99956bab-d28e-4f57-aebf-f0ced7f4bb73", "value": "T12E951D3CCB15005B3473CD28A5853A4B70AB73931DAE9EE455C9867E563280EFAF970E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753515, "uuid": "0506c217-aef7-4e5f-95e6-123d85341670", "value": "12288:4/zNm/rgGZqjTXBaQNVy00/ZoFtnU0LdzhPISNppJHTbXbek:4BmTgG2Q+9JVRpd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753515, "uuid": "29801f71-8a8b-448a-ae95-0faee54a13cd", "value": 1895848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753515, "uuid": "73eb4145-3984-4664-80f1-6a909bfe0d3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753515, "uuid": "b33effa0-3796-4c4f-b6b4-7b577242a011", "value": "Scan_000020260710_PO_008565.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c791b3-7d54-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783793800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793800, "uuid": "f501d14b-bfdf-4178-89b6-7b76ac60b6df", "comment": "Malware payload (Mirai)", "value": "1897953bfe7d04c82134ef661d96492d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793800, "uuid": "0969152e-4d91-47db-8afb-112f58e73240", "comment": "Malware payload (Mirai)", "value": "3a25b82a489e1e0529e1bd2b422199289a205edcc62b8c03aedc05915ffdff1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793800, "uuid": "e4fd1242-f122-4d14-8a25-3d9f100efc98", "comment": "Malware payload (Mirai)", "value": "7f258e4b917506ef4e38498839868718b5032bb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793800, "uuid": "4ecb64a6-285d-41a2-a20b-d186c095d611", "comment": "Malware payload (Mirai)", "value": "e93463663ba32f673ae6ff9b10ad589dc2fbba14152bd7fa66bf54b362c8b97123dfe6c72c520bf8ca7308b0a99b589b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793800, "uuid": "90a6880c-9528-46ad-b9ba-34bc79718222", "value": "T12C03F1C746F5DF15CB2FA6B14C56B6DE6230E01FDA5593622ED090BB46EBF1022392C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793800, "uuid": "4c69fcd7-33a6-4a37-b86f-30041d9e472d", "value": "768:0Tud3PX52+LZg54NocytP5EpRIaB8t+ON15XnnbcuyD7UHQRjb:0Tu50uNlytP5EpRIZ+OV3nouy8HyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793800, "uuid": "30a1c92a-3b1c-4f6b-a9f0-b2201de1caeb", "value": 40404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793800, "uuid": "541d79ff-1b4d-4529-a0da-a4b1d1c50edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793800, "uuid": "388dcdf0-afa6-441b-bef5-48fbc1e48a1d", "value": "titanjr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e4e2d0-7d0b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783762485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762485, "uuid": "82f8b644-256c-4ff5-8cfb-e13c1e840621", "comment": "Malware payload (Mirai)", "value": "3a9f8bb83790bf9db2b2f67cb2300e3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762485, "uuid": "3991f828-f641-4394-83bc-e897821a06e1", "comment": "Malware payload (Mirai)", "value": "3a40e78447d5bdbcad4df28080fb5c7ca03acfcb6b97fd7eed2a43ecc50f8c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762485, "uuid": "33fdc7a2-4f39-4574-b62a-8708c56f325e", "comment": "Malware payload (Mirai)", "value": "2f7f577d76df6db398a90e34b4d14907a25b1ff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762485, "uuid": "44433cd8-49db-47ee-82ca-70eaf5628405", "comment": "Malware payload (Mirai)", "value": "0cb1b70f65e979e1e9135507ee447bed24c7e3d34b3d5558b2462046dee02506c0c4d6fdf781dca4f2862f607d904811", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762485, "uuid": "7a666442-d082-4137-a33c-9f10911acfdb", "value": "T1C9B44A55FC409B96C6C16ABFFF6D828C371317B8E2EE71129D194B3063DB95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762485, "uuid": "ac0c667d-2e34-4bc8-bda2-d9b2bbcd6055", "value": "12288:/75lF2mbY6LfKNL8ds5eD5yW8kcccpCSBIuriXh247K4AWmoide:z5lFRf8AygedEUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762485, "uuid": "f4135897-78f5-4e6a-89e6-2f36fa21a9b7", "value": 498560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762485, "uuid": "e0ea80c6-e8f1-4320-89e3-f0bf8c43d765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762485, "uuid": "bca9434a-bacf-4c63-bf87-f17dc54071e6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6508003b-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753312, "uuid": "ad9ad6ea-ff69-492f-b5d3-34089f85fb95", "comment": "Malware payload (Formbook)", "value": "321e5178dcc199740b11d0978e211cee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753312, "uuid": "7d2f4116-32ed-4cd8-9055-619d38249241", "comment": "Malware payload (Formbook)", "value": "3b1ed6966259b3ebc70c1cb64083d72a20a9c5d8bcdeadc8fff08e408ebcb0cb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753312, "uuid": "8df169ac-b4e6-44da-bc1b-a87dd0b0f3be", "comment": "Malware payload (Formbook)", "value": "7febd4fef3206f28cad112abf5d7b0c4e1a8e96c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753312, "uuid": "3124e026-0f5c-4f72-bcc4-f4a10922f7bb", "comment": "Malware payload (Formbook)", "value": "96510beb9ca19687381fdad914cd4750f4b4ccd8e3e92322ba674af983aa95315ff5e9c0b140221bc1b4912f101401d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753312, "uuid": "2495f2d7-5e58-4732-9742-7dbc95903bfd", "value": "T146A502114AC46FA9CF985B2860FF260DE3F04A8B5056658AE733BD46FFF760092175B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753312, "uuid": "89c111a8-97d2-4671-a887-0a09e2df2197", "value": "24576:vtyixkYB4PKXjMvcLe9qbd7dvlbPwVUlFqzMqtMjpxd/cwQ4qPHyHxiWF70VR:v8sR7tc2lgzMqcSGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753312, "uuid": "0ba50864-fc03-41ac-8f9f-11793681d969", "value": 2074148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753312, "uuid": "77ba9bbf-18b4-428d-9c6d-9b5a73cdbdde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753312, "uuid": "2472e815-d365-4302-89a9-f2a89cae3ab7", "value": "Evidence of payment copy July 10 2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e3f4a9-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748183, "uuid": "414c7f90-eef4-472b-965e-a19cc6df9a40", "comment": "Malware payload (Mirai)", "value": "afd9f378201612060b6bd7366294712b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748183, "uuid": "6e3e6342-24b1-40d5-ba17-0ddb1ed8e36d", "comment": "Malware payload (Mirai)", "value": "3be2e505cc89927908a6ed4bd11aae81500fd7cf0992a3c46b8cfab64278580f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748183, "uuid": "879b69ff-2bf1-43bd-a09f-b7623e4a6fd4", "comment": "Malware payload (Mirai)", "value": "2791ca1b37a693e734459bdd3cda51fac4221eb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748183, "uuid": "72ab5a04-54d0-4f64-9f29-76cf89f0bcdf", "comment": "Malware payload (Mirai)", "value": "36ac1d4bc9860252809887839c77c3691dd495d167b1c5867f76a88d508a7f084529c3303a28ef5e171a92495da91f3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748183, "uuid": "c340efd3-7505-415b-90f2-31f601d8bc22", "value": "T130A30859F8929A22C6C516BBFA0F42CD772663A8D3DF3117CE155F20378B82B0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748183, "uuid": "adc2fdd0-2c5c-45bc-a881-18fa5169b50f", "value": "3072:qZRCjlZQ5eMW3mFX529OVR2M4SaBCRnbC:qZRCjlZjcX5T2MMCVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748183, "uuid": "f5927b84-f39f-4323-b921-96ef519a3ec5", "value": 105228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748183, "uuid": "dae143ed-96b4-4af1-beb4-73f6559557f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748183, "uuid": "52c49348-6706-4f59-862a-5ad6fcba19be", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a2ab8a-7cf0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783750899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750899, "uuid": "361c6e6e-bef4-4996-846b-11384aedc248", "comment": "Malware payload (Mirai)", "value": "379eed379bb8d69448a1d2ddda48f2b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750899, "uuid": "767c54cc-2851-4ee4-995b-8970f141edb8", "comment": "Malware payload (Mirai)", "value": "3c2ffa8e5ee0a6eb7a0e47434a1821bd2d7f52e511abf6dbe65b5fa90f40c006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750899, "uuid": "194b227f-0a43-492d-96fb-2f707648ec58", "comment": "Malware payload (Mirai)", "value": "5363001ae4033f1f5652aadabf75c80a9a93a89d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750899, "uuid": "bdf9eef4-4925-41b5-814e-ac87fb712e2b", "comment": "Malware payload (Mirai)", "value": "6b4ea3069f178ae0571fda9b074ec09dde667d60faf463e8a71a0d8dc0ac50f521dc21737083eef26f9d1f8bcf55a7f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750899, "uuid": "daffdbf2-bf60-4d55-b5a7-afc3b846c1bc", "value": "T154541956BD419F17C5C226F7FBAE4388371A7BA9D6EE3113D810AF50329A48F0E36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750899, "uuid": "b4f9551b-a670-413f-b2e2-04b49eb7ecb0", "value": "6144:DQXfYGC1sczW2Yzlh0kvsQrtYYmYO2SwIrLQmxMQT1X+sQC2yqxAdnjqqVrA:DQvYVscRY5N75OHwaLLJ+C2gqqVrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783750899, "uuid": "d8f0ecbe-b77d-4f25-9cdd-93b8bf86eb38", "value": 291896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783750899, "uuid": "59203c21-4f2c-4def-a652-92c170a6b44d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750899, "uuid": "00002d20-00f4-46e2-8753-a353473c0d9d", "value": "kworkerd-irq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4826557f-7cec-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748968, "uuid": "6cf72c7e-03d7-45de-af46-805fdd7f2850", "comment": "Malware payload (Mirai)", "value": "c3aa47f7a09af5158bb845a8a3702b50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748968, "uuid": "a6141e2c-0002-410d-965c-5f180f50c459", "comment": "Malware payload (Mirai)", "value": "3d33d72fea57c4c28dda41d4f410a4cf5ddf7dd4d5e7ecfa45a27543a746551c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748968, "uuid": "cc671dfd-f95d-4549-8ea2-05184f921f1f", "comment": "Malware payload (Mirai)", "value": "43f52e85d1d6e87c4c112fc36c78836d6dd58b84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748968, "uuid": "22f55131-c5c7-4834-b163-93d5168296fb", "comment": "Malware payload (Mirai)", "value": "b6e70c4fb867f1b1f0001b5b1eba97a23ef64837d1c8914cb84f765e1c9fe01a4bc45a5c88936dac71058dd14854876b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748968, "uuid": "920e5aaa-1108-48f4-a073-6b62ced32fdc", "value": "T15573085AFD816B11E5D625BEFF4E114933534B6CE3EE7202AE209B2523CA91B0F3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748968, "uuid": "c0a9faaf-9a82-4424-a0e7-15178de67166", "value": "1536:Kdn4Hr787tcCLZfYEMka/3HEGsWRcS85llIIi9D2BJDq+tYZH7kgRlx:FycCB1MkavHEGsWRcQ3D2jDqCY9Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748968, "uuid": "38f7d08f-398f-49e2-99c2-2ea0ee47a5ce", "value": 76528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748968, "uuid": "626b8419-3567-479c-96ae-de457e0dcccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748968, "uuid": "472e0233-eb8d-40bc-9edd-18a4fc549932", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342fd82f-7d1c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783769551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769551, "uuid": "306959ac-b28b-4173-b7ab-e39e43ab77db", "comment": "Malware payload (Mirai)", "value": "b0bca1400f71ae4ab1171f3480ab200f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769551, "uuid": "7781c9ee-fe81-430d-93a4-96a8da55aa02", "comment": "Malware payload (Mirai)", "value": "3d52d6476e3f56502988786fa9bf9cad6e0dd5eec723a1a977e665a86f7459f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769551, "uuid": "dfad00f7-6a74-4197-b2d9-d4f27d21cf5a", "comment": "Malware payload (Mirai)", "value": "3f9b9edb54b03dc2cd92546da379ca988062d076", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769551, "uuid": "13cccf22-f3b4-4397-8880-f0ac20781e14", "comment": "Malware payload (Mirai)", "value": "32ee228bf27d586256647bd9a60061ea70fcde75003f9ea5f50b4f4d8bfaed97ef2f638c56ae0a9271e12c9d77ee2f25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769551, "uuid": "99089eb5-2584-4d9a-9465-4ecd585d21d6", "value": "T117B30A89F8816B24C2D226BBFE5F018E33574BACD3EA72129D144F6477CB95B0E36605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769551, "uuid": "bd1aab70-21f2-432c-ac58-eaf29e4c4e5a", "value": "3072:W48eqoudrTuTfVvYOk6gRQmXnJM1Qa4RJPYIss6zzrFxvwP:W4V2TuTfVvG9RQmZ6Qa4RJPYI165i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783769551, "uuid": "ea6a41d6-77a8-4f8f-8c7a-f23aa7d66cfe", "value": 113680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783769551, "uuid": "c0352fdf-425a-4efa-ae0e-0e9d0f9c56c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769551, "uuid": "58215153-273a-4735-8c9d-e0864d9d4689", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e9529a-7d62-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783799533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783799533, "uuid": "2d85b317-9bf9-4a09-958a-f480f302b4e7", "comment": "Malware payload", "value": "21eb0e8ba5e3013302e924966f1c0973", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783799533, "uuid": "e0dd0479-86d7-4a2b-a396-a46cee9ec701", "comment": "Malware payload", "value": "3e1f434c282f58b8da8d8c4067adf9b90ffc407a5962fb97fe0172e25e5810b9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783799533, "uuid": "ee01621b-7ef9-481e-a911-52f8a077dfad", "comment": "Malware payload", "value": "202e1e61f6d5b9f0574b88f627502c811b01ea1f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783799533, "uuid": "4454f8e7-a775-4346-bc41-76d85c4bfeac", "comment": "Malware payload", "value": "fa56c93a42620362976e892101c541cb3e05002124669f6dc032ad39168884899fa3959f22d2b5c1de073491773e472f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783799533, "uuid": "d8320054-6843-4f7e-b726-b211ce59f77e", "value": "T19AE6330469E022EEC663463C6EF145D6E4A9F0764B75C5DF8FA483666D232E08D3DB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783799533, "uuid": "f21fe188-e217-41de-bdc2-f46ed8caa0c8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783799533, "uuid": "8d1ed6e2-a28c-40fd-aa4b-4bc1988d98ca", "value": "393216:erMlr9JekuokbYO8tj+X0aDhnXMCHWUjXkcuI3/PGTAI:eryrubEtjSNNnXMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783799533, "uuid": "9a3aca0b-c077-44f2-821f-3888a70719f0", "value": 14309783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783799533, "uuid": "e676132b-f574-4e2e-8bb2-4a6b36592d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783799533, "uuid": "66661ff8-de74-412a-b441-11556bdafb25", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9616cec3-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753394, "uuid": "a170d434-251d-481d-89ab-7f70a8a1c46c", "comment": "Malware payload (RemcosRAT)", "value": "ebe225442b2afb70d428667ccac7a3e8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753394, "uuid": "755b5f44-5cca-488a-9c22-c0cb5cfbaa66", "comment": "Malware payload (RemcosRAT)", "value": "3e458abef0d8697e9bdcbbcb8e5336e08b0f15dd356b12acd4772995fc27af45", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753394, "uuid": "5259710d-6344-4b5c-9b91-52b8ac5da025", "comment": "Malware payload (RemcosRAT)", "value": "fbdb1ee1f5c9613406dbc58baf147d4c9d78e011", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753394, "uuid": "94c40f19-21c0-4d2f-9cbb-a472ce7a4be4", "comment": "Malware payload (RemcosRAT)", "value": "1608b24930599655d4bdc8c76fbf914659e280f0921ae17bdca0a682adcd0825bac9fb399f482640d25e88cd902239a0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753394, "uuid": "cd6874fc-2d63-4593-ba48-029641ba38ff", "value": "T1203242026B25B33C1B2CD27D67B13903A75E073646C9CDAABB0C61976BEE40E4C874B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753394, "uuid": "63e00192-87bd-4a79-846b-9b8d102682af", "value": "192:FpqW/+zbRl9ka47T3V8mNTBEIbOPVrli6APjP1kS0hKD97IUyIgFNn6zbhWbnG5l:FYW/+/Rl9v6T3V8mNTBEqOPVrli6APj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753394, "uuid": "6368d585-077f-4c9a-9aa7-cd94f7cb0e69", "value": 11490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753394, "uuid": "4a0da079-10bc-4bfd-931d-0a6941e2ae5f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753394, "uuid": "0c180e64-2ee3-4166-8f6d-4422f4f7e6f1", "value": "givemebest.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672cacb3-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783753315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753315, "uuid": "9f8337a7-6e8f-4246-8912-c2e85791cc77", "comment": "Malware payload", "value": "ae65ba28ca5dbc3ee5a7521d3da23c93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753315, "uuid": "d2dc9211-c751-4c86-9c0e-2ce292022196", "comment": "Malware payload", "value": "3ebb9b33c31e56fe1bc736bf10d7ee6276e3f84e363cfb5a34ff2c08ebcb6f70", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753315, "uuid": "e6f3205c-2f51-48d4-9459-80433270a0b4", "comment": "Malware payload", "value": "0f37f926ef681d030fa1994bfb920bc48511a86d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753315, "uuid": "cecd3c22-514e-4be0-9723-b503d2e165c3", "comment": "Malware payload", "value": "f4117eaccc3d77582c777d1d1783aee66098294621b511d658a2849e2b4db6746f9c1d8df7f4d9005fc774042d0b0fea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753315, "uuid": "f2628790-6b93-4de0-9faa-6832df530a60", "value": "T107228518701699239FB317608B6E219CFF8657274A31CA417CAE43C8BF70517D6B1AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753315, "uuid": "c2c182de-862e-49b8-85a9-feede4f9e846", "value": "192:Dm8ovG35kKGJlzTJyehxJNZjW2ju+Egn53y85RKzoluNreAxCOa7LZ/YOJtVJpX:y8ovG3KKyvtZ/OpAOgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753315, "uuid": "3b231518-2a73-468e-a222-b72932c8a0be", "value": 10362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753315, "uuid": "d9427b0c-10e1-482f-b0a8-f5087c39f011", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753315, "uuid": "6ce4f5bf-c7d0-4798-b352-e21100f603af", "value": "lms.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e501a5-7cce-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1783736316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783736316, "uuid": "9cb6a2f1-89e9-456f-b851-947bb6e5b349", "comment": "Malware payload (Joker)", "value": "cd95c35cb7ba021ef249ae4b7a2d080c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783736316, "uuid": "def48d8c-5dfc-498d-a27e-94db51b475b4", "comment": "Malware payload (Joker)", "value": "40ec19f9ca8dd33ca1d90a447ea3b9d2b9dd8691eea1dd5195f4868197c035a2", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783736316, "uuid": "cacb8d7b-561d-4039-ab9a-1036ecb965ce", "comment": "Malware payload (Joker)", "value": "7dcb405a539f5b145913e86705cc6246381a5994", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783736316, "uuid": "ea307658-323f-4b50-b1bf-28a2ea7a7fb4", "comment": "Malware payload (Joker)", "value": "e2cf0a2e68018f35c45c3db26cac1c2678333a773e482a32d737d1e109a0bc8af97a209ad4b0ffeb9d68ce02e4da9201", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783736316, "uuid": "c93a0112-d800-43bd-b801-d0495b81f53f", "value": "T11D97E149F50CD52BEEC9B0BC8F8A06D3F43AB9151650C19B3C22860EFD977D55A22BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783736316, "uuid": "0956ba2e-e5b5-47bb-8855-a896d637164d", "value": "786432:o5TsgF3DGRnwy1pzf29LVEjg4ajh9+EKJah4vcFv4BmHZy:o5TsgJw29LVagncEiahPWBmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783736316, "uuid": "edcb97cc-536c-4f86-bfc7-6fbe35219b3a", "value": 40115544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783736316, "uuid": "6eda77a6-1e44-4263-9683-58f6a232e47c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783736316, "uuid": "9ada5011-a85f-4c38-ab92-eb51dc6d3075", "value": "com.tachating.messagesms_16.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600f4b50-7d3a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783782509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782509, "uuid": "c54ec133-870e-40bf-9980-1ee060a00843", "comment": "Malware payload", "value": "b0938f592722d0299dcb9943ad26acb3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782509, "uuid": "651dc582-9764-452d-a1f3-b1263444bbd5", "comment": "Malware payload", "value": "414bb8a69cafb7541a1e1118703ff1f8bc79fbf179914b869ad507c00f646e39", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782509, "uuid": "00ebd37f-8c4a-4e09-82da-145d4be45236", "comment": "Malware payload", "value": "41d55209c319ee34e4b0731e92c272aac45a8b9a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782509, "uuid": "350773a1-b9c4-4a91-81c5-6edbc803d9ec", "comment": "Malware payload", "value": "7fb00a5ecffc16f4cc18713a4f3e8d7824a709f6465d21cc21025663ccb11a113a42b0ac24b7ce27cceb953465fbb827", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782509, "uuid": "8565ec57-ae08-4ba8-89b8-9ab4d1c22a1c", "value": "T114336C551A857C249A99C9361D7F2F0CBCAD43E6320492EE7FCB3CF28C4AA9D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782509, "uuid": "9b9dc814-f673-41f1-8587-e1039bbe0670", "value": "768:HVEJVIhtMW9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:1EJ2MTcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783782509, "uuid": "f016edd7-598f-4a2c-a252-d41816e7dd22", "value": 50374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783782509, "uuid": "f7c152a7-6a71-411e-ad8a-24420f0f4862", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782509, "uuid": "d77d2334-61cf-4f2a-8d0e-8d44efb26560", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1d90d9-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783752975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752975, "uuid": "81f6c87f-c43a-451a-9da9-0fad58df97b7", "comment": "Malware payload (Formbook)", "value": "b7444cd47a536f2e1e2394d7adfce85f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752975, "uuid": "5e325808-ec50-4bb1-92fe-9e7b689ed827", "comment": "Malware payload (Formbook)", "value": "415a2251f27ed7f9856775f551415f6ded1034ab37f71ddb5f2829bb6ef091ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752975, "uuid": "fdc6e15c-1498-4d1a-9383-6e5750b0724f", "comment": "Malware payload (Formbook)", "value": "221b224ba690480c6cb1494b3b6a4d2e5d374d1e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752975, "uuid": "b3b7c25b-d8b2-4604-9550-48bd33252edd", "comment": "Malware payload (Formbook)", "value": "dfe5f526c0ee5b26ef8c6fd3667afc914ba636dd191d6793f513c89c64a4bdb8c5fcd117c88af0458edff6357139450f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752975, "uuid": "d87ac6fc-ddc4-4d39-a4b6-fc3e3a090b8d", "value": "T122A53311BF175B62D44D44B382D0A65CDD2C8BFCF3A0DBAB65735A86BAF60DB1EA0440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752975, "uuid": "c43e993b-8725-4cb7-a741-6c509527ffc0", "value": "49152:ZNXSrYzvdj/YdlU2EBynnzbu0lCQL3lCIMzO54sNyVHUexw+zCqyFT+4:LSrYzFj/KlU2EBWnz9lRIIQsNyV0exwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752975, "uuid": "46156149-23fb-40a1-9702-030df84914c0", "value": 2225732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752975, "uuid": "c028a958-d910-4575-9115-9ff820188d71", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752975, "uuid": "ea07d15c-d9d6-4885-bf31-5d45313abceb", "value": "Purchase Order_0092.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9effff-7d33-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783779527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783779527, "uuid": "8950b489-7f56-4eb0-9346-0f5e56095900", "comment": "Malware payload (Mirai)", "value": "189aaa1c92cf55dc9083e1a259a6ac4f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783779527, "uuid": "1691d380-ec66-4cd7-a1d2-d38de241a3c9", "comment": "Malware payload (Mirai)", "value": "423a748638ea1d72a76be855d13b64adffd12fb01551781ba4a1565b278eaa65", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783779527, "uuid": "d990c5f9-f985-40d8-8e55-6a1ec7d8f084", "comment": "Malware payload (Mirai)", "value": "39e370d616efc17451f9a245d1d245a7fb4e9f7a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783779527, "uuid": "d1772a1c-cb80-4c20-ae8f-4a630ba7681d", "comment": "Malware payload (Mirai)", "value": "eafb478f63dc7b26ab2c46e2f3d623e9bffe7bdb17bba5cdcb840b5b63d29c954aa05962cf217e7f89c728d839f2e62d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783779527, "uuid": "8a78cf3b-b12a-47cf-a508-46b3ddb1719a", "value": "T122557D57B2B370FDC067C030835BCB62A936F46545326E7B35C4D6342EA2EA41B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783779527, "uuid": "d25270bd-7880-4d56-8f15-242c19b26f17", "value": "24576:COTojZGXSSz1M18YARgnJ08yTnCRqq2oAd4m:CzdGXSKK18YARgnJ79qqhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783779527, "uuid": "9718565a-c69e-4c74-a1d2-a9ebc62de0de", "value": 1293184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783779527, "uuid": "0e0c67e1-8a67-494a-8505-b1410b568051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783779527, "uuid": "f689d718-52c4-4d8d-871b-399db40d12a4", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa1a520-7cec-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749268, "uuid": "dff8bd65-7672-4dba-bbe7-40e0b1d11675", "comment": "Malware payload (Mirai)", "value": "ff7bec54f9f72c512b1ff73cb4e86e86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749268, "uuid": "9de1b1bc-bfab-4aed-9991-778d18286e57", "comment": "Malware payload (Mirai)", "value": "4319b75ce855f62b6d4078674fddee0d8989c8472c319bb3e72f7742d3801924", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749268, "uuid": "424b4783-bc28-4dfc-9007-5b57b3a96993", "comment": "Malware payload (Mirai)", "value": "e4c23ad006266b0b51a4a1c506dca127a108f038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749268, "uuid": "a06dcbca-759c-4082-83f1-79fef8586b26", "comment": "Malware payload (Mirai)", "value": "2687466d1ed05a17001a637bcacf87c85fe16aba20bd67a5e6c9b3de3fb6df9bcae2b7a00d9c6a3b6d58869666d8940c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749268, "uuid": "3af798cb-62ba-46b1-8bd5-446b84b81134", "value": "T1AD332995FD01AA12C6C155B7FF0F438D77264358E2EE7303AA25AF20379B82B0E2B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749268, "uuid": "334d13e4-f46a-467d-a83b-a19781279c1d", "value": "768:vnSoutqLyOIWrQeU6fT7MFYkwIleEOF4IucDu6/1Z+f7PPmWjJgRnI:qOzz8FYyeEOFjDh/WPb1gRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749268, "uuid": "07c03962-f710-490f-904a-06422f449111", "value": 50304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749268, "uuid": "7b6e55de-7a57-4d61-9354-85b7ebeb6a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749268, "uuid": "e92f8da2-8f2b-479f-9034-c63266ba1d3a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a46fea-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748124, "uuid": "f1969670-5d0c-427d-b108-383dbff22b08", "comment": "Malware payload (Mirai)", "value": "46f37a1984deba1ff3ba4dbeefc96f19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748124, "uuid": "f028ed81-65ba-4f98-b83d-61baa5afe5f0", "comment": "Malware payload (Mirai)", "value": "458597708ff0f5e3591e08f4f771e2c60f3d2f969ff92401c4e6125824a3860c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748124, "uuid": "1350d11d-162f-4ac6-9465-88046ce3b9c9", "comment": "Malware payload (Mirai)", "value": "db25a6d918fdd7320335091f2e99d917c9af168c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748124, "uuid": "7ee9d417-c10f-4bb1-a87b-fec60a18a034", "comment": "Malware payload (Mirai)", "value": "ade836806c41bfb70f027478ee1ed939bf9fbccc3e91eb953a91352b72d160bf9a6793bff0c18d97b379adffa9aee636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748124, "uuid": "fe058fa5-b3f6-4e6d-8ab9-e7c257574c98", "value": "T15EE3D60E6E258F3DF779C33487F74E26A79873C626E0C645D16CE5112E6028E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748124, "uuid": "28cdd59e-b507-425c-a435-27598e0c9bf1", "value": "3072:rxOMeDf3cnpliHn2qsJoIrNZpLfsWNBUxNvtDru4gnieT9HBDTnby5:r0Meb3cn6OX5p/y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748124, "uuid": "2b7cbbc4-1e5d-4122-bbc5-999911b69253", "value": 143236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748124, "uuid": "f7d00322-b916-44be-8fe0-fada0ba445f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748124, "uuid": "a9437b66-deb9-4d4f-8438-68bd698d55c2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92507f7e-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753388, "uuid": "436077dc-bcb6-43de-888d-c4f74ffb048f", "comment": "Malware payload (RemcosRAT)", "value": "6d09011a7305bf51d150b53399bc6fec", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753388, "uuid": "cbbeaacc-4c34-4652-9284-db83b4467b2a", "comment": "Malware payload (RemcosRAT)", "value": "45d33995abad40c2dbefc7af2ba684f2b9f095e5ef7d7c939af36b16727ce799", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753388, "uuid": "1f0f5669-c5e2-41c4-b72e-e2a5902bd0ac", "comment": "Malware payload (RemcosRAT)", "value": "71e30aaf224de9fa66519ecd968c38236558e66f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753388, "uuid": "0c483265-b0b6-439f-b560-26a5d3f2fc25", "comment": "Malware payload (RemcosRAT)", "value": "54075183eb2a46d9588ded10f4212b28d0dd6297de557d47dbb7335ec898c39334a9c45b0bb2c0fe143a7177738a1f4a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753388, "uuid": "99db7268-f0f2-47cb-ac15-f94c3ed48dae", "value": "T18F12A7701C0140E0675686F2A767FD2BB721101A92B2B021F54F7E9F8BA694A7FFD548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753388, "uuid": "81913284-7a0a-4092-81b7-3c8f41fb139a", "value": "96:VTpviBckwMA0eJRvEjrLW3DNAVx8AfLZDKqJym6zdMNeVN7N5fU50+HIdIAyRoi1:FpdKA05rD1lDKqMm6zCNeVNN+EKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753388, "uuid": "a777389f-fcb6-4d2f-883c-e96d7e3efd6d", "value": 9516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753388, "uuid": "1dabeba5-737c-4c4a-89f1-136682363e0c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753388, "uuid": "63d5a0e4-1e16-4e1f-80a0-64c9d31993df", "value": "goodthingswithbettergirlson.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b81f6c-7d39-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783782274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782274, "uuid": "a1aeb86c-45e0-45b0-bcc7-e8d22dc58aa8", "comment": "Malware payload (Mirai)", "value": "6567ef574c33a879033a082fa3ba9bf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782274, "uuid": "7d2f376f-bc70-4796-a289-5feee2dc8599", "comment": "Malware payload (Mirai)", "value": "46cfad24a61fd8087b5c28c438e8cee7b42f0bfeb471d55e0a5d3e2f14b070cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782274, "uuid": "0ce8be97-f047-483e-9909-723b17b88e37", "comment": "Malware payload (Mirai)", "value": "8e42add60dc5432f58533c31b1e0b119289077a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782274, "uuid": "cea8d211-7fd4-4d33-aff5-871b07bed4c7", "comment": "Malware payload (Mirai)", "value": "0bdc35c830927582d9fe9555fa7553278674f91f6a530f7dd2a9ca20aeaa13b642fe4d2610d17e1cafa579769c905e14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782274, "uuid": "aac26ea8-1702-4137-9b66-84d8d3a8d36c", "value": "T1E9544B03658095B6C483E0B6CBDFA2235A61783D5C3A724A27E0BF667F56DF05B19B03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782274, "uuid": "9fb94f12-33a3-41ac-a0f5-351fc4597d08", "value": "6144:GcViMFwCX6C6HmpnwLc3g+bmbTRYqxyPXTqQlz78:GLMFX6xmpnwLc3sTRmqQlH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783782274, "uuid": "1c73b71f-207f-4ca3-9778-670fb5edcdf3", "value": 294152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783782274, "uuid": "93c5c979-b35a-43f8-9bb8-7c52d293333a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782274, "uuid": "600d4a35-cd92-4523-8ddf-f6da456d643e", "value": "kworkerd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265bb549-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749771, "uuid": "6e1c0dfc-bec1-4f5b-b7bf-27786aa13f02", "comment": "Malware payload (Mirai)", "value": "36b87be5dc9087458590ca831f336d6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749771, "uuid": "56be41c5-d3a4-44e2-bd5b-e8148766ceb9", "comment": "Malware payload (Mirai)", "value": "471329e28d25e75c837ed86f7ef62f8516745fefd44363c131e048b00a0b5562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749771, "uuid": "f112b849-f774-410d-a99c-1fbe3e0e710e", "comment": "Malware payload (Mirai)", "value": "4e5220126a736bf1cce46437d0849eba43744c97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749771, "uuid": "7a43addc-17c1-4070-a889-74265140144e", "comment": "Malware payload (Mirai)", "value": "b651a2dae922b4a6ca9cbdd1493f0275ccf89bc8d376135b5bb568b85bcf7fc8d4282c5d54b263640e02442a80051a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749771, "uuid": "560a387f-81f8-461a-938c-3f0c8de37258", "value": "T12A230158C29A8E5475A893F9C1EF35AD25828278899A90F38FD0C63F1ED67F4D63C530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749771, "uuid": "772a2ff2-da56-4317-932a-52cf4092e907", "value": "768:bCYmuss1WUa2OC5B24sW9tL75IgOCxONDymptKNR0Ml+q+XEq0jwAjLo9cLwePe8:fFssRQD4syL7KX/ti7lh+mjDjMnemno1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749771, "uuid": "b13240fa-5315-4be3-83a4-942e8f3789c1", "value": 49084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749771, "uuid": "fdde224a-23a5-4f3d-b4b6-e853ad6defa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749771, "uuid": "bb94dc43-7f9f-4947-93a8-93d7b5547d25", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61eb857-7d24-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783773312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783773312, "uuid": "1e61f517-571e-4c6a-bffa-78292a2f7667", "comment": "Malware payload (RemcosRAT)", "value": "c0d94fca477cdc2dae48a0e450a608c3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783773312, "uuid": "d8ae8c33-bca9-416e-8506-b7d9dad9ab05", "comment": "Malware payload (RemcosRAT)", "value": "47af1f0d9932840767920b3cb2befb3839bbc980e610c6a14327edf1b1682b2d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783773312, "uuid": "116d6ffb-3da3-4b5a-99b6-8a666a411729", "comment": "Malware payload (RemcosRAT)", "value": "9f5c02e8b30738c4a1d52429023588a07ca79d64", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783773312, "uuid": "695891dd-98fc-4813-bafc-5463e627c71b", "comment": "Malware payload (RemcosRAT)", "value": "a9271f21f0f42c6741e1ab7a5f0bef4a0714045802a481ab2c401ed7b321a1866122783cb7df6531ff17af9dffad9520", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783773312, "uuid": "cf277247-201f-41d5-b86d-2350bde57735", "value": "T17F42F264C61DD7AC4AAEC72E9EBF0987D231CD124E00593B333C728F47206F5A697985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783773312, "uuid": "53b56edb-6381-40df-ad30-856594849429", "value": "192:Fp2Ma3TazlsLlcm6TacnUyAyVZTH7E2dn:FcMa3Taz+Llcm6TacnUyAyVZTbE2dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783773312, "uuid": "0885f071-e58c-41f6-b423-5f2dd47d841f", "value": 12629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783773312, "uuid": "633f4d1d-19e7-4a99-bfe9-ec8f0257c38f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783773312, "uuid": "190dd24e-c3ec-4842-bec7-c5453ede4431", "value": "givemebestthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2595b8a2-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766949, "uuid": "3383f82e-ac0a-4cc1-b161-4f072835280b", "comment": "Malware payload (Mirai)", "value": "ac38d648dfc06fef81bafb43769732be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766949, "uuid": "8acde2c3-6b4e-4b13-82c5-30f57cb3c0d2", "comment": "Malware payload (Mirai)", "value": "48219419c610bf5db535b76312fcb51b80c046dfdc2d28ac16935f870f74a15b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766949, "uuid": "cc11c7e0-1e90-4079-aff4-982b376e9465", "comment": "Malware payload (Mirai)", "value": "d3bdee03f407172dad3369137385b685e81b62cc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766949, "uuid": "6f83fd7b-48b3-4ef2-83cf-802d9d305b1e", "comment": "Malware payload (Mirai)", "value": "2501fa7805ec62be2407c612b40169673e006a148e3dcfca3869b0150112296dcc57410212516295ff5312009a262781", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766949, "uuid": "0011ee8a-673b-4ef9-9dd8-0e69ba226864", "value": "T19E21F7AC2D996A6A0E22CD41F0A24526A12FEBC5B2923B5BFD4CB57158986043231BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766949, "uuid": "a343ee69-0440-4f38-a463-e33a8fd30478", "value": "24:QvQhBh9M0oyCx8qx+RxMx6LiJxoKdxErxJ/FIx89x+sxfx6LikxoKwxEOxJ/F8:QvQhnoYJiA4Jifq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766949, "uuid": "3969344f-b9ba-4f1d-995b-54d0a6ef078a", "value": 1223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766949, "uuid": "504fb574-12b4-4f1a-80b6-e1a1c274ac5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766949, "uuid": "b2613764-ac76-4689-a8ad-e0fe32111784", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040522dc-7d58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783795240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795240, "uuid": "5b777e63-17f9-4396-8b99-72348b2a67e6", "comment": "Malware payload (Mirai)", "value": "e818d918cf3ba57e91ff1c189f1a4a49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795240, "uuid": "d3dea381-c064-40f5-9399-247b02137556", "comment": "Malware payload (Mirai)", "value": "48a8dfd9665440464f0b2a79f3679a00c21757a208ec96aabcf5166ac8e6ad31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795240, "uuid": "fc57c4c7-b678-49b2-8436-e9f49d962baa", "comment": "Malware payload (Mirai)", "value": "d79f5ffd7464221b8af8a4b9a000a39445d5c5c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795240, "uuid": "880b4e4d-83f8-4968-9f36-ea92178ca7d8", "comment": "Malware payload (Mirai)", "value": "990b454452604d2dcfca7b94a97f22eba562953e9e520ec170ccad52c9ffe4899c59f126c5bf1879dcd2ee2d95fea9fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795240, "uuid": "8b4bb4ba-ef87-44dc-96c9-aae2b0bcf50f", "value": "T196456B57B2B364BDC093C43087DBD662A932B42546222E7F65C4CB312FA7E641B1DB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795240, "uuid": "e5848b05-7370-4998-91ff-097f71454f4e", "value": "24576:5MU1YjYc4kAUftW9Idcn4Po2Q3+FKf5ClKuTZXqvL/f:5MUKjYc4kAUly2ZAf5CA8ZXqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783795240, "uuid": "11496f97-6067-4573-be63-27be917fe104", "value": 1241016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783795240, "uuid": "f7985970-cfb3-4be4-abc6-d4f431cab4b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795240, "uuid": "228b4338-0ee1-4aba-af6f-cda462e4da32", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38db592-7d0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783762946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762946, "uuid": "8c5a8c58-c107-48af-a0f8-aea20b6fe66e", "comment": "Malware payload (Vidar)", "value": "c16e60c672f817faa5287e9cd585aae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762946, "uuid": "3d19e844-7646-4a13-84aa-204d2a67ba0a", "comment": "Malware payload (Vidar)", "value": "4992cb5f29594ae1cea78e028a2e6a51d571a610ceeb4442b605953b916dd1c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762946, "uuid": "952b9dfe-8b52-4ac8-818a-333adb1e2c39", "comment": "Malware payload (Vidar)", "value": "b8293f75702d6f27eb4f69ec2564ce064d6a0068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762946, "uuid": "9c7cef82-e1cf-4471-9a81-577881a2f1a0", "comment": "Malware payload (Vidar)", "value": "45460be780f047d762a41ad301cfe22c801a25ba2c59542a5823c6378848ae34364d4787a932bf4b81a995e7f80bd43a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762946, "uuid": "e4d11fe9-2b5b-4cad-ab0b-05ca3af182e0", "value": "T15DE59C07BD9119EBC09AA33298B61296BB71BC094F3277D32E9077382E727D09D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762946, "uuid": "e190557d-3621-4745-989c-1d4964d895d5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762946, "uuid": "af4041e3-452d-4a82-9e1d-7ae07d5e0fd7", "value": "49152:80M59Hu74mqIqSEbEZobDqMJX/5YQGuihD4Pvy7e:802QqSEYZuDRJX/SpuuCvyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762946, "uuid": "fa9fe186-afea-4728-95a9-096de202a6ed", "value": 3277688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762946, "uuid": "8ea745ae-0108-4327-a320-6d109bde73be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762946, "uuid": "cd6bce9e-7e0a-4585-ac17-044d2e9ebfeb", "value": "0c086e9dec2646afaae25a4d6d279141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2ebd89-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783281, "uuid": "1c945663-b21d-44de-a059-cd0a54161d02", "comment": "Malware payload (Mirai)", "value": "b170f0a8bd3bebdb5ac87c1626cc0856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783281, "uuid": "c9b8fe97-0320-4ba0-a358-153d968e0c8f", "comment": "Malware payload (Mirai)", "value": "49a25be22ee766aa66d0ce3a47a26d61a38a7c364a832ef388f1e252bcf35a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783281, "uuid": "68efae2f-f60b-43fd-871c-e1c3e372a7d1", "comment": "Malware payload (Mirai)", "value": "21bdf32943a8f7e67c59b089fda99c338bc16024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783281, "uuid": "e14b2848-bb05-42cb-959c-cb4aa9086406", "comment": "Malware payload (Mirai)", "value": "253aeb2578037e6e73754b047524b96f8fa83e88228685949c884da6460a0ed5869ad4ab7891f80ed91654f7d62fd027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783281, "uuid": "9bb3f6c3-131e-465c-a5a7-526ab7c177bd", "value": "T14913E1AB827FE3F0D055A4730E6B9E54FDA63C9D9002565388CE11FE8EA74952F10EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783281, "uuid": "f59c314f-f11a-4d77-803d-72806486f777", "value": "768:Z6bBruHA7g+AzZJc3uAfqmdQbVisQT+siUphoeAZni9BMaw3o0ljx0VH:ZOrzg+esumqmdKVPXhUphohhi9Bao8+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783281, "uuid": "17d16183-64a7-4064-88e9-0c6937ab7bb7", "value": 42804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783281, "uuid": "c257f644-784d-47cf-9595-cdd4b06f2eb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783281, "uuid": "1fb6dea1-2507-4922-989e-7103dc1d4e21", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f5120e-7cda-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Pony)", "timestamp": 1783741205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741205, "uuid": "ddf45a4e-fa5f-4336-8652-db6aa5d31a5c", "comment": "Malware payload (Pony)", "value": "406453301fc2f6c6be8838cfda572f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741205, "uuid": "da73b88d-ad62-459f-8159-d86f7892f231", "comment": "Malware payload (Pony)", "value": "49e3dd606bf5bf7e1c49b26a25135b2be18ee75c7b8e751c3dc538c0043e5a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741205, "uuid": "b856668a-4bd8-4671-bbf5-e102fab481f8", "comment": "Malware payload (Pony)", "value": "06cc92450ee23832c765eb727645667141fc1e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741205, "uuid": "1dd19ce4-6131-4d74-91a7-685b50fd7c38", "comment": "Malware payload (Pony)", "value": "3b2a149599e4224dc1947d252fe1c4e0317e6b68fde4f2a0e595fcf608ce5a943c5912432e807e15bb44c4aa7ce77763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741205, "uuid": "05a726c6-e230-4484-ab69-04260389955d", "value": "T156930903FA80E0F1C0A22A7137C15761E7FD9E797C3A8D4AEF9C49856DB22877B16152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741205, "uuid": "c3a6dc7b-9bb3-4c82-8f53-0665cc65da1a", "value": "09070e021d4505e6183701ac6e022a16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741205, "uuid": "0e9cb743-4115-4600-b275-7179633fdd5f", "value": "1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEIWkzmt2l:2SnMuGc/CfZDap6COU45EIGtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783741205, "uuid": "b6a4bdcd-4b1a-48c6-b52f-c53274c076f3", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783741205, "uuid": "1373165e-cfea-4f5d-ad7e-0f40f4013d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741205, "uuid": "5d3113a4-b391-41e0-bb55-dc5c24200448", "value": "406453301fc2f6c6be8838cfda572f09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e9199e-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783752963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752963, "uuid": "3f5c31b8-61a3-472e-b9ec-281fc73fde8f", "comment": "Malware payload (PureLogsStealer)", "value": "a4437999e35b4d86f0e676b3baca8a81", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752963, "uuid": "45442452-c212-409e-b734-99abc20f464c", "comment": "Malware payload (PureLogsStealer)", "value": "4bb16555c6d16051154f98850757d5eacfefcd07031cdde2054e574f988e8c5b", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752963, "uuid": "0f3baf3b-9ca5-4952-bc09-d641c1b4d9b1", "comment": "Malware payload (PureLogsStealer)", "value": "4438ff729d980bbea78e69aad315f8c015c7e3be", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752963, "uuid": "06b0cd27-d708-4f10-9ced-e02734b3047f", "comment": "Malware payload (PureLogsStealer)", "value": "5d156cc7e96ea7c1464850423de23b9c90c24e714f6a0a51ce1b2bfc0a914684f21dd9ef60f5cdff0f41101739355543", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752963, "uuid": "c30a1f3f-f94b-456e-b347-c855c4d514dd", "value": "T1F2652307ABD1BB1AC19F89386C9798B4015EBC16F806891B33887B5C347F795878B64E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752963, "uuid": "517ddada-d34c-4bc5-ad9d-eb30fe6ffecb", "value": "24576:oNB31xX9tIbrZZDI0tHPAcHutnBQsPgIDmdUbeSEBW3uzzZOfOxaEQDo0e:m31xN2ZZ/fOwsZaOeSM8sI3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752963, "uuid": "65b5447d-f052-4dde-ba27-907ae23ed707", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752963, "uuid": "659d2cd2-e6fe-43aa-8c21-d5aed3e03a44", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752963, "uuid": "449a5fd5-eaea-4c0f-aff4-2c37ce200a57", "value": "Pedido N\u00ba 22635636.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf907663-7ce9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783747880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747880, "uuid": "8c9d410f-3df8-4b46-a0be-96d47000dba3", "comment": "Malware payload (Mirai)", "value": "ff8901b9111ed0dd63c602e35875a96e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747880, "uuid": "397690c6-8794-45bf-876c-27f56714d2b5", "comment": "Malware payload (Mirai)", "value": "4f77798ec288b63a181271d679c45b6e1a95ced69ee8121497ea19d450b8233f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747880, "uuid": "2190a9b7-e16a-405f-8b5b-f6c5ec15c5c5", "comment": "Malware payload (Mirai)", "value": "c2bce51f96295193745f275fb9d1d0a0b0f2e2aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747880, "uuid": "e9c2f5ce-90ae-4ac6-8368-4ef5a3943558", "comment": "Malware payload (Mirai)", "value": "f1f3e89e238297dae9f6aa034a838dbac07d0afdf27c88e6c60a498be2ecf9bb01216b3fa86f1856c73f110a5de9ceab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747880, "uuid": "4c4a98bd-a6ee-4a02-883c-2cca568fd279", "value": "T107332AA5FD029A13C6C1557BFF0E838D77270398E2EE7303AA25AB2137878560E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747880, "uuid": "d398a601-f0f3-4f6d-9190-ce88c2c39406", "value": "768:Z6ZH7saX28+yRFQLvnOStHlM+Ai5Ew4letOj4hDyHI3sySJV31IbulURctTdgRMI:IvBVmvbIp2WetOj4Io3w5+65gRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783747880, "uuid": "45957a07-f80f-4468-9016-e895e080e4b5", "value": 53156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783747880, "uuid": "fc0be1e7-e76a-4254-aef9-b76c1bc5129c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747880, "uuid": "1d7e27c9-f713-4e14-9344-77d83ce29233", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ea9265-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749768, "uuid": "2f43a17d-9742-494a-ac2e-836ecc7aa0f3", "comment": "Malware payload (Mirai)", "value": "13817a77da927e56385e0746e0629055", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749768, "uuid": "9accb558-a2c2-4040-9dcb-7b7c9ec5e158", "comment": "Malware payload (Mirai)", "value": "4ff7c8a8a66dddc9b33794e7823d606a3cd68b1b6ec33c842165484008289ca8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749768, "uuid": "e0278468-c582-4c73-9417-14c86e6a70e8", "comment": "Malware payload (Mirai)", "value": "eb4f143f812fbe64b1b0d5f0f0924f690e3389b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749768, "uuid": "037a04e7-ecfc-4559-9e36-6ed8d64561e5", "comment": "Malware payload (Mirai)", "value": "b483037d638c3e0026f0e5cd92d1038ffbb8fabf0c670963bfbc0a9f2cf876c25a35d8f4ca5c70da93b65282ccef7f70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749768, "uuid": "9c3cd14b-3a71-485a-a1fb-4ab4eafc71fb", "value": "T10E3302D56D689987CD5D1EFA163C03B023C6356AF4CA4F5D92B11D8A3A3A5C2FC880BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749768, "uuid": "a5801ac3-8cf9-44f1-9e62-5899aff35cfd", "value": "1536:xZnJpOYgWB1yERKL5E/oZdU4ZOXGyjPXC3c++DY:vJpOYtxRKlOovJZgC+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749768, "uuid": "da405ad3-5fc4-4629-9507-bc4e84fe1dbf", "value": 52868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749768, "uuid": "2a65e4c4-72e2-423d-9381-282b02316ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749768, "uuid": "876f24b9-e0d3-4be6-b6eb-6981c7f026e4", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee705df7-7d0a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783762132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762132, "uuid": "6c7f4dc5-2ad6-4e62-9783-b11f5f4424a4", "comment": "Malware payload (Vidar)", "value": "3fac22d84c552120c80e18a8d82e3526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762132, "uuid": "32241e9c-851d-4588-bf7b-d0c8ef9362a3", "comment": "Malware payload (Vidar)", "value": "526efbd526d1e0fa9ac6b9def17f1925774e3696595232e8e8d6801a8a302e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762132, "uuid": "87520dcf-11fb-4dbe-a264-f4a0b1e62e1f", "comment": "Malware payload (Vidar)", "value": "992eda2e29b8cc10474cdb4d2badd31faffb4e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762132, "uuid": "2e6ed0ba-ccaf-4cf4-8a6c-a96c013d2004", "comment": "Malware payload (Vidar)", "value": "c8c4f3ac3e9907e32e16abfe20bb074138c748a336059ddf050ad1b40e70897ef874fc5c2c92f207d344ad3454b280bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762132, "uuid": "8ede524a-4bee-41ae-961d-538a39097cb2", "value": "T141F733D0535A4255C1CF9FFD213F0BE3AE271EE0A21ED0AB4A668571F8A54A7C68C14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762132, "uuid": "f5a62336-17cc-43a4-8cbd-a6ddcffc8ba4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762132, "uuid": "9fbf54d1-5517-435f-8c1d-3dee82f85991", "value": "1572864:KLdkQ5K/ajFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB767:K2Q5OEaABZVPArg/bXeB767", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762132, "uuid": "c46ccfcb-7df5-4717-85cd-33d9dc162e5e", "value": 72300147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762132, "uuid": "d19c55c7-588e-4e01-b734-3aa480228294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762132, "uuid": "f6c0af3e-5d11-4ef1-b161-2034d706703f", "value": "HitWave.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e283d4-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753562, "uuid": "9e388a45-9416-4b86-9724-2a821dd79546", "comment": "Malware payload (XWorm)", "value": "7a8dab1c50661e6aabb104227ec24380", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753562, "uuid": "f22d6350-ea61-4433-90d0-547c68e9f98f", "comment": "Malware payload (XWorm)", "value": "538a205693a9a9428b9092ee238b90f8c4a2136f65f2391d9b44a9ddd51d0cc3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753562, "uuid": "0d5af6ab-1977-427b-bd7a-29937ea9cb1c", "comment": "Malware payload (XWorm)", "value": "500837d7dd226010587f289a94fef819fc44bd87", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753562, "uuid": "35120f62-0ca3-4e46-ab45-53ed814b7a41", "comment": "Malware payload (XWorm)", "value": "d0898047ae4fd8c7fd2be29a096d8ff48ba5cd083ece931044405cacadb7d85ad2520f96e4fc587803aab9e6d297827d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753562, "uuid": "4f1907d1-0f7a-431c-af5f-0abe3e75dff0", "value": "T1C5750AFB4F388082C1B495B74F1A2719F4F045FB1816E56EF8BD3B84B7980986469EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753562, "uuid": "9ef7d6c9-0118-421d-aca6-ec754e25b9bc", "value": "192:ECCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC:ufA+PM/+fRXlvEo+zqITBFdxRz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753562, "uuid": "1cf6b63b-f105-44cb-b8c2-2b0fa14333d5", "value": 1701634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753562, "uuid": "1b214e10-1b7d-421d-8b3d-0ea9bd780936", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753562, "uuid": "663d4fa8-3738-438c-a4e7-ba0184c8f04b", "value": "pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c475123e-7d11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765068, "uuid": "5257d20b-fede-45f7-9d1d-d31cf5e1073b", "comment": "Malware payload (Mirai)", "value": "0835c651b255722b36d8033d11e25fae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765068, "uuid": "1146e23d-a31c-4a93-a2af-beaf87dca1ca", "comment": "Malware payload (Mirai)", "value": "54ceabfa135451c8f236d115ea6e8fb8ac12b0a268c7b6c2d69e82992801915e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765068, "uuid": "ee7f304c-7f86-49b5-a567-3507b24c17e7", "comment": "Malware payload (Mirai)", "value": "b66b6ab4b5ed396a72e4bf5e0221e0e410535ab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765068, "uuid": "8408f110-a999-4ce7-afae-5d55f5cff29f", "comment": "Malware payload (Mirai)", "value": "598234df60f27d292964a93c918e66c62945ba2a0a307b08582b784870396e81b18ea67c34010d8452e5ba9b9148124c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765068, "uuid": "842bf1c6-df31-4903-8e51-d89306181b98", "value": "T12BB31989F8929A23C6C616BBFA4F42CD772663A8D3DE3107CD159B2037C752B0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765068, "uuid": "3e5bda14-043c-4492-8f01-fc1e23025055", "value": "1536:eREA0nAkBT5d5KgNT+qQQu2rl7zfQS5nuBC3v/CyuwSIcT+JbhZKa2KeNu7vFnbW:k4nAmUqz1zff5KCXSIcT+wGFnbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765068, "uuid": "0e2b9cee-6987-4937-849a-4e27f77f90df", "value": 109060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765068, "uuid": "b52c09c9-b828-424e-bcc3-317443bef719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765068, "uuid": "84581f11-30e2-4700-b80c-2b34d7a940da", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfc10b9-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783335, "uuid": "86a67836-6024-412c-ae91-a0dd696b4e8c", "comment": "Malware payload (Mirai)", "value": "8242df10ce4c6f38e8a46d2e06f4e314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783335, "uuid": "89291821-a48f-43d4-8b13-d0d3a0a6c326", "comment": "Malware payload (Mirai)", "value": "560fe731cf18724d705d30455d567b6a989a919b07116ea1b15d4b9d72cc6a1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783335, "uuid": "dfb4ce73-aac1-4bb5-83df-fe8877a44805", "comment": "Malware payload (Mirai)", "value": "9aa752d3a968f6455c2c4a0ef450949ed773e2c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783335, "uuid": "8ecb5b7f-9c86-477e-a72c-561e3a915a2f", "comment": "Malware payload (Mirai)", "value": "c196bdca98ce2d9d716931acc996b560ef9af1aadd12a2971546764773985a93b50bddda8964fdd6bb3475912290399b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783335, "uuid": "1cc47c10-6455-44fe-b5e9-55e2b2cb31e8", "value": "T120430992FD9246AAC5D017B6776F568A33E267A5C2DE3313C8140B1137CA90F8E76E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783335, "uuid": "b2b08295-c502-4dff-8946-323a81fbf8c4", "value": "1536:O3UZYDym4OnhttbfhVbMIHVeO8qCeGZbBn:8UZGym4OnxHwO8q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783335, "uuid": "f90896cc-6fa6-4be3-9ddb-d3d6b2f344ff", "value": 56752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783335, "uuid": "a2a32314-2aef-4a48-adcc-9fbaafb409b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783335, "uuid": "975ae0ff-e231-43b8-9ce6-e1062365824b", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71bec9a-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783765502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765502, "uuid": "a70f4b5d-2f7d-41bb-bae9-fcd4c510b70e", "comment": "Malware payload", "value": "77c23d350f68d40b4a04a50c8a5c2afd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765502, "uuid": "2b288654-d648-45b6-8538-0abb1330b6c8", "comment": "Malware payload", "value": "5776dcbb421d104f239d02a0b819245c00c6aa4fb5d8ca23835af9e6db0fa756", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765502, "uuid": "08e44216-c3ec-4dc7-9560-ec9777417c19", "comment": "Malware payload", "value": "3f3e907e7c53533c5b9d837c5ca2bbe286c48e48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765502, "uuid": "918c1773-ffc3-41c6-bfa6-c21074698a71", "comment": "Malware payload", "value": "e7615bf674bc409d3c1cdfdb972cc80e8558eb50a9f3421ca2cc2a51154042ed80e7b2a0aa08a42ed5166074f5cbad05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765502, "uuid": "e7cf4c8e-9e19-4d6c-b2fd-88babccc6ac0", "value": "T112F0F049E67C027390D1046CBF0C86E10FE34472EB822AA9F083ED631DB99B8B542A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765502, "uuid": "a62de8fe-c29d-4e87-bed7-766bc8a3aaa2", "value": "6:+49gGLFKmYD6QdXmrhEMXfR3uec7DuFOTp3ahJIo0qKIiOljugiZlg3FZNuHA/s6:V9DofLcR3vuD9IHuqKUDFXGoKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765502, "uuid": "790501bf-3b2d-4dc9-aff6-a2b91722ef3c", "value": 564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765502, "uuid": "41e028af-3b7c-439e-9bad-398177ddc28e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765502, "uuid": "10b4cdf4-52f4-46a0-b0ec-1e549a8c7bc1", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c00f77-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783317, "uuid": "3fb156ac-3f06-4a66-b321-1b9cf2c873d2", "comment": "Malware payload (Mirai)", "value": "58019f40c0db273868c3f8612a1443e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783317, "uuid": "ab074e8b-64e1-492f-b228-d29c825b7a71", "comment": "Malware payload (Mirai)", "value": "59c3aa7fcd4d594e117d30951af4fa9ed9baa1d18c808e72b0edda17458e2569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783317, "uuid": "db1e841b-d5bd-4cdc-8eee-be476248e096", "comment": "Malware payload (Mirai)", "value": "423f20e512c1dc354e5f44c64964593f38455f5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783317, "uuid": "4185d26b-0579-4ad2-880e-6f569b720a51", "comment": "Malware payload (Mirai)", "value": "24c2c91361a706b5d2dc2eb7688786657efa68118ab9e56e8bbb92c1a125c2a5b684d4779434b4d020e7684454b130aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783317, "uuid": "0ece510a-0844-44d9-8bbc-e8e7c97358e3", "value": "T117C3C75E6E218F7DF768873047B38B21A35933D636E1D685E2ACD6045F6034E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783317, "uuid": "d073d707-a479-4a45-a1d7-f84cb75e50bf", "value": "1536:E+O5PMvRae4eK2jke89aIM34qLruropKPpOh+JAHHfh8K6eSHQy0qpV7AXY:M5P4Rav4klsWXQ+JAH58KO0uUXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783317, "uuid": "b467d65e-c1af-4271-80c7-a784f531ac4a", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783317, "uuid": "b7c5825e-6280-42e5-83db-6960152c10e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783317, "uuid": "a5b606ca-71c3-49bb-9971-ad78640f9229", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2d25a7-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753404, "uuid": "833e917b-685d-477a-bb96-8e0c3ed424fd", "comment": "Malware payload (AgentTesla)", "value": "001975cb157cbc8b5e05f43846d790d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753404, "uuid": "d353dc87-5f8c-4c08-9094-0de9f717e46a", "comment": "Malware payload (AgentTesla)", "value": "5a43e67720eb299fccc8a096a20ab298009e37fc6febe048b617c5017347da86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753404, "uuid": "479d44b4-cbeb-4088-ad8d-eeb8b56dcccf", "comment": "Malware payload (AgentTesla)", "value": "54fd821f38d51dd906fab883e8c357093f5fb7d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753404, "uuid": "db0eb158-2997-49fc-9556-1a29701b95d9", "comment": "Malware payload (AgentTesla)", "value": "731c10444c198f5b01054165bea3e0059c62f32269af40336e2c29307d814c4b9782f8e836757e3924fdceecccaaba48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753404, "uuid": "4c1afc72-f057-4ebd-8a3d-47a7b2d21e77", "value": "T112D2D9EA2CD9C951CBE8322DE4EE0728F0BDB2C2A9564DE47D1D12458BD608F49E1DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753404, "uuid": "bad7b426-e408-46f4-ac5d-ae6101d0e684", "value": "192:FpkN1WuQOdksr9kpdrEr+iNAr6cvvUrA+iNkrakdudnAr6ZWuQOdksreirE6kndC:FvG+dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753404, "uuid": "fc8e706c-2f8b-4c1f-95ba-31bd273be104", "value": 30896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753404, "uuid": "3b4285cd-1506-4a82-b017-5b2a690c52b8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753404, "uuid": "6fdf8370-1133-4e94-a74c-db52ebd1f77b", "value": "vbv6htplztg.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5426785-7d2f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783777928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783777928, "uuid": "ecc646fb-75a9-4c53-b129-2ef5a6b2f1a3", "comment": "Malware payload", "value": "3b7dae4633680569b2e8f24f2a259d30", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783777928, "uuid": "f5eb7f38-c6a9-4a3f-b990-6a7b7798b242", "comment": "Malware payload", "value": "5a81034a515d713f88a25491ff013254715e0f48cf3ecba74bd2747b2bf395f7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783777928, "uuid": "c7fc1cae-26e5-47b2-b312-c5ce35652653", "comment": "Malware payload", "value": "a2fb0c6dfe1033f5fb34ff6278d9ac9f47de723a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783777928, "uuid": "74e2e841-eb8f-461a-8415-51ab4a2cf1cf", "comment": "Malware payload", "value": "2ce4f25319c1354682154e58bd3c5738f95490454e6088f1a270543e498048dea6106a0b962104e1846ede0d417d1390", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783777928, "uuid": "46e610cb-8a99-45cd-83ae-416441c6e1fc", "value": "T122E6330CB1C041EDD553803DDDD1A655D1AA78A76772CAAF4BA887E12FC72A08C3DB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783777928, "uuid": "f6ac0b3a-bdf6-4faf-b9d5-78b7e2ebbbca", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783777928, "uuid": "edf855bc-8fbd-4ddf-b20e-bd9b784720e3", "value": "393216:9JOrMzuJ9/dJ+TZdIqXMCHWUjXzcuI3/PGTAI:9KzJuZdIqXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783777928, "uuid": "0d473d67-f021-406e-aabc-ceed38306d24", "value": 14270525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783777928, "uuid": "026cf27f-92cd-4641-97c9-a84c5e56391c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783777928, "uuid": "0c3ca3f6-dde7-48d2-b2ce-9ad51598c69e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61f78e5-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753555, "uuid": "362dbc9e-365d-4964-9823-cd919ebba37f", "comment": "Malware payload (Formbook)", "value": "2a7e1a706d8f6e6cbe24c68ca3d6312c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753555, "uuid": "7fcd3735-9f64-4d47-b709-e905a1680009", "comment": "Malware payload (Formbook)", "value": "5baa58fbd2a9309d6853cf1cd5be83adbced95bbdc1a7471c11ee5455f85bfa9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753555, "uuid": "f65436c3-250d-4c82-a275-7a73a14b2479", "comment": "Malware payload (Formbook)", "value": "8a8d36f2ce735061f097271bb9557f88cfe8c213", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753555, "uuid": "52d897d7-9649-4254-b8f7-169912476444", "comment": "Malware payload (Formbook)", "value": "4b4560156a8f7d28815b1ddbf2505fad2884bfd002b436005d3d27ddcfc80cecf1b3bdf2850d5f812ebbf3858bacdcdd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753555, "uuid": "b391650f-484e-4634-a4e5-7f5cb78b99cf", "value": "T1A4B23F9CD7D6007D8ED5D7389C6B0964C7DDC508C1729AB062BB4E2E3F016BAE16832B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753555, "uuid": "5cd56366-c8b2-44d6-859d-d3a403dac0a3", "value": "384:iXMQYnuX7rcuvypIbAxhLRRS/D7AKUNB7DrFf5xBBL0uTzj+FtUY00O:9uX7rNqBq/vAKgNZ70czj+FtA0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753555, "uuid": "8f6c1a5e-9335-4329-ac79-11782b8f1c2a", "value": 25154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753555, "uuid": "e611c550-795f-4378-a19e-cd37c0426986", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753555, "uuid": "3ba61e27-49d5-472e-ad7d-bd8d2586a56e", "value": "PUC 8578\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3084c4-7d7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783811123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783811123, "uuid": "47424d18-69ab-4fff-886d-de28ab71f106", "comment": "Malware payload", "value": "aa246c59edb665b82b92e0788a41337f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783811123, "uuid": "74dec292-bd8f-4f12-a9ff-b46c1e098a24", "comment": "Malware payload", "value": "5bdcf2d4fd8a65c17237d4808e2b613deb0f54de1b90839f1f8e450d8b2acc19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783811123, "uuid": "60a348da-d44e-4f83-827f-f6244c6583eb", "comment": "Malware payload", "value": "1ebf85b32bffb858911ea65289cdbcf4ca3bc304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783811123, "uuid": "78556fe2-4ce2-4186-8e69-54cc231c5229", "comment": "Malware payload", "value": "7ac278e3eb881a25fbce5a6273543b33d9cbd3bc806b99998a8982adb335251150a4e9501f1bdaaf71f9e149786ca54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783811123, "uuid": "cfbe17cd-ffbd-4b3f-a943-f0acf783ec74", "value": "T1C847338023F00398F473F770CEB24B67E6BA7858FA62D74D9681254F1E3A6519990F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783811123, "uuid": "057fd788-5cc3-4ed5-8445-f53d9e2e9965", "value": "94184592e4150dd6cb6610037032ac80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783811123, "uuid": "063945a6-d70f-4e32-8da5-e64ac1dfc959", "value": "393216:dLAmLbNyS3QBin05X2NXehAJ1q8pQ9bwXxxcyOQr2YUfg3Acdf65bThCfRYsWlul:9A+bP3dgX2NuGLQ8+y4kAciBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783811123, "uuid": "4b6e672a-4078-4764-952e-6b7edfd49148", "value": 25704127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783811123, "uuid": "b1576a7b-7058-4c1b-8737-afd704bcec97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783811123, "uuid": "15f61a50-6e94-45d1-a937-df06cc8f19a0", "value": "Drv_ceo_12.8.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37823e9d-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766979, "uuid": "c3125c83-ec8a-4ffc-a7db-43f1b7045812", "comment": "Malware payload (Mirai)", "value": "6ffb1ed819c93955ed7d936febd87e01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766979, "uuid": "a884d156-1f00-4530-aefa-7efff87b2799", "comment": "Malware payload (Mirai)", "value": "5ce7c9fac5faf6d34ed7e0bf07d0dfe3409cfde25fde0aca44dcfe2c2d3dca88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766979, "uuid": "ae08de57-09eb-4f98-b2c4-6035ee21d2ef", "comment": "Malware payload (Mirai)", "value": "e999d3d31c623ab5618b251c9b0e11f8ebcdde12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766979, "uuid": "2aa5b817-c263-40f5-8d38-bfbda919317d", "comment": "Malware payload (Mirai)", "value": "1a5f033ce8a1af30696cb0034b4a886c718daa6645106e95a4cdafb97de417af6e1efee1770c106b0376832fcae546aa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766979, "uuid": "4a329269-4d56-4df5-b426-6eb0a882d54c", "value": "T15DA38EC5EA43E4F1F9561AB0103BA32A8A36D5365535FB45EBA13E31BD23B009E0776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766979, "uuid": "54f6438e-3fda-4ce7-a1b1-0aa1adc4d703", "value": "1536:sElxIoJzdlAVeaCTnmhfYooKXP/qDcNmUdA0DCL0EfcnWMY+034n8ZbRrxfOO9yv:Fl7lwYaCQQw//lmwU0UuYBIn0fO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766979, "uuid": "b58d84a3-14ea-43e2-8270-3fb79dc63dad", "value": 103568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766979, "uuid": "29cf158e-4615-491a-a184-b4f88bb39742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766979, "uuid": "8f1888c2-d0cf-4893-ae02-40323c2729b0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d3a716-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765505, "uuid": "c20dce16-595f-4887-83a6-81bc5f125cd1", "comment": "Malware payload (Mirai)", "value": "bdd75aaef1e0f1d8b01c7d925a17a02c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765505, "uuid": "3cf45484-985c-4243-a881-34e341b6502d", "comment": "Malware payload (Mirai)", "value": "5d4e94bb5112de5a0e04e409c1f3e4b6869efc5143d05449838e9c619b0bd45a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765505, "uuid": "c8e1eb18-3099-4102-ba0f-b6c39cbbe7c6", "comment": "Malware payload (Mirai)", "value": "3c3c7d555666fdb5b9d66d56611f7c528867f1e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765505, "uuid": "a88c42ad-5351-4dd1-985d-16e457f27cd8", "comment": "Malware payload (Mirai)", "value": "aae13ac978cf0a16424807b24aaa9eaba03f50f0249289fb291a34e71341b9a14bc30501b225c949ece160f98319a01e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765505, "uuid": "33791815-597b-440a-9efd-25fb399800cb", "value": "T197B32B85BCE1C921CAC422BBFB2D518D331653DCD2EF7102AE286B7826CA56D1F37545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765505, "uuid": "9422b8ce-73cb-4821-a61f-aadec7339360", "value": "3072:HQd+6d0y39V0immjhBLw902r34fvlozlScy:Ed0eHv443VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765505, "uuid": "3a5ee57b-7fed-441d-9dda-0b5db2da5b91", "value": 107700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765505, "uuid": "93dd288c-19ff-4d41-9f78-bbb9babdc3ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765505, "uuid": "92e9c749-8a1b-4175-a2ed-7d8cd9179c85", "value": "Ares.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b83dcba-7d40-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783785132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785132, "uuid": "9bf866e0-374a-4a9e-bd9a-f7499028ac9c", "comment": "Malware payload", "value": "6c553c9e419c9a9c9a8f8edf48689080", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785132, "uuid": "c05438ef-c0bf-41bf-9ff6-fe0a46d09d52", "comment": "Malware payload", "value": "5dcb78322136f0f0865fe9ccfa4c468d201318100d122ef7f6a0112daf330587", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785132, "uuid": "308390a3-818d-4d55-9026-6b65089e6d33", "comment": "Malware payload", "value": "3bc56fdd0eba52f38d1557617265a907483f0720", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785132, "uuid": "1c98d371-0212-4217-a15d-1f87dc64b6c8", "comment": "Malware payload", "value": "cd0c05c9e4bd86ebde2d241e16580c3ec2c10cbf131a1db829c6f68246b7af39d095f15a359f0c178bd49439e8505654", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785132, "uuid": "2b95df47-b838-4be6-8800-ce1849fb6bc5", "value": "T12EE63308A9D412EEFA33453DDD912241E595B8A04B31C65B8BECC7F25D932E4CD3AB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785132, "uuid": "abfe2dba-54eb-4710-b949-d7ab51a404ef", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785132, "uuid": "d334bd7b-49f3-4b7b-8779-16730f227999", "value": "393216:Fe3/5onAVsodRKv4H7lqXMCHWUjXFcuI3/PGTAI:FeBoAPRKIhqXMb8XyH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783785132, "uuid": "589c177e-0f85-4eb0-bd6a-69cadc249427", "value": 14310188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783785132, "uuid": "e5413d8c-bb9e-4d9f-ac7a-954b0072631a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785132, "uuid": "5ef1eba1-62e8-4a7d-8868-ea7d25573055", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1306777b-7d3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783782810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782810, "uuid": "2a2b33e8-15be-4ae6-beb1-7e60916d2b32", "comment": "Malware payload (Mirai)", "value": "2dc0b8193b148676afcfcd436f152128", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782810, "uuid": "8ca0fc4a-76e2-47e9-a4f8-9412e5733e15", "comment": "Malware payload (Mirai)", "value": "5e4b9a17e267cddc124d5ca59d0aad74205116720cbb9ea02d7264c61f0d6b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782810, "uuid": "958153cd-ba04-46d1-93d1-5cefdbbd32bf", "comment": "Malware payload (Mirai)", "value": "8fa21a550cef78ee8d014e94ec1edeacc9e2ea36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782810, "uuid": "588e5893-5354-454b-a52a-a295cbb96482", "comment": "Malware payload (Mirai)", "value": "785d5631858067f98ef4166e1647ba32931cf06ac56025b4d0d6a613daefaef19500f694f5e9c93c1fbf8db6039e3cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782810, "uuid": "cabb1c2c-7b35-4dc9-acce-d1f7f225484e", "value": "T18D441946FB404A13C4D617BAEA9F42453333E768D3EB73069928AFB43BC775A0E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782810, "uuid": "e2519ac2-a57a-47f7-bb03-a2df6454ea66", "value": "6144:bvEma6tytRoZgJA8aZsIvYvkCViz+zGmidjAV/GT4m62qYNs:LEma6tyQZgJFaZsIvYvkUCW8g/Xm6BYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783782810, "uuid": "d80667c5-0544-4080-a5f1-f7e9f8150731", "value": 256680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783782810, "uuid": "5fc0a81e-9387-4c09-92c8-93c05b79474f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782810, "uuid": "6d1ba4f7-ec33-43c9-a11c-61208120982d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07618c8-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753519, "uuid": "4fa54b02-32c3-4aec-8aee-9ba1ce1d605d", "comment": "Malware payload (XWorm)", "value": "af9c08a1603f4abc673a800fc347e844", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753519, "uuid": "80de5a29-98ad-46eb-bc63-15836a94d4b2", "comment": "Malware payload (XWorm)", "value": "5e9cf53e891d6e59478c8e863312a4eac67c7b77e5cb6c569130b6f95177e54a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753519, "uuid": "2d881863-1061-4e41-b5dc-fd734aaee1f5", "comment": "Malware payload (XWorm)", "value": "ad4f4163648bf83add2ca598ad762610c1fa44b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753519, "uuid": "ca3bdc48-525c-4458-ab9c-adca4f1c63af", "comment": "Malware payload (XWorm)", "value": "4d4e146341795cb00c63e901eb363887073b3b3eb44778aef99ee5cc7ba933470a5aa81d0fcbd01a3b4c71f64576b999", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753519, "uuid": "d8b36558-8469-4224-b860-07b95740b0ef", "value": "T1C375A8FBE16AA2C7AD62DB628EE10141645CF70C5F95093F7B584EFA799F5082063C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753519, "uuid": "83c0e623-f302-4a18-b494-90b272e94cf0", "value": "192:fYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYe:OWmOlNW2UkeSm+/uH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753519, "uuid": "c01ac46c-717a-4365-b659-ccd804b3af7d", "value": 1601294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753519, "uuid": "d802dd9d-139b-4cf5-93fa-f6cb2033bdbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753519, "uuid": "a46f5bbf-c972-4083-9222-2ab1f6fb0324", "value": "ST-001_MUNKAG\u00d6D\u00d6R \u00c9S ALAPS\u00cdK-M\u00c9LY\u00cdT\u00c9S_1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8d9c84-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788808, "uuid": "c7dee013-7355-4619-9cf5-2abecc9cc6dc", "comment": "Malware payload (Mirai)", "value": "61cff27d1865e1cfcdcedccc68fba15c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788808, "uuid": "030b3d28-7dfb-4e00-90d7-06cb7acd59cb", "comment": "Malware payload (Mirai)", "value": "5eb20bf4b6ff91ac45d4f7632661ff2166c7cf1270022a201a2dab8e600a1817", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788808, "uuid": "be7c1744-8c38-437a-bcdd-5f98cd0f307b", "comment": "Malware payload (Mirai)", "value": "19a26d0a2a00618d7f711ca99746f38f9e600db2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788808, "uuid": "4b3bfc0e-9b25-4dc7-b5bc-38275830fca2", "comment": "Malware payload (Mirai)", "value": "0f0e6e8ee76833775bd5e9c6846055c7a40db3466e016f0d1a2a16c0b1a56dbe0c0a1973bd64c0188069f93f1e36cc12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788808, "uuid": "747f71d6-5dac-489d-8502-170e7da890d2", "value": "T13BF33C46E6414A13C0D6177ABBEF42453323AB6493DB73069928BFF43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788808, "uuid": "9dee7c2f-71e6-458f-856b-a763ae3bc69a", "value": "3072:8hG77R4X2HaUJbXUc1df4RVaEFkINdLfhLNM/9tMiOZH7v5w2F:8hGvKGHaUJbXUcrf4aEqIzLfhZM/9Wnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788808, "uuid": "1629fd3a-91b8-4ca2-ac73-43a31f60a541", "value": 160069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788808, "uuid": "932a150b-1e23-4e51-9e09-50018ddd14e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788808, "uuid": "90a41d85-d7fa-4758-b140-0d941e2317ed", "value": "XDarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a781b3-7d4c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783790495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790495, "uuid": "3b88c4c9-6995-4b0e-b773-fcf65d8663f4", "comment": "Malware payload", "value": "52ba905ab2dbbb5691f4b518c39a17b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790495, "uuid": "f1a77a30-acf9-428e-b947-c3c34276de29", "comment": "Malware payload", "value": "5ecad6764c40bac3f71661ae6601930acb0e51a961ee837a3f2f90ca3fd952a4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790495, "uuid": "f4a37f06-306a-4874-9778-bdaa143cc7e6", "comment": "Malware payload", "value": "f10cdba8ca9daf2b92df729f1c1823bcad47887c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790495, "uuid": "e1e27680-014e-4f78-8bce-fc3fa393ff63", "comment": "Malware payload", "value": "9c938f5798b8e42c32d8e758a9e1931779ad6f4b4ea029f66bed48579206c787f5ef5072704035da99b24010e6009df0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790495, "uuid": "4623db21-e285-4fb6-83e5-9d64a312de0e", "value": "T178336C5516817C24EA99C8361C7E2F0CB9AD43E6324492EE7FCB3CF28C4AA9D911971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790495, "uuid": "997ca90b-94a2-40c7-b4c5-2b4ba4a6b0c5", "value": "768:6+X9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:6+gcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783790495, "uuid": "0889f036-be1d-49f6-a0d9-a604a36f3c44", "value": 50366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783790495, "uuid": "2f10fb47-6bf8-43a7-94f1-f7d56a72f5f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790495, "uuid": "87a2a6f2-b2b1-4d96-92f0-0d3a42d3e7bc", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29305017-7d46-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783787571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787571, "uuid": "7920dded-5f67-484e-9c23-08d4c14d6948", "comment": "Malware payload (Mirai)", "value": "7b09ab36204123371c8fb44cb1cad42b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787571, "uuid": "96f32c73-f2a3-4d45-9cf1-32e88605fad3", "comment": "Malware payload (Mirai)", "value": "5f13ce55c8aa64b6e5744b52fd927c11c12605386132d541dd0f29956ba3ed88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787571, "uuid": "d450f623-bf68-4e34-9d87-f1821893eb2f", "comment": "Malware payload (Mirai)", "value": "10cc6fce07115705bfbd32f24b324673cf99fdbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787571, "uuid": "d16794d9-66cd-44a8-9b39-732facf2059c", "comment": "Malware payload (Mirai)", "value": "625c3290f7706a150dc5cef6a72765687a703d0d6dae76958918b7c7401b0b9d5c8785b32f8d11a95cbc7c708767f73c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787571, "uuid": "e9ebead0-7e23-4474-9be7-9c2203dd4e12", "value": "T156948D12FAE2D4B2F49200B0121B67A2A677D934213BD9A7D7D61D74D931BC0872A37F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787571, "uuid": "d07a6c03-57f9-45be-b511-cc171967b8d6", "value": "6144:3MvYEh/1fjr6qd2k/H6/043TsseuhhG4BxkvTo3pEZuhe/:3MQGNjp/Hm3hRhJxk7qk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783787571, "uuid": "0bbbaf4e-381c-48b4-8a53-8ee9c7b873ea", "value": 444676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783787571, "uuid": "c51db68d-a915-49a2-a129-c1f70940c10d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787571, "uuid": "a24717f4-578a-46df-82e1-b9b8e0315b60", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273fd7cf-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766952, "uuid": "b19c6f29-de4d-4666-a9f4-c9e4e50034fb", "comment": "Malware payload (Mirai)", "value": "e68799e20298d7fe3a9f631d8628f74f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766952, "uuid": "537469af-ad78-4deb-bfd9-d8bd336c46ae", "comment": "Malware payload (Mirai)", "value": "5f7d35d9e71f3df72a63610f6fe2684b6490bae26d89df74c3e156153e364e57", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766952, "uuid": "74bf5b64-8069-4384-b51b-3fd7d04e1f3f", "comment": "Malware payload (Mirai)", "value": "4aa7ce00ddf82e5d426548d91d29f0198763689b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766952, "uuid": "f5d16913-c593-43b4-97ec-6e0f087ce316", "comment": "Malware payload (Mirai)", "value": "d288413dcb292429d01e66b53adeb9cba92359ddab40e49cc7a9c9d178208dc9abce2ab149646da337c030fa136fc00c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766952, "uuid": "a1a6a3d9-a0fa-4048-9e5a-46f127bcb03f", "value": "T1A8E38EAC9E0E6D42D2C3E3BDAD5A0F62313678744664C3F61E00528DEADEDD69CF5026", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766952, "uuid": "18aa5688-7065-4a2e-a940-57b82dfe428f", "value": "3072:O9/93V+SPue/MCb0VBmH3MfnfeCPStzDOiB9KhRYgS:OPUAB/CiXOnf8tmiTKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766952, "uuid": "cf0209b8-8a21-4ceb-bfbd-9346164e9c30", "value": 145376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766952, "uuid": "670906b8-2650-40b8-a677-18324b351272", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766952, "uuid": "021974a5-151a-45d2-90d0-f2c14aea6d8b", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52dca42-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753554, "uuid": "9693c814-e102-4526-ae82-96ef7003505e", "comment": "Malware payload (XWorm)", "value": "6a46a78fa9e94e012a069b3add1a464c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753554, "uuid": "a1d4f417-5632-4c2f-b9dd-7e382ff1d9fe", "comment": "Malware payload (XWorm)", "value": "5fae9386d96698451cd76f48f7c216a5fd3b7a37cfd03825f84156ea810dab2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753554, "uuid": "40b0a596-7583-4468-bf96-9db540474ac1", "comment": "Malware payload (XWorm)", "value": "e07c3adbb068934b971ee29d2c0a5fba769c8692", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753554, "uuid": "821f04d1-13e5-4212-a8b2-655d11d60e66", "comment": "Malware payload (XWorm)", "value": "28660869eee1e1f5b7e10db37230f35d90531b5983d993abe7d76342e79a52e20e48c745e4d979c9cf9237289c28a262", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753554, "uuid": "dc2adac6-5dd6-43d8-a8bd-b270e870c6e0", "value": "T12BB511BD8E7E249850B6B64A3DCC0E9E84AEDCD72F374C54F61ACAC65C419463083E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753554, "uuid": "5895eb43-268f-4dba-bb81-66952a2526b9", "value": "96:ZYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYnYn4:wS/mewKK4O7tGvWaoEwPCaOe6W72P/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753554, "uuid": "3428bb3f-a9a7-4d34-b76d-af68dd905768", "value": 2288923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753554, "uuid": "c55fc3f4-c930-46cc-8937-69c8c3aa3e7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753554, "uuid": "6db033ec-c2a6-4b19-afce-0ea069dc40a3", "value": "confirmaci\u00f3n de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84adaa8-7ceb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748727, "uuid": "eccd9840-1d26-4b06-b185-4abc7610712a", "comment": "Malware payload (Mirai)", "value": "97110c6a5c4bacda635aea95b0fbc95b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748727, "uuid": "4ca39264-3b58-4367-a596-ba6e5d622801", "comment": "Malware payload (Mirai)", "value": "6008b72b141eb3af8452450a16c797bb04147530f0f19707df66ec3196b0f14c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748727, "uuid": "96d6dd5e-6528-4e8f-98e6-6db532e454f6", "comment": "Malware payload (Mirai)", "value": "af122accde6fbaca308c7f968ca0d0b872f4f52c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748727, "uuid": "56abbe1f-3682-4357-9c82-3f419fcb87cc", "comment": "Malware payload (Mirai)", "value": "0d57dc4bc4fac5f7d862f9f2a6a14aaa6c4745fdee7c00441d35258523ffdad16c3dc68d95b1fd258395d93b8c3f6d73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748727, "uuid": "4e85e8db-c364-4e48-8f0b-4233ea9ff167", "value": "T16A63E706EF514EEBDC6FCE3705A80B0235DC994722B43B7A3574D92CB51A54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748727, "uuid": "ba20668b-8486-46ee-a7fc-dac88a8d7290", "value": "1536:0tuR5Bh2gOzToTMAXZw5zk5vGtLpEdyHntx3sbRGW:0tWBogcIw5sN6vOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748727, "uuid": "348b10cf-389b-4217-bddb-2ce05cc4b5c9", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748727, "uuid": "ab794d15-b36d-42d8-92db-278eb4097642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748727, "uuid": "c113e0b0-7949-43c5-a342-ae321ccf2c77", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad8fbb5-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783753510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753510, "uuid": "a3364faa-3e44-4a67-b828-7b7a3e2c3211", "comment": "Malware payload", "value": "cb10d2038f94e871a48d8e82f7c2e466", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753510, "uuid": "92fe3d3f-88f7-4f5a-a988-cbba78f962e5", "comment": "Malware payload", "value": "609025e130a92fbd0913e30e3b4cfac0b8d13548a99f1e6dd77545b2cdc621a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753510, "uuid": "7c5a98db-1b38-433e-a1e1-7994c0da0f5e", "comment": "Malware payload", "value": "b99a6f7c0f922ccc33b17ff0153f0ecbcb6978b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753510, "uuid": "723c729b-895e-4926-a1a0-21d56d682a99", "comment": "Malware payload", "value": "86429e53c76560135faabddce91c50770e7b5b0ef603ade7e707886b33b6ae4a7ea374bae1eb08f73bf50649f1d8b4bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753510, "uuid": "b04c64ef-5a22-4fec-b53f-86fa4c469c87", "value": "T122A58FD01BBC248541A956EB8F1A3D5C3DECE5026E278E5F30A052867591E30EE2EDFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753510, "uuid": "a4d6f01d-0869-4e88-a99b-adc9336a4aec", "value": "96:sdNXwHn7bzvnX3CbhaZ/LDqhcn9r03QOCKb0ROcPRnL0:zHTX3GKL3h7ROER0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753510, "uuid": "c2ba05ef-bf22-4297-aa09-076a88d8f582", "value": 2205479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753510, "uuid": "e54d62c6-3f4d-4af0-b1fc-5b2c5b6780fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753510, "uuid": "1becaf4a-e7b4-447b-8dbf-a4d2da89d274", "value": "AGGT-N012141_doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36516395-7d09-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783761394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761394, "uuid": "88ec876c-ccb1-45e8-9559-d2a919e61d07", "comment": "Malware payload", "value": "cc0ad90265d4b8b02aa194e57ab86b1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761394, "uuid": "2b94dc9c-61b5-4af9-9650-cd1a844f430f", "comment": "Malware payload", "value": "623c68a3dbfa0b799b8bb176e2d040a55cfe15986e1b3f35784b600bea6e0932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761394, "uuid": "3fa7f060-c1e2-4c35-9b51-5a77218773b2", "comment": "Malware payload", "value": "6fbad6375569a7c8d42e19d004fa39e1b9de1977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761394, "uuid": "16e93092-515e-4dd1-8f44-09c886bd07cd", "comment": "Malware payload", "value": "6b99a7e4d29221236a50db6379ff80ac02822399693efe7a586656743b1dbc31a48266a09f91089e13e664e233de0f54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761394, "uuid": "cb65ff69-4493-43de-a157-373b86153647", "value": "T1CE0833188BF9A297E93D9CFC11B0D673FD29107DAE28789B5AF474217173009067E68E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761394, "uuid": "7acbcf04-19fa-48a3-ab56-e6da103d0973", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761394, "uuid": "c349fbeb-74c1-4592-9403-45c9f471173f", "value": "1572864:pt9IKPSb+WFYdeTqowzKYypCPRfYLgRLlPBnU6InslAQJnAE7:pUK7WFYHoyKYyuB/5PU6InsJnAE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783761394, "uuid": "7e8f0bbd-b93b-40b5-981d-3cda99eed4dc", "value": 77727972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783761394, "uuid": "fd62f002-1f66-4a66-8a59-c8cb82dc1748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761394, "uuid": "c5e10a1b-14ff-42dd-8620-6306a2e7c629", "value": "Sloven_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e7a24d-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766972, "uuid": "d955d2d2-55c0-4d5e-ba2c-9be9e5e96045", "comment": "Malware payload (Mirai)", "value": "d20432918ee474ce65ac0e67e03cb642", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766972, "uuid": "3fc117a6-c3ea-4feb-a915-19692cb5f591", "comment": "Malware payload (Mirai)", "value": "6343a8e3d8e5a16817526c09a61a8a8f5a28cf1df10cf14a8475d69f171821ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766972, "uuid": "88f03c1e-64b7-425f-b792-76adb8126251", "comment": "Malware payload (Mirai)", "value": "0ed9be16a374e0bb8bb0aa8fdfd081aa76a8b0b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766972, "uuid": "9fa8b489-764c-4194-bbe4-8030abc72cc1", "comment": "Malware payload (Mirai)", "value": "82def0d65c69e55a363aaee3b3193d280e829eeac4eb3006f2a1bc296d85599c3dac4b08e9b07913bd13cc87d3624f14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766972, "uuid": "092dbcb6-f20e-4934-9116-801b5c7692b0", "value": "T10AB31899F8D29A22C5C2627FFA4F42CD773663E4D3DF7107DD196B20328652B0E6A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766972, "uuid": "04270818-569b-446e-bf39-ea073a0b4533", "value": "3072:hMMXLR6xN1QpbGs5bp4HhCTo4TDJIwtn5e:hMMX9Qubn519o4xI6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766972, "uuid": "ac87968b-f47b-48fe-aa39-871fe47d2bf6", "value": 108000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766972, "uuid": "abb88403-0622-4779-a614-b99331a68454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766972, "uuid": "9eadb8ba-002f-456c-899f-81e697859cbf", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773899df-7ce9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783747759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747759, "uuid": "830f95ea-bead-4c07-bb30-f3487854c994", "comment": "Malware payload (Mirai)", "value": "171c2ce58d79a3e7c546f720e22ccfb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747759, "uuid": "63c8ebf0-8cb9-4a3f-a8c1-4a32fcaed0c4", "comment": "Malware payload (Mirai)", "value": "63d32cdc1388827bbb8913843d4b21708227ef2d79f00b574cc003cdd3fea8bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747759, "uuid": "9481e598-6d87-4db8-b9c0-141f3ce641a1", "comment": "Malware payload (Mirai)", "value": "6a60b2ab1094166d85cdca444406995a4650c7c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747759, "uuid": "3b23b3e8-4c1f-40bd-bc36-e1252be1e0fe", "comment": "Malware payload (Mirai)", "value": "676a631f941a6d77a45c824579ef087e08c189ced1e759564fce1bcf4338b13df57331b2a5fc3d4c8667613590aa8f49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747759, "uuid": "a25760e4-8f6d-4d9e-81cf-71372502bc23", "value": "T1CE541A56BD819B02C1D116FAFB6E828A33177FB8D2DE3212DD145FA0778A49F0E2B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747759, "uuid": "b65193ba-b9f9-4e61-b6a7-455bfc83068b", "value": "6144:fWA3SvwmzQKR6ZUVsiFwXPhRhqNWtkAJfsXaCYUWBwL5YcLqUXGqxAdnbqPVrF3G:jS5E4EiF0p6stZCXaCSWL5Yc/XcqPVrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783747759, "uuid": "a4d98da4-5fbf-43bd-b95f-948c227832ee", "value": 303408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783747759, "uuid": "d7f40ad2-7c38-4707-b637-443a47be443d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747759, "uuid": "1aa5723b-f995-4377-a7b6-41212326e3f4", "value": "kworkerd-softirq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad003ab-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766958, "uuid": "dc5a34ed-4bdc-426e-b6b9-54c310b1be98", "comment": "Malware payload (Mirai)", "value": "5ef80e31e8bc8ecdfb068d8d354c47af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766958, "uuid": "e5cc2e38-5d0b-4fa2-93b3-ef2041d0f059", "comment": "Malware payload (Mirai)", "value": "63d99fc5106c6006d320bb9e069ca5a967de993243cd3963a94a5093200b9929", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766958, "uuid": "8bcb4179-1f29-4e50-9751-59d15246e8a6", "comment": "Malware payload (Mirai)", "value": "fc63ca65952573e219160b0c60c99e8c80a92d3a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766958, "uuid": "f46c80ad-43e2-4519-9cc6-a678c4e9d096", "comment": "Malware payload (Mirai)", "value": "0c825860d62a11516e65738f52ccce7774cb94ac4da12fffe177b4f941e6110b188d46776759c4aaa249bdeaf14084cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766958, "uuid": "09ebd3e5-316d-4e75-87c7-b6594766e9a0", "value": "T1C3219EE6A7D35E17CC540237DCEF5710E362AE44859EF513E35116250D3F21A5F21159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766958, "uuid": "4d046670-09f7-4af9-862d-18980f3d7342", "value": "24:J6KFpV0gP9qD0at6EoKGUrUlFSy4WzLCkIddgH9IkAYwNfm:J6KjFqDPtZrkFSy4WzLT9IkAYwNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766958, "uuid": "c73821e9-7dec-40aa-a203-15469faf1a02", "value": 1152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766958, "uuid": "021376ea-edc2-482c-823e-7a528cbbdbef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766958, "uuid": "d3a4e1a2-951e-4bb4-ac4a-ba9d4f9dfe3e", "value": "dlr.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4e0181-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766961, "uuid": "3c1703b6-05ef-4114-b9b3-611e29a2ca6e", "comment": "Malware payload (Mirai)", "value": "54ff820879e45c2ab978072a3d3e07f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766961, "uuid": "08a7beaf-066f-4994-b820-9c275b26a7b9", "comment": "Malware payload (Mirai)", "value": "64156be4c063fe56c1a61990f3ed56bb549a953b212c4849629e792d2f5aa40e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766961, "uuid": "a747f014-ff68-4ef6-92d2-5b6676b522a4", "comment": "Malware payload (Mirai)", "value": "939cc69eb16268a8bf60a7a8a6672622f36751b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766961, "uuid": "4cdeaaee-cbff-484f-86dc-97effc4c6208", "comment": "Malware payload (Mirai)", "value": "ef96db61aa548bc9aeffc1d0484ade00cc42e47f6deb603e858157a220d7f676d9787d2b917ef9cdb81e5d988f6ea63a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766961, "uuid": "12f4bcd5-f605-4401-9386-d624abe9e79e", "value": "T1DE31FED1A7D09DBDC4F451BE9E5B0310B3799F00E0C77222870C63696C1AE3C9E27446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766961, "uuid": "d4771b2a-7159-4b88-a743-e80344385594", "value": "24:uTcRKGpa7Urz/jlfe+XK1hZVev3gRGaJ9ixBBuLlTO9gjSq:uARKGpa7UrLZe9s+JCBu1OZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766961, "uuid": "eca8e7c0-1de9-41c6-9821-09c8f1cf627f", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766961, "uuid": "cc81a9c5-9aa0-402a-ac1b-612fdc95c926", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766961, "uuid": "2de2f44e-291f-49b3-a9ec-1a88de67d9fe", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ff5b49-7cd9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783741070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741070, "uuid": "6e30de54-cf2e-4c45-9d65-dc65a25c82fb", "comment": "Malware payload", "value": "0d46017a3c37466dcecf99dcc1632bcc", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "EvilAI", "colour": "#8A73A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KALIM LIMITED", "colour": "#F26AD6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741070, "uuid": "d7d2d169-41a2-465b-8950-7f12925bbb9b", "comment": "Malware payload", "value": "6451eb28eb29c067d8ca421b7a73462b669562ef5e06c447d13914c5d4116150", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "EvilAI", "colour": "#8A73A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KALIM LIMITED", "colour": "#F26AD6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741070, "uuid": "dca77cf6-ea5f-4b6f-a71d-b8fd3e76bd63", "comment": "Malware payload", "value": "e8ab7406d6f6430f7c6aba21607d12e7815702f6", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "EvilAI", "colour": "#8A73A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KALIM LIMITED", "colour": "#F26AD6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783741070, "uuid": "637d6895-9cc3-4644-9640-19619512dbfe", "comment": "Malware payload", "value": "1ba04f4eb5ef83166f0d491db6ef4dbf562d32cb2a63005158e4a3e3b6f8282b2fd302ec25f19fde93925c259ccc9145", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "EvilAI", "colour": "#8A73A7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KALIM LIMITED", "colour": "#F26AD6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741070, "uuid": "95d49904-87eb-4d79-a960-35a90f0a7e8d", "value": "T1F4659F19D646DE2EFF028C745B6338224BC5E900CB9617C2D2AC4EBBACB92444D5EDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741070, "uuid": "aadec2a0-18b8-459d-9b74-36b450dc038d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741070, "uuid": "ae9cc564-4921-4a60-9036-6137c94685e6", "value": "24576:qFFEsF/21U4S/4Y01vzu/IJVU14K+mFlVm/n7seNw9CAtIISv3S:SFEsF/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783741070, "uuid": "147b8869-979a-474b-a674-3bc39b1cb7eb", "value": 1488704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783741070, "uuid": "14c7b050-c36d-4360-b981-f9ed653a0bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783741070, "uuid": "a0434bb8-4eff-4235-9eb4-f493447c11a8", "value": "TXTconverterSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8554f1b5-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783752937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752937, "uuid": "a745af38-6a0e-4e67-b6e3-9c85d0b57068", "comment": "Malware payload", "value": "d5e471c46b3e07cd14780e5b92cc4a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752937, "uuid": "343cea3f-51e5-428b-9bd7-6367ab4184ab", "comment": "Malware payload", "value": "6561ba943d100e3834c16abd8b38513bc0ea983ef02a172eb66fd7bce803ae73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752937, "uuid": "d83d5ab2-b8b1-4b83-9835-eb533d157198", "comment": "Malware payload", "value": "f7aa8f17280432b47fa6d3c57d2568202b981d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752937, "uuid": "6facff15-7a56-4ca4-98d9-259cddb6859d", "comment": "Malware payload", "value": "38f2cc7267c507bfd91c3c014c869784ff022c2d383af8df01bef2521d1ada958693d98da6cf6237492d538ae528b550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752937, "uuid": "797dfa62-ae8e-4ff2-9cc3-40401849ec6e", "value": "T1D6068D17E2A350FCC12BC17C46579672A931B828C534FE7F5A94DB312E31E50AB6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752937, "uuid": "081307f2-8055-4ddb-aab5-397e45293ac3", "value": "0b5e5be5c80bbfa5fe328363fcad3260", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752937, "uuid": "970f7525-ae2b-4a28-8cff-edf8a42a71cc", "value": "98304:5b/KgkK+7dGd91FUztjOdBEm8bILHGWCv5IjjPmgoR:Bvuq1FUzMOegv5IjjPmgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752937, "uuid": "eceb9752-a66f-4c3d-a455-5dc4c162dc01", "value": 3798528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752937, "uuid": "f097dc1f-22b3-40ca-a318-59d3ea226fdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752937, "uuid": "52d98fbd-f1c6-4598-b846-f4c2e8af6b4c", "value": "d5e471c46b3e07cd14780e5b92cc4a36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f41b59-7d21-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783771993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783771993, "uuid": "94dd71b8-c9b0-4416-88f9-36d9d0f06c65", "comment": "Malware payload", "value": "26c8edb01d3db568639f145ce286ebb6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783771993, "uuid": "83f76e18-240e-4536-b469-4781f15ded86", "comment": "Malware payload", "value": "67ac3dcea8bd9a75d1aabc0957a465e8952a725e780ee5091d5fc06cf57d11e0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783771993, "uuid": "337b8f29-e745-4bb0-b865-50ea7b0b5dc6", "comment": "Malware payload", "value": "a7200cbef90328923fbd16e798d3128a8f6b25cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783771993, "uuid": "19b40035-a1e3-4e4c-a78d-0777c790193e", "comment": "Malware payload", "value": "467113972969a3e4581a33e4f4655bf6b6f52a2f294a61b8fed32a3719c048dfa856030b2f4a4f150a56f05bbb8fac15", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783771993, "uuid": "0078d006-7ca9-4ab2-88bf-1737429ea8d6", "value": "T1B2C27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1224D42AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783771993, "uuid": "f20181c5-b28b-475b-8b4d-3993188f7498", "value": "768:G8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:G8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783771993, "uuid": "f152e9e2-b609-4784-93f9-5385fc22638f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783771993, "uuid": "a09cfa3d-978b-43d3-868d-7491ae7a3764", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783771993, "uuid": "8d9a4d7d-2db8-4381-a9d9-ac59dc6a7cbd", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71aeb445-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753333, "uuid": "5e55b48f-28ce-4241-9a7f-a20c165b219c", "comment": "Malware payload (RemcosRAT)", "value": "73132c58be77aa0646a591d51f5944ab", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753333, "uuid": "8464a6fb-220d-4641-95fa-3ed609e4d75a", "comment": "Malware payload (RemcosRAT)", "value": "6bd60df85d8916b75d47f60b0a785efdaed4def6471462e6dd89b580b031430d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753333, "uuid": "7132abe0-c5de-4b3b-921a-5ca47e09bc6b", "comment": "Malware payload (RemcosRAT)", "value": "40d670a27294d8ca38d6e3875b88637259762880", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753333, "uuid": "d0cb1a06-802a-4ed3-bd02-3756e68e713e", "comment": "Malware payload (RemcosRAT)", "value": "dfcce781a9ad7eb6e758c8046e949bf94af5a68b0bef2904e152099c29faac8e72e5fd9846be84940aea54f843a28afa", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753333, "uuid": "311bc0d2-c060-48fc-ba9b-451ef1e0da11", "value": "T1768282A7DA825F45ED472BB6DC907C0290F9D344B53281C4BDBF6394340F2689F62AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753333, "uuid": "bca1f776-61b4-4dec-b9ad-6aa0d4068eb4", "value": "384:s+p2IwI3TSbD1u7ePMLNRWRdSaAvKrZIrzhWWZZmlXlv:suwbnU7EcqdSa1yuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753333, "uuid": "94e8407d-115a-4a51-9360-36a70f4417e0", "value": 19060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753333, "uuid": "c59944d2-af54-4cc4-9ec2-382eecc84115", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753333, "uuid": "95807428-433f-4110-b3e2-3c7d93a8273e", "value": "HR Leave Schedule 2026 (Updated).vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e38538-7d46-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783787544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787544, "uuid": "3f0f310d-151e-4f10-84ad-7abd34f26af9", "comment": "Malware payload (Mirai)", "value": "2f5b263ebd32b011a863f888bab8ed63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787544, "uuid": "3c4568c4-5bfe-4c4b-990e-0c495ef2860a", "comment": "Malware payload (Mirai)", "value": "6bdcd3db6a0fcd59aa478e1eb790092a8b946503d232a0316bb75584938ca014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787544, "uuid": "c9f59cca-14a8-4b14-8529-58119dca2de8", "comment": "Malware payload (Mirai)", "value": "1eac425494548d1151d626ec9f4226709c8d5962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787544, "uuid": "aee606bf-275d-4d96-bb2a-d24843bab90f", "comment": "Malware payload (Mirai)", "value": "723bb97866cf55203dfa86d1c5b7e31794250f434d5ce0d75bb03095a32210d72f133d8027bec68d9d368b4a2c3382be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787544, "uuid": "47c3d876-1aff-4c9c-b0ea-10d61c684366", "value": "T10E24123FE3A57E35FC8660F65B0F0E53EDE0B5DABD813248A925BAB3047F8615A61110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787544, "uuid": "b8675196-64f3-4fde-a416-3093b5448c9b", "value": "6144:Q+iDA/SUnk4EnY3DptXtS+Yf0tRwA2eLU31c3ooPiE:dCA/SlVYzntoKRYeLU31QoaiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783787544, "uuid": "efb6d7e0-d6dd-4547-9b7e-c855efd89abb", "value": 221472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783787544, "uuid": "ef4e914c-d620-43d7-b414-78dd6b25c35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787544, "uuid": "1ebf55d5-0498-4221-b788-344bccf57caa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d79de9-7d18-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783767812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767812, "uuid": "b0598f4b-8d8c-48f7-9590-04af3cb1c936", "comment": "Malware payload (ConnectWise)", "value": "c11703f8e20eb8d7fa890a59873d9436", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767812, "uuid": "fe433ba9-b1ef-4ea0-bd1b-070cc4d85606", "comment": "Malware payload (ConnectWise)", "value": "6c212f1d0ae56bc0f959e24580771ad1f12ef9613b6347bc393cade21b61fe64", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767812, "uuid": "1f1ced95-0511-49af-a492-a0a9058883ca", "comment": "Malware payload (ConnectWise)", "value": "1459b376eb5690f0b5b915ffb2fe2c72ebeef32c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767812, "uuid": "86e9a2ce-1aba-4ca4-9d27-b44fff5290ac", "comment": "Malware payload (ConnectWise)", "value": "e16ad2fc5da2906e915029e5f371ce6544353966a755c9b47d4367ce96c07f7fc302ada7cf423d3f3986c64788809a23", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767812, "uuid": "23889a3a-5822-41ab-8423-79f611b16ca4", "value": "T154646C11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767812, "uuid": "65b57770-4462-4568-b6d5-660fc65adddc", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767812, "uuid": "44484ca1-ea2f-4e6f-a944-6c25959e272d", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9G:h1iw7gryNkSV1hy1Z1u2JLu9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783767812, "uuid": "377246d3-97ef-4e2f-a046-55189e91947b", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783767812, "uuid": "82df9a7e-4e55-4854-82f2-da62fca152ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767812, "uuid": "af89382f-8bb1-4d39-b9bd-5622b2f30c1b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4354b164-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783320, "uuid": "0f22d05e-402e-4a8b-b074-e1d4ffe64567", "comment": "Malware payload (Mirai)", "value": "0fdada23e83ff397249f74a5c0f3f482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783320, "uuid": "4408fc0a-7d2b-4bfd-b797-9d66369570f6", "comment": "Malware payload (Mirai)", "value": "6c5ed0fd23d2e150da5d68437c240e9746b9af7a676f1d3040410955ece868b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783320, "uuid": "398d4758-37a5-408d-a6a3-64a578f0fb03", "comment": "Malware payload (Mirai)", "value": "94e7c9a14cc695783675ecef2ee7ffe5ffd527f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783320, "uuid": "6acfedab-1fd8-4085-8645-0b73ec9ef09d", "comment": "Malware payload (Mirai)", "value": "9c543ead7789e3693b980f0392dad6898d1bdb3f0486591f53adb47036102ed4c5daa4ee6b36fb842db0c09ae9681d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783320, "uuid": "16147c68-05c0-432a-aabf-d4a369209e39", "value": "T183933992FD418662C6C516B6FB1E428E372713A9E2EE7203DD255F2133CB91B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783320, "uuid": "52c1534b-1fb2-4399-9de0-837216913e55", "value": "1536:kHmZfFY5rNJuyi0E5uL9lSOyY9SSQLcyrH7HOQlZVPSvFFV:km1FY5rN8YL9lZrMJLcE7u4kJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783320, "uuid": "f84682b9-8b16-4507-870b-44392c56245d", "value": 93100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783320, "uuid": "8fa7b902-97b7-41a3-88ab-13bb6999104a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783320, "uuid": "d51f2ea2-43a6-40c9-b6cb-1b8ea33a9259", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d43b465-7d17-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783767499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767499, "uuid": "c9dcc745-a5b5-43e3-8372-9eab42ac3548", "comment": "Malware payload (ConnectWise)", "value": "3344d2a2fbb99f42a6fe494b45961e37", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767499, "uuid": "bb2e1dc9-e6e8-4e93-a781-6e3de43823bf", "comment": "Malware payload (ConnectWise)", "value": "6dc9e88902aaa3be9870bdda7ca206b05f7b75696490a896cea61e9b8c66c71f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767499, "uuid": "c4f502bb-02d1-497f-8d88-bfcd109db013", "comment": "Malware payload (ConnectWise)", "value": "26e2967c0c2ba1b718fc526e4be98e48a7586d69", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767499, "uuid": "5554d1d1-cb24-4f04-88c4-22318cb9827e", "comment": "Malware payload (ConnectWise)", "value": "5e3a299c4e1d63ffcd939bef175740b38170f9f06e8c40dcf9adf8424dbe8e08aa5fd1119c46b8c5cf27a0d3eed86786", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767499, "uuid": "5256dc62-ba4d-4530-9afc-91585cbeba0b", "value": "T125646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767499, "uuid": "f0945d11-0aa3-4445-8044-526ab15d7d1b", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767499, "uuid": "80fdd94f-8784-4dfe-8002-4d627e23b91c", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9cPD0:51iw7gryNkSV1hy1Z1u2JLa9cPD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783767499, "uuid": "8287e888-07de-4039-a6a1-07ce05adc635", "value": 312600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783767499, "uuid": "a15b6728-5dd8-41ab-8783-065f308c98e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767499, "uuid": "de8f53e0-7bcc-4c69-a1d0-4208ad3b51bc", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c90531-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766977, "uuid": "afe91940-9851-4d19-9120-054ec9914a9f", "comment": "Malware payload (Mirai)", "value": "edfa4c6d82c04888a6ea27af738fd924", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766977, "uuid": "a52aeaf3-faaa-4521-b8c9-cf2a767eced9", "comment": "Malware payload (Mirai)", "value": "6e39e4913635a9a8d7ae1d7b8981f634de9b8f986457ee0018ade26bed82d493", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766977, "uuid": "b8917e0d-27f8-49c4-af24-a58da0c79acf", "comment": "Malware payload (Mirai)", "value": "cdb5dc7d5a59c39faffac2b9fff5c833d60d7b51", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766977, "uuid": "39eb89ea-b1ee-4217-a1ce-dcd838727429", "comment": "Malware payload (Mirai)", "value": "d3c7e440452758a3f572f66e9ea9bf729cdd9de48cc4d0c9475ad0ba7be0a98ce2c04d5987790a5b85856396f58743d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766977, "uuid": "c9ca13eb-6e0a-4566-ad22-ed81e27dbbf4", "value": "T1EBE3F717EF602DF7E8EBCC7390B89B0924DC654A32942BB56574E428B65B44F4AD38F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766977, "uuid": "26f278dd-e025-435d-a72c-d5bad0859b89", "value": "3072:Wi9vXgPP8ydyB/T/vlO0nc9Kj0r2Us+a7ktn5/k:nhgPhdyB/jdBc9KQr2UsQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766977, "uuid": "b48d812c-bcf6-4764-99fe-4d37241a857d", "value": 147200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766977, "uuid": "01a4273a-3dce-4be2-aaae-f33d02521899", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766977, "uuid": "a134b7ee-19ef-4195-a345-288c435f33ee", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b052d8d4-7d54-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783793811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793811, "uuid": "2cee95c0-531f-4b60-99cb-7b282b4512f7", "comment": "Malware payload (Mirai)", "value": "26db9ddb5a559a07cab6110dc1722345", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793811, "uuid": "3c9ccf28-23a6-4323-b3c5-b5dc1ce1229d", "comment": "Malware payload (Mirai)", "value": "6f64ea246118283c5e6de77bfb8e6528eaac21288985240c42bd76bf797508f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793811, "uuid": "509b38a1-434a-492f-be63-f30b0c02266d", "comment": "Malware payload (Mirai)", "value": "ab47281aedf7ca5a85e953749a7ae8ac599ff529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793811, "uuid": "39dec3a7-0cbc-46a3-a7f3-007b16740959", "comment": "Malware payload (Mirai)", "value": "ccfeee62e198f6144aefe8736817e20873112614bc54bf904d9f4040ed0f387cf461f90bb69d3f73dc3524081d6d3e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793811, "uuid": "d2ddc71b-5f7c-4a55-abfb-123b7f54307a", "value": "T1D08328C2BA4BC4F5D9074830406BF33FCB32E6394061D75EEF5A9E69DE336025626299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793811, "uuid": "9a1654d6-cad1-4157-bb67-2391d3df830d", "value": "1536:oolW/mih9H+KE7lMzTwuWAFclsWSANxHU+7AoGV1hSvt:BlemU9HI7YwuAvPDU+79GY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793811, "uuid": "756b91e7-9f4b-46da-b97d-28addd753c7f", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793811, "uuid": "7bbe6753-1ef0-4b11-b424-6dabde14a09b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793811, "uuid": "8780995a-6dfd-455b-a725-6952634c9829", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c293c050-7d0b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783762488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762488, "uuid": "3284387f-f4c5-4b23-ac2f-7319cde7e932", "comment": "Malware payload", "value": "ff2fddd7f69467775cd53db9d7a6aba3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762488, "uuid": "5b03abc2-97d3-48e3-94c4-6f6f43f05e43", "comment": "Malware payload", "value": "700451e8578f9850c745bac144c7c75a066d72bef8e4f473b3e6c688c8a1ed11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762488, "uuid": "f2eaa127-48e3-44fc-a76e-68c086f03bd3", "comment": "Malware payload", "value": "a5ca27f6869052e9f8134ebfaed3512b6b13f934", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762488, "uuid": "35fe7cf9-31e4-40a7-8e58-4f3a98ec3acb", "comment": "Malware payload", "value": "6cef7f833561e61300b35f57463ed022408e54cbe8f79d7b41f9c0fa4c4836b841164ab7cf162059aefa67ed8779429b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762488, "uuid": "573e1acd-5bbc-4058-912b-94fbeae5139e", "value": "T146E41B1BAF540EFBD82FCD3705A91B0635CC659732A63B353134DE14BA5AA0A89D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762488, "uuid": "f97cc6c6-7110-4ca0-b722-5ed2e6b69aea", "value": "6144:r8i4+ZM31ZGCMxdK0F91HQBFgFDQmB3PG12wEQiREZfBy83W:r8OxHF91HQBWSN2wAREzL3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762488, "uuid": "3f1975f9-490b-4364-9b30-44b53ae9ed97", "value": 666616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762488, "uuid": "4bbb4a4d-dffa-4f1c-ae67-011c72ed3ed6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762488, "uuid": "d26863f6-cece-4f48-8f0f-9f68357a3be1", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf186b8-7ceb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748545, "uuid": "2c058c6e-2f6a-4211-85cc-2b67534b0c20", "comment": "Malware payload (Mirai)", "value": "b11924ccb824523d45e25e65b6d133b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748545, "uuid": "16dd0ccd-8639-4833-b598-4e0e7646bd84", "comment": "Malware payload (Mirai)", "value": "706677a6f92cdb5390ba7a2812b2de906fe6db4a39698266a18eff39ee7b9191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748545, "uuid": "7200ecde-a0be-4f29-ae4a-09fefcbf3908", "comment": "Malware payload (Mirai)", "value": "316653bb5f46459d8a81cb1847eb7fc89265c2e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748545, "uuid": "f663e21a-2f23-4ef6-adce-de7ecad22125", "comment": "Malware payload (Mirai)", "value": "bd909366dcbfafbe48824d2d4f836b128f0080608e3056d0f2465b9096f3b2ef4189bc5a00a361f80aab041bdd356e92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748545, "uuid": "2973373b-5110-4258-8060-937f0a887adc", "value": "T1FA9339C8BC90A626C6C1167BFF5F018D33565BE8D2EB32079D294FA0778A95B0E37641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748545, "uuid": "3d7ae535-b4c7-4e35-b3a6-729f129bda05", "value": "1536:hjL+/nwkHyyAzOMXZIV2zrw+i3HE+o8t450NI8g2tFvrWVkkf0OwV+:hjL+/nwkHyyAyMCV2nw+sHho84+NCi1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748545, "uuid": "367b99f8-cc22-4a9b-a51f-f4c80857eee3", "value": 91264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748545, "uuid": "486f0500-243e-495a-a50d-ffdf68d52327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748545, "uuid": "544a17a2-256e-4636-8579-24afcecf31e1", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74fc4d5-7cce-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1783736377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783736377, "uuid": "378f1cbf-ad0e-4ef4-b261-9e2a3ff75e65", "comment": "Malware payload (Joker)", "value": "c64b6998cc1b9d810f06b3f75651a866", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783736377, "uuid": "b90b17ff-caf8-4e02-98d4-74ec79ef5866", "comment": "Malware payload (Joker)", "value": "718efee62a3e13cfe598008f7df9cbab9c738dafb2457f93e1ed00bd1a407c97", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783736377, "uuid": "15d7e043-8405-4bdc-bf93-048862c360d1", "comment": "Malware payload (Joker)", "value": "c3b49b2e51deff34945e85c844d1bf9dc0eb78f1", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783736377, "uuid": "df2af854-3aea-4190-8b5e-c9cbd33744f9", "comment": "Malware payload (Joker)", "value": "b28c83c394153e1331322ceea4011797c79b6450701b0459cbe417ed2c665f949ecd83beb9b2e73a38f838a94c5c55d8", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783736377, "uuid": "647537ef-75ab-4c4d-86a0-ed9208f877ce", "value": "T17797CF5EB74CA82BDDC670BD8C1A0691B17A7C042611D09B2C17B30EEDB77E60F697A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783736377, "uuid": "2c203b28-0e52-45a6-8f06-40ff7172e21b", "value": "393216:Z9PW3SLIuTZlSxlES3C+E1vDWFVVhu/Jf3XP06eT0xOQjw7OXgL2Pn7X0Y3SKCT:fPZ/TZIXJCLZOkfX+0fjpK2Pz0Y31CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783736377, "uuid": "073ff1d3-7ecd-42c8-96f3-66cb75c228af", "value": 40456654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783736377, "uuid": "3a8c1322-e7cb-41be-bbaf-c2371e3ef255", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783736377, "uuid": "d447b8ae-d8a8-4764-ac56-0c577313d408", "value": "Plus+PDF+Scanner_1.0.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a49fa8-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783766978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766978, "uuid": "4b58abc0-f2c8-4617-974f-ada13fded905", "comment": "Malware payload (Gafgyt)", "value": "cb01f4ec76967c117d54302d3c7bcd65", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766978, "uuid": "13bc9869-d36b-4d90-b1f4-a0f207eea9ac", "comment": "Malware payload (Gafgyt)", "value": "71919bff312678190e1f4b525475553603ce822a6aa7a7e5a5576e2c9c45b42b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766978, "uuid": "2c0140da-c66c-4990-a180-dac9c8f1f3d2", "comment": "Malware payload (Gafgyt)", "value": "c261bf272d8e8b6584d5121d9f9244478e9dbadb", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766978, "uuid": "8342503d-a29b-4e3e-8148-c389ad1db0c4", "comment": "Malware payload (Gafgyt)", "value": "65668f9cc70b526203719be9b8c5c9eb107992eab6a6685d54dc2a0b31dbe5f87119e5f04f654de03cc2b718afe98eca", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766978, "uuid": "712bbed4-74a9-4ada-9857-a94e73e80ff4", "value": "T1BF934C88ED1BE5F4D815BE730977A73A4B31D4720236FB41FB622771AC127046A07AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766978, "uuid": "93d88cfa-9fa0-4801-ab80-dd1e58a9e740", "value": "1536:5jPcQeelCtY0HOqyrhCdJFnL3oZ8VNLL14dWcTwAMCCy//yiRS9uht9yS:x8ekvHy9C3FnLoZ8VN1PcEKh/+uF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766978, "uuid": "d4d90bf6-48d1-4590-ae3f-c813ae8e7ca5", "value": 95440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766978, "uuid": "c01aca90-c8fc-4b32-8ef5-b89246d1b1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766978, "uuid": "8884ae90-26e7-46ff-a000-bfc479292e2a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c9ead0-7cd3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783738328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783738328, "uuid": "9b2307cc-3e20-4b3b-b8a7-af95e0f0246f", "comment": "Malware payload (Efimer)", "value": "77b9c6d7b2b77e01fdde901f15591951", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783738328, "uuid": "850e19d4-b749-4f80-9067-dbcd57d50021", "comment": "Malware payload (Efimer)", "value": "71f020cf04e4105ab29e14afd46d07c7723d182c8b1ca5cb4d57c54833a83a18", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783738328, "uuid": "49765b81-9b80-4be9-b5ba-188840dfbcc5", "comment": "Malware payload (Efimer)", "value": "678763f0b4da8c252856f4e21a1b872e1e92fbee", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783738328, "uuid": "a39b48b7-2eb1-45d8-bcf3-91066abaec8d", "comment": "Malware payload (Efimer)", "value": "915afb001aed1d51534e4831f7a3d032ddd0b21d0f4f6a3c1c85f1957c992bde3718b2d24b0178e6f1d7b1724dac609a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783738328, "uuid": "ba678bb1-5cc4-4c0d-9bce-5b374effa3aa", "value": "T120E6335CAAD121FEF9F3007D59A141E1E094B8769B70C9AF2390D3E16E5B2D20E3971B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783738328, "uuid": "f5190d45-2b97-4edc-b72b-aa4189d3c475", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783738328, "uuid": "068a49d4-36be-4894-8ef3-ac8f6ab9b83b", "value": "393216:M9jzEcrNDI3jvNjdQhRSmXMCHWUjXKcuI3/PGTAI:MREcrNU3bN5eRSmXMb8XnH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783738328, "uuid": "223e9663-d867-498a-889a-0265c9039d95", "value": 14328939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783738328, "uuid": "7219c794-4943-4601-88e8-e15d16334ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783738328, "uuid": "974ab1f7-2791-4cb0-b963-f1920ae0bd06", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29526f99-7d7b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783810335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783810335, "uuid": "4873a13d-525b-4587-be28-f138fd86618a", "comment": "Malware payload", "value": "47639143ecb3cb35697d04ca098110cc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783810335, "uuid": "58d3ee90-7303-4243-a8fa-f6cc2186d8e6", "comment": "Malware payload", "value": "7279052dbfd3f10ce49890a529d3595b052507cca7df6438e0e6ad8ec7bd8239", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783810335, "uuid": "a62d9ba2-4301-42ff-b5be-fb993f4c3111", "comment": "Malware payload", "value": "2983defb1af6bf39a029556ce0e3f1c634b57011", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783810335, "uuid": "ff81868d-5b95-466f-a35f-5f2f41d5450c", "comment": "Malware payload", "value": "82a7f624480fc1ff6391747a59993b529f2a063fa7a55e2565d461f5b95b17294e61a892f6aaee164c3fa433c919dbbe", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783810335, "uuid": "519a8fc4-e8e7-47c1-9e7b-ced325dab709", "value": "T112E63304A9E041B9E9A3013DDDF12655E3B4B87107B3C5CB4B6C53A66C7B2F18D3AA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783810335, "uuid": "b7386057-4ec3-4cab-8433-cde9b3a1fc6f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783810335, "uuid": "29ac6cd9-a8d4-47b3-ba19-b8f113de0151", "value": "393216:9gvUbVywBmDC/1BpN1KAXMCHWUjXzcuI3/PGTAI:9gW7B6MpNcAXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783810335, "uuid": "c3e224cc-bbbf-4ac7-a47f-a1bd1258e47f", "value": 14304779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783810335, "uuid": "edba5df3-ec4c-4d93-9e27-48f9c80ce665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783810335, "uuid": "3469e60a-11cd-4b43-8e9e-6adebeeed781", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb70494-7d1b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1783769409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769409, "uuid": "8871134d-9645-406c-bb23-7886f06d5d1d", "comment": "Malware payload (RedLineStealer)", "value": "ae6c4adaf1a49825d656e1523e0e45a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769409, "uuid": "2780c4a7-292f-411f-bd8c-3ecd892e2c85", "comment": "Malware payload (RedLineStealer)", "value": "72e3fb64a103033837ee52ff73f5c00b2a8536b363431cd1308e7ce00f26908a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769409, "uuid": "73b1efa8-d5a4-4fbb-b108-f0204050f9e8", "comment": "Malware payload (RedLineStealer)", "value": "dabbc951f9ef0aa7bbb6870a096bea408d064285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769409, "uuid": "cea7516a-e483-4969-a4aa-440b7a2e5e86", "comment": "Malware payload (RedLineStealer)", "value": "f0ab86bedad7f3cd4df66ce6f3c3b722b2c29aa5484e45dc213f41fb0fed6490edabdd91f1a35140824ab7da3f52c9c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769409, "uuid": "690789b7-e06b-497a-a3cc-2494c0235206", "value": "T19445CF987571F48EC4528AF349E0ED3069A06C699A1E8207B5F73FAFB93D48799043F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769409, "uuid": "dc051082-7397-4305-9961-1b517cf220cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769409, "uuid": "7a16a126-639a-4eed-8036-bfe9dc5a62a5", "value": "12288:VrFWpj+PHyOd8eUBgfkZ7mLcNj8F9Xs+a815dwZH7A0UQzTtbe8Xd48pr50A:V8pj+PSOd8nWLT5a81wJzU8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783769409, "uuid": "0ba93b7d-afad-4a5b-b30d-9001e0f306a4", "value": 1263104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783769409, "uuid": "88d0cc87-855b-4a7c-be1c-e22e112a5b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769409, "uuid": "bb1c5051-7d91-4c7e-a2a6-8f8a55be64c7", "value": "AE6C4ADAF1A49825D656E1523E0E45A4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f154e50-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749759, "uuid": "5e9e56d6-5022-4a49-88d9-e10d14144f89", "comment": "Malware payload (Mirai)", "value": "71545a212e7dee3b41c658ffb1a4b616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749759, "uuid": "b09c66af-3dfb-48bd-8965-cc7019c1c3cb", "comment": "Malware payload (Mirai)", "value": "74c8304588122ce77715a39c8988e1586d17613091334c6815573ae136b19db3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749759, "uuid": "787c3db1-e669-4bc4-ad48-77e4171e6c42", "comment": "Malware payload (Mirai)", "value": "a98d06d76d749125d5770484e9f3755def849dec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749759, "uuid": "41756b4d-1962-49da-9a22-7677086f990f", "comment": "Malware payload (Mirai)", "value": "ef3fbd5b495280b8edf445621da27712a7a500c4ca81e5d6d951a4216822ed9144074ad54b13f12d7e9298339ec04901", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749759, "uuid": "4d2b2140-a984-4562-8ae8-3748f38f76ce", "value": "T1DBE2E0A145E9C2B2DF314038DD65CA839AE6516890E5B5FA309062CCFFDF74E4C65B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749759, "uuid": "f6be3900-4b52-4685-a2fc-ce06418a2ebe", "value": "768:+Z+ei4dEccLB47AEFV/x6h8FbAOTcRKbUwkVuGs3UozsP:+7i4aeDk0bVXIwrzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749759, "uuid": "d037664e-3256-4adf-84ff-9f4576b8a8c4", "value": 32892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749759, "uuid": "35f2d803-9b62-43cb-bf75-215ab6869a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749759, "uuid": "df8836c3-48d9-4f1a-b478-157c8b480e0d", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ccfa55-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783765549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765549, "uuid": "06a1b4ea-aa37-439a-9c82-d34a388feede", "comment": "Malware payload", "value": "4f978c0f857879dc5fa8b0d0e2386a23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765549, "uuid": "db4fbe91-4c1f-4d36-b75d-f344fa42d531", "comment": "Malware payload", "value": "769d295254984b910120e073bc7cdafa15a1c1310d513a1c2924c7a21d332db3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765549, "uuid": "38fdcd4a-d7f4-4185-af64-dfb7c192f796", "comment": "Malware payload", "value": "dbd8ab1d0d6953721e915ac3cc39ca0b3078efe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765549, "uuid": "d380e33f-9aa3-403a-8fbf-3a403bff1ba4", "comment": "Malware payload", "value": "d64291805b6cb26758f82ece99080424a13f79e2848c7ae23f57f800846a71a26d7391207bca3322a7b15d870823eeb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765549, "uuid": "4056da24-98af-48d3-92fa-c97079c75efd", "value": "T13C867C73905224D8E1ADC974D5141652BDB83C8B573863CBBAC476F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765549, "uuid": "f73241f8-dc1a-4302-b7cd-d8cc721ffe8f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQD:cqYUQuVDt0TZEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765549, "uuid": "496f7e33-cad5-4f3b-b1ac-5d62f1c8bbc5", "value": 8585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765549, "uuid": "347e1381-c86f-41ee-8bd8-b493c504d0aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765549, "uuid": "536ca3ee-dd31-4e3c-bfa0-240c2cbd26e8", "value": "769d295254984b910120e073bc7cdafa15a1c1310d513a1c2924c7a21d332db3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b6e6c3-7d0b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783762487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762487, "uuid": "b3c2e535-4267-45c4-ad8d-ebdd90bc52e9", "comment": "Malware payload (Mirai)", "value": "6151c34eaf583c5f0e403f912ea4ecdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762487, "uuid": "3501af7c-db01-4662-a471-6359496f3676", "comment": "Malware payload (Mirai)", "value": "7734153a68504d597860a20c80ac426d98b43d4412d23f05d9837c2bfec50bf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762487, "uuid": "86a09aaf-4883-4d3e-92d9-f6937a6ac1b8", "comment": "Malware payload (Mirai)", "value": "0f4fd6fe48058db67212165fbaee2779187f7257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762487, "uuid": "65179349-57ab-415e-ba6a-652499b4d196", "comment": "Malware payload (Mirai)", "value": "f7bedf7d52feddc201f7f256a6bfc0fe789bd41679e5a57396f21bde7596b398a8bd5b675ad0c7ce0c8192ea65a492ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762487, "uuid": "bb575f9e-414f-4fe5-b318-8397b97663df", "value": "T1DFB43951FC419B96C6D12ABFFF5D828C771317BCE2EE71129D1A4B2063CB95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762487, "uuid": "be30acb5-7406-4513-b78e-bfeac813b115", "value": "12288:eRz47zKLcJgu22aPaaMQ+eDss6Y9vnQEnYeohe/+bc4DZ2I4e:gz47zD2Xws5jiz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762487, "uuid": "0c9bc34d-319d-46ff-9278-54c0465797fe", "value": 504896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762487, "uuid": "05e729cb-890c-4a12-bcc2-ef86c9822afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762487, "uuid": "b1cb5fb4-ccbb-4d39-a6e2-ab7453d47864", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664442fe-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753314, "uuid": "6fa586de-94c2-4f36-9dad-8247c974c8d8", "comment": "Malware payload (AgentTesla)", "value": "3ac25b3aece6faeb0263b1464503d8b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753314, "uuid": "c8a2b1ba-9a1d-49c9-bb9e-43d866af1620", "comment": "Malware payload (AgentTesla)", "value": "778821763e3ae48c9c2c95fb24f42ca7d09916ebc2d5f30ee45f0d1bac0cdac1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753314, "uuid": "f15e6ecc-672d-40f0-b1f2-3c16b9f79b11", "comment": "Malware payload (AgentTesla)", "value": "27e90b6dc1c2419a5f3ddb12120352008a535a7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753314, "uuid": "eb767131-58b4-41e9-91b8-fa5296cb24a6", "comment": "Malware payload (AgentTesla)", "value": "38c6ba21068fd60e342a2d961d0b0916830a130f3c85554cb6bae29bea6327cbc696df3d3b6369a312c33b73e324bc09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753314, "uuid": "bb8b6083-01c3-42c7-99c8-cdc937366b24", "value": "T1F4A50A070B2CA0D4791D540F781B6F18CD739DCD62B2FAAC27588393E2FE5259296B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753314, "uuid": "fcd67fd7-47ac-494f-8dd2-22030302bb78", "value": "96:knr4hvTofafEbRoOuLzqhkookF03Ok5JvruvfIoP46WwTpI+4BGbwaOsroxzX9nA:kr7OzgMDSQbtB2FOsKYYyTHZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753314, "uuid": "ade8f5f7-af48-486a-9415-7310c4be4384", "value": 2263788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753314, "uuid": "f5e7c32e-8818-4e8a-a358-9331d416d035", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753314, "uuid": "7b8a3b72-67a2-43f1-b77e-e2868e3efe36", "value": "confirmaci\u00f3n de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2430ddca-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749767, "uuid": "f47781f3-6387-4ee3-9006-35f5b9676c87", "comment": "Malware payload (Mirai)", "value": "e44140b2cd901df6a7ca55235b5a4e74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749767, "uuid": "4af347ee-b2c8-46a8-b119-f554d7ff2cbb", "comment": "Malware payload (Mirai)", "value": "77ed8c7518a32663fb766f729075dcdddc355c8d6ebe381092df51bb891e0cfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749767, "uuid": "4291c08b-7c2f-4c4e-be74-5ee745c6f1ae", "comment": "Malware payload (Mirai)", "value": "21fe2d513674f769f0138ab9c5a78eebd99de0d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749767, "uuid": "4c055c93-d431-44c8-9a43-1c9bf014d29c", "comment": "Malware payload (Mirai)", "value": "832e4e76157440ec4123b7619671b23a449fe4125a5fcbb8b41bd65fca40a0a484bbc1a047e087b1f178d7acda3cf8e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749767, "uuid": "863d326b-6527-4bba-8f7a-e4f576eaf29a", "value": "T14723F188A1B8C61BF298927A2C2FB51D58A0903F7C3495F3CED8C02ED61F565872D362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749767, "uuid": "368472e8-c74b-4361-b4eb-5438d4ccd974", "value": "768:i5KTOSNokDUBFr4/bJ1v6rINm9ZR8XE8+SOby1gQVGSEXqkFYm74fnbcuyD7UHQv:i5KTOGopvr0zCYm18vOblY5vkOm7Yno9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749767, "uuid": "08bfd113-3039-4ff8-bcc4-ae08ee328a1f", "value": 47000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749767, "uuid": "4cb2daff-78f7-4e10-ba70-d0d891588d24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749767, "uuid": "b2e3d679-cd60-4fd8-8971-76dfe33e59c0", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df848e2-7d42-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783786049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786049, "uuid": "38843b5e-63c7-429b-ad91-519a2c98da2a", "comment": "Malware payload (Mirai)", "value": "5545694da96c5c5c872929dfacb12ff2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786049, "uuid": "9f7fcfdf-4765-4992-a386-1903255a81c4", "comment": "Malware payload (Mirai)", "value": "7962d4d40d4c1f13e88e5fef4b5c46a80538a898b559e34c8661d52dbe7b7549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786049, "uuid": "254e49a8-b2f4-4b17-95df-83764255b496", "comment": "Malware payload (Mirai)", "value": "5c551a4620c36d21a0946ff572271e5ba6e277a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786049, "uuid": "4cfeb89c-7ad6-4401-a73e-93d3deab568a", "comment": "Malware payload (Mirai)", "value": "1decaf65b2675cbd6b7cdc814a04b3a3d4d2f340d4336dfe2178b94f938fc0ff3f0dfd0f9527dd148772dbc099f0f759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786049, "uuid": "2357f9ae-ace8-4fcd-a5e8-209e7998958a", "value": "T1381449C3F900DDBEF80BE73784134915B130A7A214925B37B257797BAD3A09A0577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786049, "uuid": "ac1ea0e9-8514-4fe9-a04f-e254ebaaa18c", "value": "3072:6SwM4lgVTtorfbjt7NkJoaTMmGeyq/PSPGNiVPjbi/Le8zmy6hRgOy:RwM4l6TtoPraTMTepOGNZLe/y67y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783786049, "uuid": "0575676e-a704-4583-a30e-119aef085caa", "value": 190688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783786049, "uuid": "9197bd39-2ef6-4ed5-be65-820832b820aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786049, "uuid": "3cfd1412-ae70-4b32-82d9-63438fb70d4a", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd46c896-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753567, "uuid": "cdf26ec9-4bbc-4a82-b56f-9dd0bab0db5a", "comment": "Malware payload (XWorm)", "value": "0e197e5952316897d03a9b56f8a192d4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753567, "uuid": "c81dc025-66ed-44ac-bdc3-4d52e4b8e9ef", "comment": "Malware payload (XWorm)", "value": "7a0a306f43306dacf6e870c719140df23cf795585297ec04a1308f8f8736da1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753567, "uuid": "f1c1d6a0-c2d1-4ffd-bd50-22454e158309", "comment": "Malware payload (XWorm)", "value": "9fe4fe2feccfee9128bc9605fbed1a5179fce91f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753567, "uuid": "e040efe2-b4a2-4dda-815e-cb5f92db192e", "comment": "Malware payload (XWorm)", "value": "e110a6252241b777678f0b8ae594d2f70513ad28a6cef29060ef3838651e3faf98f66b3626719d54914277f8fb72b60a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753567, "uuid": "a2685a9c-3a93-4f95-a145-c4e35fc8930c", "value": "T1D5957B1A0FF498D98B1ED32A9E6B0C7192158173473BFB6D27EDB3942910D12B2E4D63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753567, "uuid": "19ea45ec-523e-42dd-8ad2-ce5dccb3db41", "value": "96:0BSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSc:7IkSFWwC8F8hgsVqkrarH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753567, "uuid": "cb1164c6-b660-4e11-b633-69f5bd9e40a2", "value": 2034126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753567, "uuid": "bbfaa6db-0b30-4dc2-ae6a-94f108088acc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753567, "uuid": "10fe58eb-ebbe-496b-b9a1-9a4bc712a67e", "value": "Comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8175f74-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765504, "uuid": "f1f89fcd-1cc5-4fa4-be8e-41486c5077b3", "comment": "Malware payload (Mirai)", "value": "c0b9aad5fd0812d7e82f285d701ce1b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765504, "uuid": "858f2b88-3f56-47e0-9964-4a3d5e1b4ee8", "comment": "Malware payload (Mirai)", "value": "7a1b66be9f1e0929e7c9fa92030363e0d02fdab0b9d2113861b0ea65022a40be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765504, "uuid": "7648f777-2fc7-441f-b415-86c4a4af5cdb", "comment": "Malware payload (Mirai)", "value": "68cb772c225307995ab9307ab1a6819c85030a1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765504, "uuid": "1f180b8e-1490-489f-9bb2-7fa0f3bb2a7d", "comment": "Malware payload (Mirai)", "value": "e2ce87e99d2e1e0f4092136dac70b4838343cbe9f464ac1941c5d73fa88491360e3537aeb2a3def3adba4a14a506864a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765504, "uuid": "ab07b99a-c272-4a11-8eff-641f0b394638", "value": "T10F931945BCA1CA29CAC023BBBB3E629D331293E8C3EB3102AD68177C56CA55D5F37545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765504, "uuid": "b196d9ac-0d72-4378-9301-9b944177e927", "value": "1536:+85nXw0z5+EoDso23w+SktaMj5wbyA5tdBOR7dK0GsuDyyG4C13XA+TbEfnj5vmI:rhzQEGW5JjS5xZu1dbQjleme26swFMms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765504, "uuid": "894d82b9-7c41-44c0-9568-b090268b753d", "value": 95784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765504, "uuid": "3efe8597-9b2f-45b0-82af-f33d9c7aad87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765504, "uuid": "af431cdc-496b-4d9d-ac08-bd5775c66f7a", "value": "Ares.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214bea36-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749762, "uuid": "b6b0cb27-57cd-43f5-9a9f-fae37ba15c88", "comment": "Malware payload (Mirai)", "value": "f118f3fa81cba559bc43e5453689f7bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749762, "uuid": "e513da62-25c2-44ac-aa1d-4e07d42a8c9b", "comment": "Malware payload (Mirai)", "value": "7a4a3a129b726b531941b41d734521e8905d57a57a7e8a0a7e5dff41ed22f6ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749762, "uuid": "2c1a95e1-e4c9-44c8-9e40-134de18b7bd5", "comment": "Malware payload (Mirai)", "value": "ca28ecb5c2309a281757aba43903dd76b497747f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749762, "uuid": "993c2832-92a6-467b-893d-f807116bddce", "comment": "Malware payload (Mirai)", "value": "a8681de3f9371650152744b4325042e98ee4c1c5dfef1fa3b0a8b7f1cd211e215ddefaf93f2af263bbcedec95592d93f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749762, "uuid": "e03af29a-0613-47fa-80f5-4e206a7e016a", "value": "T1D7E3BE97F6472492C96302F407CB6FCD6E6322825F9B99E3AD2F743B59760DB0402B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749762, "uuid": "f1b2d2e8-8178-48f6-8153-6d819365cea7", "value": "3072:7y9AU00EpURDpQB89AkyU/2YONngK7Eq:7iJ4kTu7Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749762, "uuid": "f78c1de0-e9d2-47e7-8934-7d6d7f0292a5", "value": 148932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749762, "uuid": "5634769c-6494-487f-9f21-a10e7eafa301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749762, "uuid": "99bd8b96-5c5c-4843-b112-0b89f83d6572", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffd85ef-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783288, "uuid": "50f0c614-0ebd-443e-91c8-19932ff3c1e7", "comment": "Malware payload (Mirai)", "value": "b89684dea92e9b58efe8598ba3018718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783288, "uuid": "3df6bffb-abea-4756-b524-2adb5e36ce5b", "comment": "Malware payload (Mirai)", "value": "7a4ac2fd1ba4c98850399b64563a87aaafc8499a8d52beb2e957a59e332e40a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783288, "uuid": "47f3e5c4-574d-4bd5-a534-7ebfead08719", "comment": "Malware payload (Mirai)", "value": "b7d26fe0fbd58eedb14e7a3c7ae1e0d4bf654d4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783288, "uuid": "62f69c05-03cb-483f-bf0f-47b7e1630cc0", "comment": "Malware payload (Mirai)", "value": "0b19b2777bfa6dd5992461e7e9649017bb4556e675d9be1c4aecf76219c9c7ffeef8a9f57490d07e023ddd00bbd46a9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783288, "uuid": "d60f5730-382c-4fe1-ab46-7f06564a1332", "value": "T13EB2F1686CEA6DB1C3B06832A67DC543B7321279D1F92C79345001BA7DD4409B1FF8E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783288, "uuid": "e26bbec6-11b8-4e5e-bab3-fca9ca25d615", "value": "384:eKN2h9bMzPJIvYhuAvWqbVqMgAJ5iGXAhNUF8Yhhl0yhymdGUop5hS7zY:1N2h9SJIv6uAvWK4Ni80kys3UozOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783288, "uuid": "ea419000-b7c5-45e3-9e4b-52f54236adfb", "value": 24948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783288, "uuid": "c173ed71-b9f2-4f84-b957-7d4a2633d425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783288, "uuid": "b12268cf-740b-4279-bde8-51aa38d98e0e", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34862138-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783766974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766974, "uuid": "d7c3a17b-41ae-4426-bd32-edf5bfd46a33", "comment": "Malware payload (Gafgyt)", "value": "c7fa011b194ed96188724806f6e6853b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766974, "uuid": "7d9b1dad-8fa4-45b9-ba7b-a99d49dcc65f", "comment": "Malware payload (Gafgyt)", "value": "7a886493d827034a5eaf32a3dc478c73d49e95a0612eeea01aa08aafe2f82068", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766974, "uuid": "8d31ad77-2b57-42b2-958f-045d05a0b3e6", "comment": "Malware payload (Gafgyt)", "value": "a9b82d73132269c2d238b153a6091d3f4a5a2fcc", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766974, "uuid": "618dc7c1-950e-4aeb-9cd4-67e635bd62ca", "comment": "Malware payload (Gafgyt)", "value": "c761f109eee4b2425752d08ad4a56b7bce9ae029a2e131246eecfc1e687723d45aba86fcadeb75553cb87b351e63e08b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766974, "uuid": "ddf6fc7b-2d84-426f-93c2-a59696210661", "value": "T1A7E3D70E2E794F2DF33A8339D7F749219B58738616D1C649C27CFA121E2024D651FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766974, "uuid": "a97614b7-e991-4d48-8507-8d7d04f63bab", "value": "3072:uNRr+rfFs73K2wqAdhibJQabp5SQAsRspUe1I2k0aFacZGBfoXH9trBVf2xduNT2:0Rr+rf/yxlau+jw1TnkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766974, "uuid": "515b38b3-586f-48b9-a6de-a64eb451f98a", "value": 144288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766974, "uuid": "50a6d3f3-5bd0-41c5-8f22-a382284c850f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766974, "uuid": "0d7460b1-6c6e-48dc-9d5d-9d834cccb83c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd092a7-7d34-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783780170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783780170, "uuid": "8b40fbe4-bb2c-4268-b820-24444c029c38", "comment": "Malware payload (Mirai)", "value": "f60973dea2cfda6075caaa06eea79cc3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783780170, "uuid": "6fefffbb-bb9d-449f-8b8d-abbf3466151f", "comment": "Malware payload (Mirai)", "value": "7a92770f1c85dd6312f43a10e29367fed586e74438e4f89c4682c3dc63675657", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783780170, "uuid": "53960bd7-b4a7-47fe-8edb-a5b686265c3a", "comment": "Malware payload (Mirai)", "value": "ee84887ade88cd22e23f892978a5e57bacd196a5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783780170, "uuid": "e1c77d99-f402-48b6-ac26-e36b5ae1d003", "comment": "Malware payload (Mirai)", "value": "3451ab7fcc80922d45b277f62fdbd394c9f258498fae8ecf580fdd63bd75a90a5b86d692e29cb9661887cf352e3de815", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783780170, "uuid": "b5e9310f-6b1f-464d-8b2e-fb763563dc39", "value": "T1BD832AD9B96C63CADAE001FAD6C9F5372B6BCB2185EC432CE00447B05C99778AD195EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783780170, "uuid": "763c793e-8f11-4596-b2aa-e555eac7ff0a", "value": "768:lORWfT2DSteMynpyOIrA0LjQRdsHy6EmAhm0ojXWFfadKOQVhRytkjVEGWo6:x5xynpyLJLkRdB6EmAhaXWFiZsVVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783780170, "uuid": "66115739-15b5-4428-8d2c-8494a2ebd4ef", "value": 81632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783780170, "uuid": "72c42ce6-c8e3-4542-8444-cf897f97fedc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783780170, "uuid": "397eee3f-c02d-4620-a8d4-09c56708e3b4", "value": "bot.csky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998af450-7d1b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783769291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769291, "uuid": "1ee0b65b-9828-48bc-b0d2-296ca2898c2d", "comment": "Malware payload (Mirai)", "value": "49b43eb336165cf0c8f619efd73ab6ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769291, "uuid": "9714f736-1602-4cfc-8510-5a031e8befb1", "comment": "Malware payload (Mirai)", "value": "7adc483cfc90af9b7ab531152dddcca0d9d7e8b7927f6aae14cc5052613f2e8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769291, "uuid": "b085f463-ed99-4c45-851e-8312cc0667b8", "comment": "Malware payload (Mirai)", "value": "ce5a52fde51d4179a6ce32082ef0ad891dc73c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769291, "uuid": "decb46b0-c486-47b7-856d-c3712c9a4072", "comment": "Malware payload (Mirai)", "value": "87e80594cc0987db1ffe04a558d160c2c7567be74441d09ae5f33509735cd16eedff8ae994559dfba4eb272425e27e73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769291, "uuid": "dec7deb4-cfdd-4114-8a33-fbf61ae7a22f", "value": "T1ED457C47B2B364FDC053C834839BD6A2A931B46542226E7F75C4CB312E67E642B1DB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769291, "uuid": "e779fc8b-9bf0-4157-ab5f-d92dd3043b9d", "value": "24576:SXWKi4kzUasqRUmGWbLSCNZzUkb0ayCK1mTeXqvL/f:SX9i4kzUNNCNWY0ayv1VXqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783769291, "uuid": "c8a61044-14b6-4b09-a939-9c3015ba62f0", "value": 1266496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783769291, "uuid": "4f09d6f9-d733-4b60-9995-2dfadb621c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769291, "uuid": "1398f1e1-8a27-4d78-8756-0c9a2388cd7d", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7e78f5-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783753350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753350, "uuid": "8b7de417-4664-4155-ad11-66f8321292a5", "comment": "Malware payload (ConnectWise)", "value": "42ba589531d66eddfd0647b8b8e00df6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753350, "uuid": "cbb4e42d-ff25-40ac-b488-16c9472decd9", "comment": "Malware payload (ConnectWise)", "value": "7aea988f5720a8f8f9811cb604fffb0a969cdf70cc1b97e0312b5c6d27cb9527", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753350, "uuid": "1cb151e3-01e8-47e5-89ac-ed9bc1232c69", "comment": "Malware payload (ConnectWise)", "value": "2265cdfdeccf2b4c8be448f24ab32bf65330afc0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753350, "uuid": "b69af9e5-eefb-432b-9662-483c8d39ee8b", "comment": "Malware payload (ConnectWise)", "value": "cb1c20c8842bac02618246beddd270d8f9400d3558c683785e96a29a693b25b8e08fc46e6ea4c0f6879c0c60cedf26a8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753350, "uuid": "bf961505-4fdf-4d70-b610-39819f721fea", "value": "T13351321BED0BC8A159B30A12C463DC0AEFE52713243254A4BA8D84B95F756ED8AF14CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753350, "uuid": "c75304ca-9e42-4346-809c-284b93589da3", "value": "48:DT4bSiboAwF5i3LCrj7VhahCEuSQoq23s5pACh/lzAQsCtUeSqxA24V4gCy2:YbSiQF5HnRgCEuH2c5pAC0CtUeSqz24x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753350, "uuid": "8b040ad7-c7e4-4f50-bbb0-968aef8d744e", "value": 2973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753350, "uuid": "954b73db-6179-4dcd-8e33-fa04620a7ae1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753350, "uuid": "7e93432c-dd57-4104-8894-4d75d1ec1473", "value": "adobe-flash-updater.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e65eb93-7d00-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783757515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783757515, "uuid": "400845a7-1148-4064-99b1-06c149b5a3ea", "comment": "Malware payload (RemusStealer)", "value": "c030c401764cb89ccd1de0a9111a0557", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783757515, "uuid": "a6f7f0d1-6e63-4abc-a36a-5e23e346b991", "comment": "Malware payload (RemusStealer)", "value": "7afb1a1dc8c72d5b4924d499464f5512264ef2021db5c2b8a9d0d9bda288e842", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783757515, "uuid": "2324ca39-4c26-40f0-8ac0-f47a72f55dd8", "comment": "Malware payload (RemusStealer)", "value": "3d389f8ee17b58a78ded2e333ffe3858f3f40a3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783757515, "uuid": "664ab738-3876-4c2a-b2a8-60ef02bf65a0", "comment": "Malware payload (RemusStealer)", "value": "efc5e961fd407cb7c6d8c48ad3de26e9a71b4248f22cdefa11b5fd0d7388e5ca7037e10bc032d01d9a5af21087b6a811", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783757515, "uuid": "72c070ab-af99-4a43-8491-001ec7f54d0c", "value": "T1ABB55A07BDD119EAC4AAA33189B261967B76BC080F3263D72F90B7782E727C05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783757515, "uuid": "d91107a9-3a4f-4312-9408-92849f6585b0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783757515, "uuid": "58249350-8e02-4848-9838-5d160d1e67b1", "value": "24576:TLdhGhANnM4wLs6eXFPC1ggTb4rkBw+H1i/e7KTC1+By3/zhPZ2Bele5IK2J8yvu:TLT6AlM43669C1zkgB1VZ7ECIBWr75i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783757515, "uuid": "fb55f751-1d9f-48d8-a601-c6e7f9103265", "value": 2409832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783757515, "uuid": "02b75ac6-afa5-4a6a-9ab0-8943e20bdde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783757515, "uuid": "2b2f161c-8d48-48be-999a-783f05fa031e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f7b723-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Smoke Loader)", "timestamp": 1783752933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752933, "uuid": "77001083-c66d-4725-88a3-1eae1da8e25a", "comment": "Malware payload (Smoke Loader)", "value": "8c9489251148c399ee747cbb67f75a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752933, "uuid": "cdaa0480-c748-4eba-86cd-076cbc8a7ae3", "comment": "Malware payload (Smoke Loader)", "value": "7b41f5b9d24dc10eec387c8ae7b8ba34695f63a72b5a50816b95af233429664e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752933, "uuid": "a42181d9-3df3-49c5-a4d3-1145b724e42f", "comment": "Malware payload (Smoke Loader)", "value": "7dcf4108e0924cb3f5b309f1c383ac59950f27e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752933, "uuid": "17e52da2-ec1a-457d-b338-4a90b878845d", "comment": "Malware payload (Smoke Loader)", "value": "6b927abbbf36a427090335a3dd8a6e6a023c56bd0170758e39d3edcef97f388c79c032b99af681eee6f16530cfc46171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752933, "uuid": "57ab030e-6e2d-4a45-91a4-202311dd222d", "value": "T1CFC3CF0275C551F3F28324F329ED712F136762759A748FC7EBE4A80CA6553E60A62A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752933, "uuid": "d30354f3-486b-4f13-ab64-b56def3336e0", "value": "798940e7a8ee0b6b77fbeb0d2721efb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752933, "uuid": "14bc8a9d-b292-438a-b1b9-411bfb4bdd30", "value": "3072:16N1BaHCtqUG3yGAB+UfhfBKORvS6gFejG58ltkbr:8v0HOqUGgBFfhZKORq6gM4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752933, "uuid": "f7a5037b-6fab-4546-839f-ad1efc0b405a", "value": 121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752933, "uuid": "d706b734-8172-4004-b2cf-f56d0daf8ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752933, "uuid": "f4aadc78-c297-4cb5-9409-b6e3b2a0ea46", "value": "8c9489251148c399ee747cbb67f75a45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7003b7-7d18-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783768038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783768038, "uuid": "69426f68-d573-4162-9e04-fa5a791701fa", "comment": "Malware payload (ConnectWise)", "value": "99b1a3725e47d243674aca3049bc5798", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783768038, "uuid": "fb5b0eec-f2dd-4123-bcca-e782c2515925", "comment": "Malware payload (ConnectWise)", "value": "7bcb1fa6c770a8646c588c5efc180de5201ca0bd07c982b9e4caccd728908060", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783768038, "uuid": "8586aea1-13e5-416d-bff8-0ba69dc01cc2", "comment": "Malware payload (ConnectWise)", "value": "5f90f16a64760f0218ab1e0a63dd5261df7a5c05", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783768038, "uuid": "d374da4f-9494-47c9-93b0-5cb5ff7233e3", "comment": "Malware payload (ConnectWise)", "value": "690d3cd25612b4384fae514a2c57e9c9b654c093887172683e2253c799b5518f18332f67ca8602e7112851a8a0c376d0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783768038, "uuid": "09fad5d5-7dcf-430e-984c-6fea6a8e85c3", "value": "T1BB46E111B3D695B6D1BF1638D87A52656774BC048312CBBF5394BD392E32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783768038, "uuid": "535d69e3-352d-4d10-83c5-c5f724e89127", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783768038, "uuid": "951f8b30-e96b-4c11-a62d-1fdb47be9406", "value": "98304:0zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:0hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783768038, "uuid": "fe534124-6e97-4d33-ae9d-42e74f682c05", "value": 5721680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783768038, "uuid": "59cae345-8c9e-451f-902e-bbc7b5743ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783768038, "uuid": "5b8d1933-4ce3-47dc-abea-62f5846f97c8", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3fe78d-7d18-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783768033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783768033, "uuid": "b113323a-673c-47ee-a182-cc913ad08425", "comment": "Malware payload (ConnectWise)", "value": "78282642485a9383f82d6cba66e5b915", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783768033, "uuid": "d07ec5b0-4967-4bf6-aa4a-0ea7d24b7653", "comment": "Malware payload (ConnectWise)", "value": "7be056e20a0c00099f5d572a19e7f3c0758f040dac7188bd2d6e5f6fa202142c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783768033, "uuid": "a5ff6cd9-71ba-4dce-854e-4fd9631e6c8f", "comment": "Malware payload (ConnectWise)", "value": "e070c30654c99d676fba91fd5b4735ce25875ca0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783768033, "uuid": "df8fead4-ebea-4a0f-aa78-c064740b89ac", "comment": "Malware payload (ConnectWise)", "value": "b76d2c404ccf25c113b5f226b38ff9a5df69fb47b29d2bbe2497af62ae5d9a5fb0cc09ecdfbd45dcd03061185a28e2cb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783768033, "uuid": "334a8206-f489-49e0-926d-06abd8c50408", "value": "T149646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783768033, "uuid": "511d66b0-3550-43e7-8956-743bdca54017", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783768033, "uuid": "dad9e663-d468-44e9-bbff-b4e3c7a6c082", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783768033, "uuid": "3d179fc9-e3f0-4342-86e9-0239f1cf76b8", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783768033, "uuid": "d8404419-76d4-4a09-981d-6a8f08a2d90d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783768033, "uuid": "aacb1df1-6690-42af-8145-d4ec49edee39", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea09bb8f-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753535, "uuid": "e62a0b98-130e-4ba9-aee8-3765fc3fd93d", "comment": "Malware payload (Formbook)", "value": "921e7cd443a2987089c7453106d21f5a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753535, "uuid": "9d852293-3fe9-4f29-ae91-6c77fc090dbb", "comment": "Malware payload (Formbook)", "value": "7d9512cf29b9d9792a1018f41eaa156902a16e2f20e4da4f1c308501822b39ad", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753535, "uuid": "5518c0f5-d349-4a46-9a03-ea57c6ced184", "comment": "Malware payload (Formbook)", "value": "0b8a2b451dd16aa558c059a138a8cf914b2f3715", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753535, "uuid": "a9e7ec53-79a1-405a-a73f-5178d2d8d2e3", "comment": "Malware payload (Formbook)", "value": "8422e6d9061b60cfc5d129a39062a71f828775f14a3e4fd0aa37dafdce653d75c44d036d1fe4e11b1bd6e2ddd7527e94", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753535, "uuid": "ed613222-78cf-4563-aa61-eadf89b88fa1", "value": "T192A5F1014AC4AFAC8BEA5B2D61BF3159E3E109CB5415A94AF723FC46FFF760499021B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753535, "uuid": "6c9750b5-a80b-421c-af80-6b6d996bfca0", "value": "24576:QDTbMbo/b7kIRo92w1tv03fhjQghbg+LMNSL1RVZW7jY/job2pPBNDDDmJKg:ebMED7G92IJ2yIjoyJ6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753535, "uuid": "8e497ccf-df11-4fec-aeb3-4439f7e26515", "value": 2127266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753535, "uuid": "30851c49-f37e-4361-ba50-8d1fdf5647ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753535, "uuid": "0f43c79a-1791-4617-9c94-2e87684e2d28", "value": "Ugovor 20260942700501.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a174650-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766957, "uuid": "08f31163-aa19-4ea6-bd66-2b6ef1a8a094", "comment": "Malware payload (Mirai)", "value": "8f6f3bd2c1ceabf725f2b76f5268f68b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766957, "uuid": "1482eb56-0ffe-4d23-b7fa-974ce9b5fc15", "comment": "Malware payload (Mirai)", "value": "7d996f86b9bb6889ac1327b5311356561a04cacddddfdeb5b1e41c12bbb8c0fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766957, "uuid": "b0211793-c27a-422a-945d-5c5b40447a41", "comment": "Malware payload (Mirai)", "value": "d010b4da73535973b37f0bef94b25824a7e62725", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766957, "uuid": "ec310f8e-9603-4b9a-a5b4-67fd50cf50b0", "comment": "Malware payload (Mirai)", "value": "2941571b684ab5a296f6c97812b553101bc95f8e4ff657ca466e31983b2409f8404f28c3b8a9f9f758d601e376ff9ed8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766957, "uuid": "ff76bb38-5119-402b-86d5-8c5d96a72b19", "value": "T1E2E3175AF8829F21D5C612BEFE4E518D332327A8E3EE7112DD245B2437CA95B0E7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766957, "uuid": "dbf694be-f26d-4c73-a4ad-87fbd618f487", "value": "3072:ODqR8C4GCWLFfNAlI1F42U3P+QyQnXKRf1a352OkN21DTXpuot7Rxnb7o:CqR8/DwFfNX1M3GQy2Xwda352OkN2NTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766957, "uuid": "587a4489-dd4a-4ea0-b4ea-31f9ab7ad7a0", "value": 144956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766957, "uuid": "bb1d10a9-a7db-40de-b227-b0696fd7a3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766957, "uuid": "b73a2b87-a21c-4dec-bce4-9fdd0aa1ae58", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e67120f-7d1c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783769487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769487, "uuid": "5cfaf52a-04d4-4a04-b15e-ff94b9e43ef1", "comment": "Malware payload", "value": "e1f6d99e58f8a2298688a56b105644f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769487, "uuid": "278bb8dd-0ff3-41c3-96c4-df9aea9f1776", "comment": "Malware payload", "value": "7e281f09327afdba60c1024f23abe2b9b19eec8f257e48a4e08b9fbb74a9cf03", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769487, "uuid": "14a5f202-bc99-4ad4-a7b6-1d70b8c3b12f", "comment": "Malware payload", "value": "335494cee8fb7766161f7b1e1c8695f105734c9d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783769487, "uuid": "7d2c01e3-5389-4b7a-9a6a-7e32fcc13282", "comment": "Malware payload", "value": "0a33b0a74f71dc7cd3de3f23df618b9b73049e5ebaeb20ad1ac5b564b7c2ced6f500dd4d509c11ef2a3d80cd83c66eb5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769487, "uuid": "cc48008c-e493-4b60-9f68-7f5325eadd2c", "value": "T1E8336C5516817C24AA99C8361C7E2F0CB9AD43E6324452EEBFCF3CF28C4AA9DD11971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769487, "uuid": "4170060e-2614-43c9-a945-8d090e08eaf0", "value": "768:Y+b9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:Y+scK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783769487, "uuid": "d1de17c7-564d-46fe-b005-606e96d894ce", "value": 50362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783769487, "uuid": "ba3b11f9-53f0-456a-adf0-108646b248e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783769487, "uuid": "ce1c9cbb-9c60-4836-9d6e-514fde616634", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f66957-7d5b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783796820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783796820, "uuid": "68d7310c-79ec-4224-bb56-205dc2d5c690", "comment": "Malware payload (Mirai)", "value": "3a3bc6fc6c8f1b206ca9488387aaf80b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783796820, "uuid": "9eb63b47-fb4a-4895-b8da-f57db093979d", "comment": "Malware payload (Mirai)", "value": "7ef83c3a3c06f079a710e0b62181231ef5961aa9c64e8c8951ba2883c139ee65", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783796820, "uuid": "68d5fa78-99b0-4fb2-9204-c0c7aeecdcbd", "comment": "Malware payload (Mirai)", "value": "edbc6dd028710a78fd5dd6117b016a6ca05e052e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783796820, "uuid": "bb41798b-379a-429c-92b6-124fd4b263e2", "comment": "Malware payload (Mirai)", "value": "f86dddad1461c45fb68188fb18f32aea38f76dbfd3124ec934f6354b9bb41fba3a1d9b7e67fd557831c60cb833552f4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783796820, "uuid": "a34af4d3-b03d-4fe4-adf0-d79552fd7b4e", "value": "T12621F8EC2C992E1A0F22CD40F07261AAE15FEBC872D23B1FED5A757068D85107120BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783796820, "uuid": "de2da85a-0211-477a-86f7-b3306bed2a14", "value": "24:QvQhBh9M0oyCxjeqxUNRxKx6iJx6KdxWrxLFIxje9xUNsxdx6ikx6KwxWOxLF8:QvQhnog9iyc9i5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783796820, "uuid": "5bb1f63d-5c81-4aa1-a587-b7b18bb58c1b", "value": 1307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783796820, "uuid": "4840506f-b592-4d10-a990-aad1b5af0b67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783796820, "uuid": "098b0529-3f1c-4c15-8610-183b4070e9a5", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31863776-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783290, "uuid": "58e6088f-b547-4349-b7ce-01c00cbec3d4", "comment": "Malware payload (Mirai)", "value": "192c95ef41dcc46d7ad1ddff5062a8e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783290, "uuid": "5883ea14-28a4-4ca7-82f8-b8dee237d515", "comment": "Malware payload (Mirai)", "value": "8072b5b0fe6fc53e9adf018ab1ca3efcdc2c78e2ef1e335a318aec736eb017d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783290, "uuid": "d03ad872-202a-4670-9aec-7343aaf04857", "comment": "Malware payload (Mirai)", "value": "076d3500af9d9c89193844bd24b3a6d11d014a15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783290, "uuid": "9e4c5dda-09a9-4590-a59d-fd746cab3ff9", "comment": "Malware payload (Mirai)", "value": "d226c2c728a79d286149f533001c3f2fb0021a473ebf43586aefca03ac417bdafa19fbf9a08e8fe592d07a490d27a4ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783290, "uuid": "f14aa627-c297-4252-a75c-33346deb780e", "value": "T10413E19DF964EFE5C9EC6E7900EE837056B826C6138F4B8827015DD9572588EF4DCA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783290, "uuid": "51030ce3-20a5-432a-82a1-88e175e69e5a", "value": "768:BVic/3dtQkOO0H4lCeVrGh7umSr1LisBr9ZsMrI0s6NIt9Wa:nic/3oO0H4l3GhdI3nUt7tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783290, "uuid": "d1f782ca-df49-47b9-8955-2253360e06f9", "value": 44760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783290, "uuid": "55ac5cfd-831a-4750-af1d-73af4d33eb0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783290, "uuid": "84e3aa78-685d-4c5c-9654-cec94d05bdd8", "value": "titanjr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22359387-7d45-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783787130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787130, "uuid": "d3d9df38-7cc2-49c2-bf67-cf3aa8d3efd0", "comment": "Malware payload", "value": "2cb36f7cc74750427a554c365acf24bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787130, "uuid": "f75affbb-9041-45fe-a884-6d0462cd4c86", "comment": "Malware payload", "value": "80ce991efa532d72569247a123a26587e4c9cac2a6e29bd620d3309f2d13c393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787130, "uuid": "74254839-c957-4e27-a1a1-1cd3a5690293", "comment": "Malware payload", "value": "c046506e0d6f4fb86e03ef2c65535286d4c8206d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783787130, "uuid": "c3a69d0c-31c3-4f02-bbba-1ab42d6d0957", "comment": "Malware payload", "value": "c85588d48efaffc579b5deb11ad6777dbe5d7f1c29124315ce4f781dc9ee94fa6f174cbf9d28672e8ec3e71ccb2c3cc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787130, "uuid": "b5429d7a-98e5-4893-9bc3-bf76bf795de4", "value": "T1B79422CFE713DCAEE468C57164B7D9362B0C5A4B17D141D475783CCA0BA8298A88CFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787130, "uuid": "0c066c7b-2cfa-4f9f-ac74-a31bd5ac1721", "value": "12288:yn7yuKOCUlYCbwJvV2kDiXuC9e1eEZZ4lUs:EzKOBlUJvV2WiXZEZZ4qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783787130, "uuid": "6d44a933-a2db-4ca2-a63a-15cb362fd793", "value": 425428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783787130, "uuid": "13c3790a-0ce4-45d5-9ad1-0d9bfa46a5b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783787130, "uuid": "5d7470e1-162f-4798-aa97-3da3a2211879", "value": "kworkerd-netns", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53016979-7d27-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783774327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783774327, "uuid": "0b28fe27-cf36-4a38-9167-12131932ab38", "comment": "Malware payload", "value": "2a9f3be791f1962b081dec7f9300b701", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783774327, "uuid": "c839d1fe-855b-4418-a942-89e308d7a981", "comment": "Malware payload", "value": "80dfe0aa2e7aedb2698711aa69aff81db372d582a0d7b20827445f4f1daa8c34", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783774327, "uuid": "db4e52b6-f57d-4897-aaab-94e039615f83", "comment": "Malware payload", "value": "5bb693ebbbf992ca7c584619ae6995e329d531a1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783774327, "uuid": "35014294-0bbd-46d6-be97-b13d5cbfe866", "comment": "Malware payload", "value": "c538b4b6dfa13740f0c2ab682d9c0795be14c5187679a7dea930df6d44ebf3e8b94b076aaf8dccd8c969913ea21e0d6f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783774327, "uuid": "651fa378-5797-4c62-ba7e-2ca7c927a990", "value": "T173E63348D6D002AFFA33603DFF5189E9E19578595B36C6C74BA883B16E5B1A00C3CB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783774327, "uuid": "4a81936a-44f4-4ceb-abc8-8c09eab9bb7f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783774327, "uuid": "ea8f14cc-fb30-44c6-b379-7e81704baa8d", "value": "393216:Wngvg+S4Jub+qpGQTINPtXXAq2XMCHWUjX8cuI3/PGTAI:WnnHV+qkTNPxXf2XMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783774327, "uuid": "85f6e728-63aa-4d6e-b87d-93d876c37e14", "value": 14300824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783774327, "uuid": "6d950dff-442f-4f46-9f3c-2d41b17e625e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783774327, "uuid": "c852cd5a-611a-40ed-b4c1-43d3de1ea081", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690dc5aa-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753319, "uuid": "a7e8f6fc-4c1c-413e-a0c3-206221910234", "comment": "Malware payload (XWorm)", "value": "5753b2e40dda6785f1cddb7b8e8ffd84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753319, "uuid": "85e1ab85-6aad-4b51-9ad5-e2ead1409189", "comment": "Malware payload (XWorm)", "value": "81d1be154c6ac1d29d5074a2836b53caae2649b2b18868fe75506c7fb5771df6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753319, "uuid": "f6f90450-624a-458e-9957-36c2660857f4", "comment": "Malware payload (XWorm)", "value": "8848757b52d0fc3dc38387b5189aceccecac98ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753319, "uuid": "7e89517f-91e3-477d-88ad-ee6728f1ab12", "comment": "Malware payload (XWorm)", "value": "e8d21bbddf1a8ee07e288193e1bf2efb13242ff46b4c410c4856003ed1f2d8c61948455c52a4283ec14c11fdd429db67", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753319, "uuid": "5b34aff8-f9a8-4f9d-9b73-84ea70f3bf14", "value": "T184B5129B1E2AA6C8C5D2BECB100431D1CF5FA96E7922410C79338E568DB116FD1E9B7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753319, "uuid": "9e40d0dc-66ed-49df-be0c-57f2c8c9195e", "value": "96:jfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsfsl:p+WM6csMoVhmsjWh/ormN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753319, "uuid": "49cd9e5a-6ac5-46b9-aff0-89bcc8528953", "value": 2295195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753319, "uuid": "d04f0660-c783-4ca4-b70d-1f34a27c636e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753319, "uuid": "ee68b7a1-74ac-4a0c-b4a8-fe88f4fbe85b", "value": "MArrrrrtinnn.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6352ff-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766959, "uuid": "0b3ed142-635c-4c3a-9f91-752056ff6a0a", "comment": "Malware payload (Mirai)", "value": "1a18336313fbf7eef064ccfbc2beb30e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766959, "uuid": "7fbe1dc0-08bb-4cfa-bb98-d6cd462ae6fe", "comment": "Malware payload (Mirai)", "value": "83319a48bf7efd4040aa882a7c17675c556567461f9e7e142cdefc06ea81ec08", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766959, "uuid": "d174f17b-ffd6-4738-b044-2e97c45151f9", "comment": "Malware payload (Mirai)", "value": "63af12026ca48e23d4ef99cc6fde7d0a8fa84b7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766959, "uuid": "4aecd0bf-5408-4e89-a137-11940954c32f", "comment": "Malware payload (Mirai)", "value": "5ace01d52fc3bc27b16cffd49c0572bcb7eaab8c3cce5e6e3ef133d7e17430b2bc77d35f0d90588a1a29aa346d7da15b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766959, "uuid": "030c462e-4579-462d-be38-11e7d7be7b8a", "value": "T149219E9AA7D36D2BCC540277DCAF5710E362AE44869EF513F32216190C6E21A1F21156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766959, "uuid": "e3e5d62d-8044-441b-aa07-80ad66a02ae3", "value": "24:JColMlgP9qD0at6EoKGUrUlFSy4WzLCkIddx2HuGIDv1Nfc7:JColMOFqDPtZrkFSy4WzLmGIr1Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766959, "uuid": "fbcddf7d-8286-4d1d-9163-ef560981937d", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766959, "uuid": "e9b30c57-d89e-42fa-b257-023612eca387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766959, "uuid": "780a4e08-5d54-45e4-8c5e-186087fe986b", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17671f1e-7d54-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783793554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793554, "uuid": "cadb92b1-4346-4aad-a999-59339f54aaf0", "comment": "Malware payload (Mirai)", "value": "14ea85e2e2960af7515b20a7ef812ef6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793554, "uuid": "cd2af330-8c44-46d5-97cd-6c22b01433d5", "comment": "Malware payload (Mirai)", "value": "83850b796647f863101c5ea49c0e0472b8b7931ba53b3c4e1f5486a4121f9339", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793554, "uuid": "1c013980-019f-479c-8539-38e88b681fc1", "comment": "Malware payload (Mirai)", "value": "2f167ff22b688a2bfb6b19e8b059ab886aabd42e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793554, "uuid": "1186345c-206c-402f-99e7-584e0cd4fc48", "comment": "Malware payload (Mirai)", "value": "d7adb3bb7dbf5c5b28a77546fc20cc2c38b9f79225717a2f0570a2a6fae1c9b62955a5994322446b6c0cc149c3e379c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793554, "uuid": "ca74cdb6-5642-4219-bb0e-6dc31f6606dc", "value": "T15A519E85215C2B31AC99DAD632AB403C619750E74FCF5FBD98D828F948CCE1578C36A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793554, "uuid": "01909dfe-e4d8-4b88-87a7-d6b48884f096", "value": "24:ItInm7v+ltsgAjCLM858NIG4ksayq037xzv:iom7mlWt+LTJa237Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793554, "uuid": "384c0854-0a8d-41d6-94ac-6a1bf666daa9", "value": 2829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793554, "uuid": "71793aad-05a2-4e8b-92f0-41ef4b5961b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793554, "uuid": "720d132c-addc-458d-92ac-315642c29a54", "value": "titanjr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e348cda0-7d4f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783791749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783791749, "uuid": "e4058669-1a91-4e50-8bc4-ab2f84f5dc34", "comment": "Malware payload (Mirai)", "value": "88147c46a2db536a445f0f8ddd9af28e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783791749, "uuid": "88258130-9860-460a-93d5-294913071655", "comment": "Malware payload (Mirai)", "value": "84563043237682a743bb3e7ae7b57d50aaa0f1ae9abf453c4b00828d15b70ddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783791749, "uuid": "e950e05f-1727-4f73-8090-ce6503c0982e", "comment": "Malware payload (Mirai)", "value": "4c67a2e0543f7aedecd76b8c9c2588095f57163f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783791749, "uuid": "6f58b17b-9066-4287-b91e-60d97a0a3ffd", "comment": "Malware payload (Mirai)", "value": "a742da7f457ace29431fe62ac08e15504c3fdbf18550c1dd983e303b90a7e488f9be04c7deb10e04a8eae810122be71f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783791749, "uuid": "c3a12933-d3fd-458d-9f1f-f992e564d189", "value": "T155F3E70AAF601EF7E86FCD3351E95B0620CC655622A83FB57534D928F64A14F8AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783791749, "uuid": "280dc47b-497e-4c95-909c-8a38cefd9f49", "value": "3072:noJWv6U582Eo3NDJCqgF8wQSapzCnbdJM:oS6U7Eo3NDJCqgWlSfdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783791749, "uuid": "8f05c0e1-6cbb-4899-8457-643e47a4f8a2", "value": 165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783791749, "uuid": "1e72ac1f-d834-4870-b0af-f4ba1571c3c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783791749, "uuid": "595a1d0e-84e6-4d7f-a744-7a3763a1d67f", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08abfa5d-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783752727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752727, "uuid": "2c61a2eb-4f1b-4f40-8e0e-b88127b647d0", "comment": "Malware payload (Efimer)", "value": "ba46cfb8a6e53e9dea2fbf06e3db2518", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752727, "uuid": "8079f6f8-dadf-4caf-be36-dc2c62026880", "comment": "Malware payload (Efimer)", "value": "849059557326f75a14a78e4e62652dfb52f7ffd4d21a3726509ca7a99ad02fe5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752727, "uuid": "3e6c2d7f-51e3-4f8a-b968-283f6f047780", "comment": "Malware payload (Efimer)", "value": "daa34b283f67504f68606ac746812b8c1d814f4b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752727, "uuid": "54e7934c-0023-4a8a-8ea0-98ba499ed1d4", "comment": "Malware payload (Efimer)", "value": "9e94909a857fbebbb43dc31674bfa1586b2f4c0db5496bb6fd0cea575c670e69fde5428d7c6e18fcb28ddc202806bf8f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752727, "uuid": "67f2bac5-1b3e-462e-9b5a-6f1dd05a961c", "value": "T155E63308AAE013ABF9B30139EEF25D54E5A178F557B2CADB476482503E532E24D3E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752727, "uuid": "f1fa25a3-8baf-462d-8898-d9e538497474", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752727, "uuid": "47f8ae2e-b128-4096-b3bf-c7e35b0ea3ad", "value": "393216:zvXXXgetOqCfFj4OrlawE3DQPlXXMCHWUjXEcuI3/PGTAI:zFCfF0wEzQPZXMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752727, "uuid": "14b559c2-ade0-4f31-a6c1-d0ff41f78185", "value": 14289640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752727, "uuid": "cf7f4196-41aa-456c-9aff-ba2a3cfdee65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752727, "uuid": "5ffcd879-a3bb-41c0-a71c-686f4b8887ab", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd51eeb-7d57-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783794879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794879, "uuid": "a3067b1c-b92c-4c39-bab8-0822445f73fd", "comment": "Malware payload", "value": "9391a75ffd287b67fec10d3760a46a61", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794879, "uuid": "da83f26f-79b1-4ccc-b2b0-66db02b043ff", "comment": "Malware payload", "value": "84d81af465f76c5bfcbe193748a17d6b597a3cd3875a96ed7791eb18cfe10c4f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794879, "uuid": "340bb281-f999-420a-a755-4448a0464c56", "comment": "Malware payload", "value": "c8d0b3630f028bbee91a0ca4828817fcf11cd5d0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794879, "uuid": "94a0b879-17d2-4aee-bb60-beeffcf72895", "comment": "Malware payload", "value": "3fb0849e6b0e25f2de55b5b24b07cc3784835fa2e436f02ebdb6e7bbc707c32359e0272c08a0aca488dab25b271a3cf0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794879, "uuid": "344e48c7-78a1-417c-ac09-d7b533ef434b", "value": "T136337C6616817C24AA98C8371D7F1F0CBDAD43E6320492DE7FCA3CF28C5AA9D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794879, "uuid": "7a5e0593-95b4-415a-afef-374020415885", "value": "768:XXRWNGxVPA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:xlxzcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783794879, "uuid": "8fcf657e-95b1-4776-ac8a-e3ca24d20da6", "value": 50382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783794879, "uuid": "5bcb5875-e6bd-4a4c-a688-baeaa65bcc30", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794879, "uuid": "51798897-7bfd-420e-9db3-c903fd3227b3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cef5ab1-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749755, "uuid": "31ec82ab-e55a-4608-a818-49873135ae8d", "comment": "Malware payload (Mirai)", "value": "e5d5bfcd34bd6d87257860d503a517e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749755, "uuid": "c35fec22-071c-4886-85a8-24480dce6f39", "comment": "Malware payload (Mirai)", "value": "85966314684daf60d9d1789f8e4afda6e978af253c15c7d16fcc19edd5ae6fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749755, "uuid": "74205a3f-bdac-4951-931c-63affbfda4d5", "comment": "Malware payload (Mirai)", "value": "0698876b7a7f1c8651c8f396bc46b0927efe4575", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749755, "uuid": "21266d40-403f-4256-a812-7cf4b80df4c8", "comment": "Malware payload (Mirai)", "value": "69cb61be36c87d228e8537daa744302c9b2846a58de6b319cbb4d168c4936ee369142a36db2a961ee2f91610758d6816", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749755, "uuid": "dc149e32-5f32-4ca7-be82-1ba637b40c90", "value": "T1D723010781BBD08B9C6130701AF7349F1A851B1E17A8685F43F8F4F63285E8B6B3C9A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749755, "uuid": "7dc3d514-1f0c-4813-aa26-b8a381fe2e13", "value": "1536:SsnbLVQAjGZJuqiTaZ5qsMH8qjTzsKnouy8oyZ:Sa9MJphZXE8E/sSoutX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749755, "uuid": "58d19a3b-d001-48fd-aa6e-ee362e0880b6", "value": 49824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749755, "uuid": "a40ccf34-8a6d-4478-b7be-da8b3fd55865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749755, "uuid": "061f6b2e-a204-4a64-b8c7-942f2c65e6d7", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1bc581-7d53-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783793433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793433, "uuid": "c99ce319-01b0-4180-a63b-3e3d3abf0423", "comment": "Malware payload", "value": "60fe55a7577d0fe9f9f9e928b58a149d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793433, "uuid": "20598aea-c8a7-405d-b393-7a6d3fd7b769", "comment": "Malware payload", "value": "85a8df9964a728109e6b06241d5c9622f34035da24dc316336ccaf49b36fcbfe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793433, "uuid": "46b57c18-57f5-42d1-89dd-18857344730c", "comment": "Malware payload", "value": "65a042c02e2fb1e029589935ffb85a338a23267d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793433, "uuid": "5e71daa0-4441-4ecb-8ed4-44843e6c2fc8", "comment": "Malware payload", "value": "d9cfd036c81eccffe5ca688f023276bec2d0453fbc0326838feec3200921ec50687285ea447585c733cc5647ea44a059", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793433, "uuid": "5e47e3a3-ace6-494a-83b3-ca7a651c4d48", "value": "T14CC28D956A867C44BDC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793433, "uuid": "60944bc4-54d1-495d-8ac5-4b843ae8d771", "value": "768:c8vCB+25j6es8Rdx9FYpMSUpi+20qUpi+20YQX:c8l25Jdnd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793433, "uuid": "13165620-d1ce-4966-a383-d4b794a77cd7", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793433, "uuid": "9064b503-cd79-4f33-98e1-3be7f08b75bc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793433, "uuid": "ea194af9-0a1e-4139-9418-56712d0d401b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb410f2-7d15-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783766832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766832, "uuid": "2ddfeb95-d872-4cb7-97d3-125a8eb025ef", "comment": "Malware payload (PureLogsStealer)", "value": "62a993c8458911147bc76fe10f0de75e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766832, "uuid": "200b6b79-e19b-47c5-9151-db735084c11a", "comment": "Malware payload (PureLogsStealer)", "value": "880d74780d64dd25ce6f24c1c7a04f7d6028ba89a7acfe35fcfe428c89ef24d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766832, "uuid": "d00dabfa-0bf7-466d-96df-d272e90a7ddd", "comment": "Malware payload (PureLogsStealer)", "value": "35ac9b94234b4b73fd6976c4248b988b2a884af9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766832, "uuid": "a7c9ec11-e9d4-46eb-aaba-322fd6d4c73c", "comment": "Malware payload (PureLogsStealer)", "value": "1f56181f5cc8e8c341b05afaf82d890d2e230b066922fe22f7ba0776d1c2bdc936d5a74c65a22eb085672023e0889978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766832, "uuid": "291734b1-da94-4f31-b0a1-869c308f249e", "value": "T10E05BF2A36925F21D14A1373C1C34A008BEA86676AD7F70B72C413D61D477FEEE0A697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766832, "uuid": "152cab4c-f9a4-4681-bc59-870ee928af46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766832, "uuid": "19e0bda9-18b3-4972-88cd-b33772700408", "value": "12288:u2gOO0wmyIaWz2/Ix17ZmFFNHIollOYlilp/aGJCweW8Fn5qEVtDY1:uBOO0n5wU17ZKplyda2Pen5VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766832, "uuid": "5b5870bf-a091-4d96-8f46-b3ae8841a5e7", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766832, "uuid": "c148d2be-63e0-4605-832f-6478fdf3e101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766832, "uuid": "4d78a670-dafb-4393-90db-e9b0bbde138d", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.14344475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba6571d-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749753, "uuid": "e35910ab-a066-4a53-9ee0-bad09e7afa11", "comment": "Malware payload (Mirai)", "value": "303695f78aa7c936339299519e11d287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749753, "uuid": "1f3b7de1-11a1-410d-8c67-532e28d61cf7", "comment": "Malware payload (Mirai)", "value": "882a14264606dc22084aa89b7fc1ecb3ef2472cd3c5c6cbe3ac49c39f771f9eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749753, "uuid": "f17658d2-a99d-4e56-a4d9-6edc2d704ba9", "comment": "Malware payload (Mirai)", "value": "8f278a26c4b3025777eb46113430ceaa90349cd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749753, "uuid": "f3cc75f8-6f21-46d4-857a-9accc22142a4", "comment": "Malware payload (Mirai)", "value": "a447e7d0cf8bac7773cdf0c56bce49bc768647b5b4bd7bb35982f06a13101dadd2da918dc0f302cce4158a717a1c96b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749753, "uuid": "6d035aba-b15e-48ec-ada0-31dd3bd42d58", "value": "T1EF7302184ED774345459BCB5791987E0399E3A18B2F33C66343141FCBC869CA7FA6A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749753, "uuid": "032dd091-563d-4ed1-acb9-aa191fb0e2c4", "value": "1536:0PqWJz2JGfSv0lACY0UN3vdV7e4pHRvmSqfu51jYbaElQdqLwrAf4Yf6eqppglY:0LiEKvcU5jSqvWkVYbjlQsLw84FHnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749753, "uuid": "ac63a226-22df-4028-8d9a-7a3ebe288f79", "value": 74888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749753, "uuid": "c5dde29c-420b-42ae-a547-24f7b43e37cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749753, "uuid": "ebfcea6e-b328-482e-a9f3-230eed602854", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afc80b8-7d80-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783812673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812673, "uuid": "b40af622-a62a-4e13-9f2d-17f0185037de", "comment": "Malware payload (Mirai)", "value": "0ac8b3af4ea3ffcc3bdca85467468bd9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812673, "uuid": "47b6a485-4266-4ca9-b44b-74bb17b76d9e", "comment": "Malware payload (Mirai)", "value": "889f8101436dbf4c3d7bf4a8ed9c399bbacedaaf0c64c731eeebcd2cee6f435b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812673, "uuid": "3def2994-e169-4c19-a1bf-a46766da4e2d", "comment": "Malware payload (Mirai)", "value": "0f1419d47ddb5bfa187a753d49b6261aafeaaa8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812673, "uuid": "97dc28a6-cbc9-4a49-8728-117f482d07f1", "comment": "Malware payload (Mirai)", "value": "25cebea3537d14a5b87b67eabb2d3817119c11cf21969a86b02b69cd7e9bd8a0303ab28274af918fc44a5ff50638c79c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812673, "uuid": "e0db401f-90c9-4467-9f22-88a20839d46e", "value": "T1A95191C7510517312EB2DDA6BBBB886D30D0D1AB64C7FFA6A4D8BCA4428DD0C7C4265B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812673, "uuid": "9dc1090a-dfac-440a-860a-4bd7020d7ca6", "value": "48:iJv5J+YEJ993J6PJILJcLJiTKiTGFlJXZJkvLJZ7JJmTrJITJlhTJrjVJcwV:iHA9EeacxazPwLVAClDTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783812673, "uuid": "6e837be0-2d23-4b8a-81b9-b89d0e7f952f", "value": 2728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783812673, "uuid": "574db7b1-8ecf-455b-8bd8-c0b0efc85bdf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812673, "uuid": "f8edc64c-c51c-4878-b38e-99cec6334c40", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34359189-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766974, "uuid": "c8f4a2cb-d166-4530-8cdc-a241027e951f", "comment": "Malware payload (Mirai)", "value": "e2bc6884539413778ecb681618bd771c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766974, "uuid": "1a382f6e-cdc9-4830-b8f5-2f1b9b8e63ee", "comment": "Malware payload (Mirai)", "value": "8929c3e6385b11bb8c13ff49a1e92cba53d1cb6d33095a9dcb50aa72497b6e52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766974, "uuid": "af98a650-ac60-4c0f-bce7-506cc6253eaf", "comment": "Malware payload (Mirai)", "value": "dd11e2c41e7d2ea498e1fa7512664d284c17222c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766974, "uuid": "418f3a30-f4ea-478d-9fcf-e7dafc8959d2", "comment": "Malware payload (Mirai)", "value": "9fea3a7d3eeb2288d3d9b02e16cf97a87e75b1d0ee5bad119898906fe079b158895bc77a2cb475aa8a82e976f5e98fd2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766974, "uuid": "bac90810-d8c9-4b94-9bda-da484998cd61", "value": "T1F8D3078AF8819F21D4D722BEFA4F519D332367E8E3EE7112DD245B2133C655A0A7B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766974, "uuid": "007e791b-94e9-4c67-b6fe-13316edb4c9d", "value": "3072:uxWtvzaAPvWuRk7eESHk18U5ureuay6KpXUhOA5R74eNJo0jKIn5MU:uxWtvPH/S7eK8vquay6KpXUVR/NS0dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766974, "uuid": "be630edb-1ff0-4543-bdb9-4e52f08dfcd1", "value": 132656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766974, "uuid": "b44cc27e-00e7-49c4-877d-c107e70da5d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766974, "uuid": "33fd60df-c095-4aa5-ba37-d5e653eed4a8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a20786-7d15-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783766834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766834, "uuid": "40c217a9-f55e-426c-996d-2db85ac287cd", "comment": "Malware payload (PureLogsStealer)", "value": "5b2ed9c729b4a0915bda302c023e0478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766834, "uuid": "7de4b097-0b7d-4660-a2d4-b0c929480e69", "comment": "Malware payload (PureLogsStealer)", "value": "8b18c11fe95bd59dd8e018d75668792c478e557a71a54a7f078f2ef4f060ab0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766834, "uuid": "e7fa686b-0f04-418a-9851-80f617f15d0b", "comment": "Malware payload (PureLogsStealer)", "value": "ed7dfb9642ae2a0b9f6331e8a75bbd10e25a76a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766834, "uuid": "620daa53-f6a5-4d3a-b725-d81efc04351a", "comment": "Malware payload (PureLogsStealer)", "value": "95c05cdc7eb4a66c93bd04cfa1d8b830e552160e75d208a54f05530687a0f72ee0e5032c2ae34eb5d5e3e6eb633d98ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766834, "uuid": "7bfefca0-9a92-409d-bf93-aa9160ba0d4f", "value": "T1E805BF3A72918F21D24A1373C1DB4A0097EA9A577697FB0B71C413D71D423FEEA0A687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766834, "uuid": "c901aad3-f1e6-4a2e-89cc-9fd5dfe7a25a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766834, "uuid": "d0067c29-0983-4335-9ba4-9b0b7e5c7837", "value": "12288:5sv7AsftroSqMOhkyqo3ssDLAqbfqGBT+x/xEivXaH:5KfFcSua7oXb9BTC/bvKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766834, "uuid": "b97c9220-970b-46d3-b6df-280ef48001f6", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766834, "uuid": "649000b1-4c7b-4aa4-8bda-72ed84699b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766834, "uuid": "7cff5cc4-cef2-4074-bf9b-4ba3b6c6ad5a", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.87914731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d46e3b-7d58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783795241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795241, "uuid": "6b3d24fa-d30b-4547-80cd-20efc6ae1fdc", "comment": "Malware payload (Mirai)", "value": "3c8381134691e6e41206c5bfd2c55ed2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795241, "uuid": "60969876-db1f-4928-b9c7-af8b629560b0", "comment": "Malware payload (Mirai)", "value": "8b35bc886f3c46afe759dad21cd8bbb05b2c360a4a6b6e8bae8a8be334ac012c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795241, "uuid": "3952ae56-0350-4ecd-8259-948d69a9ad18", "comment": "Malware payload (Mirai)", "value": "0678df09b1065c5cb4e6126a4b2fdc60dc480b0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795241, "uuid": "74fc7a7a-8f0d-40a4-8388-cffbecbcad93", "comment": "Malware payload (Mirai)", "value": "c8ac3ce74afd89f94137fbcae2a44e5b1b3504448a94c882a05222ae7c3bfb5569724dd03a5714e5f2339c35b58c6945", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795241, "uuid": "e2192b28-fe12-4b39-bbfa-225f1a7e66b0", "value": "T1EAA34AD7B402CDBDF84ADB7B44531906B531E3A20A831F36625BB917BC361A85937F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795241, "uuid": "de63a733-7e19-48ba-b146-740e95adb0ac", "value": "1536:sNLBpg4ORXcJpjrRcBoMtnP4++Y8E788E36HDeSHJ3PdNi6KXXltP5CdkzDne:RczjrRgLP3+Y8E7rF3PniZRCdkzTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783795241, "uuid": "2280560d-70ef-4f84-a8f9-6c0bb6e6618a", "value": 99592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783795241, "uuid": "63a59594-ffe9-4248-b89e-98c10789b155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795241, "uuid": "4870eda8-d944-4dc9-abde-58312f794d92", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f8f836-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783788806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788806, "uuid": "d75f8f29-862b-4111-a933-313f210f007a", "comment": "Malware payload", "value": "7a3755828cb585b015078a21083fdac7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788806, "uuid": "12dff460-0697-43f5-afc1-7fcfcdf3b549", "comment": "Malware payload", "value": "8d29e7e8fc06f9b54bf35c50d8c8f227bc75aaea18098b2c49cbe2bde47199ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788806, "uuid": "3e7dca3c-ddb7-4ec9-b451-5df9459f3bc4", "comment": "Malware payload", "value": "868b14e86260813b63401460ce833c0b08772580", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788806, "uuid": "6602a63c-cfd2-4440-b5f6-1ca8cd5004a6", "comment": "Malware payload", "value": "b7fe219b4b849a3770bc62666c2d91dbf63a5a0e0cb8aa05da7f35df6cd7d76fd381e1ec353e7c85cbf7cb46066571f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788806, "uuid": "7b7f5f9a-f38c-440a-87b9-228a8e1eac63", "value": "T15551C0CA125217753DF6FABE71BA4468B390E0CE68C5EE34E5D938F5424DD0C3286663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788806, "uuid": "c0c561d9-32a4-453c-a0cc-ad293a71d0c2", "value": "24:vh4ihdKhKLD2hNyhTUw2h7uhdsenhUFIhDADhrshyhpuRhNGhmChAnAMkhdDB:v5OLGSh439hoXa+D6AMk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788806, "uuid": "f86eae7f-6517-4e25-8767-0da0e4c1e4b5", "value": 2520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788806, "uuid": "a7678b92-6b38-4a66-8a61-9965f24438f1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788806, "uuid": "24a33704-7a4a-4812-ac1c-44846e6f022d", "value": "HMugenXrevamped.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efe34b8-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766965, "uuid": "d2cbe11a-642d-4967-be33-ab291173dd6f", "comment": "Malware payload (Mirai)", "value": "ee7bcdd0db0ccc9fc3cebb20d4fb3db0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766965, "uuid": "c2a6acb5-fba1-4fbc-9a42-75ba46d5793e", "comment": "Malware payload (Mirai)", "value": "8df6f45863fc8dba4fbe0aa6033983c249b4761e3bf2aa5c2052f1ef63191fdc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766965, "uuid": "1be2873c-9760-4146-8810-6ac6b8885504", "comment": "Malware payload (Mirai)", "value": "7b71430402ba374511a3d7cf2c78538c45517440", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766965, "uuid": "d8ace711-61be-4380-ba43-9194c5da7911", "comment": "Malware payload (Mirai)", "value": "f975c885634717a811fa99ef7e38a403588eb9f62fb11c33460e3ebbf6682e6f6193a399abe49732860cc55aed55420e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766965, "uuid": "b5c42074-2fd4-4593-ae10-718db03b953c", "value": "T15041CE8E5F714EF8F159D93847374B35279B920843C04249E1ACD6405EC430D899EBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766965, "uuid": "79453aa3-cf8d-40be-ae9a-8531fe72ee73", "value": "24:3u4dsgph8AmsiRD8AmyT/z2HdllPh+qtWB4u37I8pa8+Ddz3N9l5zBkEp7ilAGnv:exgpEuQ2H7y1ErD/9LuEp8nn2L3qxMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766965, "uuid": "501a0780-5b40-4e8c-b111-7fd5aaea8834", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766965, "uuid": "330bc1ee-1387-478d-954f-30f2335481a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766965, "uuid": "b175f33f-9212-491b-ab04-6267a800391f", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d3d8f6-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748129, "uuid": "4b57a1ce-94da-40de-99d0-37f7e4fa8415", "comment": "Malware payload (Mirai)", "value": "7f4b5e7cfd64dd0001998ef29d590127", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748129, "uuid": "ea7fe3c4-8d67-4c67-ac81-eb7c79ff4589", "comment": "Malware payload (Mirai)", "value": "8e601ad8bbd565084f359166fd9b13930c70c3220f4d4f185e1b7e07c4a55d3c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748129, "uuid": "b9c9aa20-15b0-40c6-bddf-e10bb8aafd65", "comment": "Malware payload (Mirai)", "value": "75415b5e133cb8b9fd042acef0afaf92a85ad8b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748129, "uuid": "6ec848e2-a612-4b3f-b5b7-be54afb48434", "comment": "Malware payload (Mirai)", "value": "e58e16fed76991a1fa531c78d1015de207623a546b2350821c1bc52ef8b3b65d0a312d9b611066883eeae5a479469d8d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748129, "uuid": "5ed54378-2431-4774-890e-77aed0237fa1", "value": "T1C4F062980144296397499D1FB593906F136AFBC8605737C6FACEA79896407C5B020EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748129, "uuid": "9e8e3606-3c47-45a3-a940-d3022ed5fc4f", "value": "12:KhI5W3CtI1/TbNDh3aFP/3bQWDh3aQX1npLOhcDh3aK26Dh3DzliAE/Dh33eqlHA:KOQyS1bbpxiPvb5xL1npLOExnHxPliAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748129, "uuid": "4ab06ec4-df91-4fe8-b42e-8c99835f5f55", "value": 536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748129, "uuid": "f825aa50-3702-4a88-b61f-26093b41e581", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748129, "uuid": "3567b8d6-904c-4e6e-9b82-2e0516aea441", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ddac30-7cf4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1783752312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752312, "uuid": "7403d488-8800-4e31-9b05-506986de8183", "comment": "Malware payload (RedLineStealer)", "value": "5081657547532969afad7a03891b43f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752312, "uuid": "099580a6-3597-4c6b-b03f-8c15fb3a744e", "comment": "Malware payload (RedLineStealer)", "value": "8ebc8fc6ce56d5684a1f15bc23439a183e5955ab82971c5c7a7b0b8832d78198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752312, "uuid": "4bbbc5aa-1291-4202-8a69-eb1077e0f163", "comment": "Malware payload (RedLineStealer)", "value": "2aa33f9d04274c941ec0a668819a2f3960c691d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752312, "uuid": "0d4874e8-f291-4f3e-ba5c-98cf54a79bd9", "comment": "Malware payload (RedLineStealer)", "value": "0b51e879ec58c00140e64015ef5568e64b981930229e3031aea7368d2ceb35f0f2b6cf9c35c295887a180a6a5f3b7b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752312, "uuid": "15c3d9b1-a1ff-4b00-be4f-48e8dd470e23", "value": "T166D4194177409B51D55A317AD3D618340BF1B9E74B32C20AEF8A3FA97D72363AC1B60A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752312, "uuid": "262a7dbe-59ca-4506-9738-6eb671f2d084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752312, "uuid": "fc9961f1-eca2-40a1-8240-589fab108ab5", "value": "12288:M9J85LGE/c8SttVJDj8iCug9aCenPcN3CNIb88WsNMP5F1k:M9gSE/c8SttHf8iC7hWPW3CNIb88WsN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752312, "uuid": "caa7a784-8b08-49fc-b020-1091a9648ee3", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752312, "uuid": "22fdbd1b-5ba8-47bf-9504-981e176fd44c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752312, "uuid": "a22b590d-9f33-414a-8300-a2289e34b6ad", "value": "5081657547532969AFAD7A03891B43F7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c530f16b-7d11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765070, "uuid": "87224230-224e-416a-8f3d-756c017a61be", "comment": "Malware payload (Mirai)", "value": "2b58333826338cd78ea2f8d76f478482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765070, "uuid": "ab1531ac-7d3e-49c1-b6d9-2bb8ff20f6b2", "comment": "Malware payload (Mirai)", "value": "8f7df0deccf13ea546fb82bbb0283915c879705da914f87776b3f27a42a0afc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765070, "uuid": "653d1048-a4d8-473d-8b42-664994cea1a3", "comment": "Malware payload (Mirai)", "value": "29f10090722201878228aea2302187180d5ab1b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765070, "uuid": "34e6ff4a-74b6-43d2-9a8a-632dda9313c9", "comment": "Malware payload (Mirai)", "value": "50f465632d7a54da1196cf0c2e12dbf51d6235fea27841b00c658f54411a728ee5ec5af6aa148dd00ded0eef7405cb45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765070, "uuid": "de49bd66-bebb-4278-9e01-62c04e55cacb", "value": "T110C3174AF8819F21D5D626BEFA5F518D332367A8E3EE7112DD245B2037CA91B0E7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765070, "uuid": "808f246a-d7ee-470d-8440-fa3a0f308d72", "value": "3072:n+MpIm+rw5RUSdEGaZyJyS4WZZllIaITJwaX6OfDZhmK3txQaOnbe:n+Mp3+8LUS2GiS4efIaITJwaXJfmK9yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765070, "uuid": "514d5b0a-9353-461b-a316-f54b56ab68f6", "value": 129408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765070, "uuid": "d545a261-879d-41dd-9633-d22c937983cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765070, "uuid": "449251df-1c76-4383-81c7-0aafc5bbb95d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd01010-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766967, "uuid": "880862ef-8cd3-4fb4-bccd-97d768f015e3", "comment": "Malware payload (Mirai)", "value": "e818302b857f0cd7b9e309f27ac6cab1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766967, "uuid": "a516ef45-6488-4d89-adf0-d2974a7c01a0", "comment": "Malware payload (Mirai)", "value": "8f88479b2c24525bb7ceb92b0db742acec7ca4b8e77b7e2f08022a93c14ab10a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766967, "uuid": "535238bd-2dde-4c5d-9c33-04cc39794702", "comment": "Malware payload (Mirai)", "value": "1d3f583fc738287e68c523bf7839cbc0657a262b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766967, "uuid": "94f97f90-4c57-4c89-bddc-f57292d2250a", "comment": "Malware payload (Mirai)", "value": "c8e2faa7225c71e232ec50ddf0ad556d8bb91256e3dad73b0877666fd6194ce2d6e9e36ea01f4e34859876ffd167ca1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766967, "uuid": "93910688-996e-4772-8ff2-6bde341c5254", "value": "T11951F8E82DE11A774E43CF06A0228D2F712FFDC594E22BDFDADD6AE4846850470305D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766967, "uuid": "5fbb2f33-ec96-4116-ab02-f73a914f3566", "value": "24:r05pELMk0aC5EMy0MBswlxAx8Dxu8x+CxVxpxKx6LLxIxoKXRC4xK4x83pxuepxK:rMpzaC564hA58bNHNH+j+CPBpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766967, "uuid": "81c2403e-e747-4933-856c-d2d579b7132e", "value": 2722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766967, "uuid": "05102c30-c377-4886-b6ec-d3f99bb33f1d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766967, "uuid": "cb7f8485-d7ba-4dd5-96e4-b2c77493be40", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd60ea8-7d3e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783784408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784408, "uuid": "625113a4-1df9-40ae-9b69-fded5662d14d", "comment": "Malware payload (Mirai)", "value": "c49a503cc75fab25cae91096abee3899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784408, "uuid": "865f9036-3ee3-4b1b-a9f7-f9206eea21e3", "comment": "Malware payload (Mirai)", "value": "8fb68cc227948f1927ef1291da5aaea036f58842b6aab3770a53ff066a0e2555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784408, "uuid": "273769e1-8825-4670-8db4-170d1cec9872", "comment": "Malware payload (Mirai)", "value": "206d49ade776e2fe05a90a0b325730e1d0cabdc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784408, "uuid": "e1fbe275-111e-4d6f-b5c5-e769986919ea", "comment": "Malware payload (Mirai)", "value": "d22a3b964d50fa1245cb0464568204f5066ee47bd020cfa9da17b5f2dc8577b9f33a4ee4f9b35309118e466d78b8892c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784408, "uuid": "99121a93-186b-456f-9707-259f4c0951ab", "value": "T1D9043A02B31C0947D1632EF43A3B27E0D3EF9A9220A8F645754F9A8D9172D37558ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784408, "uuid": "b248c1f1-81d4-4aa0-83a6-38fe8ec55028", "value": "3072:rQvGNhxfqqeK8NZcp+6DdsNxYxpDRClEJVtyVfna:hXq9tgp+sSxYxpDRCWJVExa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783784408, "uuid": "9f763a14-6e53-4528-ac53-94fab9493556", "value": 179248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783784408, "uuid": "55ffd014-5d91-41ce-9de5-f79bcde70937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784408, "uuid": "eef331be-2695-439e-b19f-e7c4a7283298", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7ab7fc-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749836, "uuid": "dc821b06-7cc9-482b-a6a2-2625a9a7736f", "comment": "Malware payload (Mirai)", "value": "ad157bf074836ba20071c330b5125373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749836, "uuid": "711ae533-dc1d-4458-b1df-8a22a21049ab", "comment": "Malware payload (Mirai)", "value": "8fba5b4a2c5a6a463bc90511739d03c2077f4b5f51f433e09215f68f8effd7e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749836, "uuid": "548d18ff-ed3e-4073-abc5-258e2a3f6c70", "comment": "Malware payload (Mirai)", "value": "b552f939abce231231d2deebcac44221709a7d67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749836, "uuid": "278efc1f-0051-4890-85f5-bbfdf4ef40c6", "comment": "Malware payload (Mirai)", "value": "025d072eb9233e7e456b03498a7def756e6e2a8f25bccba31a0368828a3014f2da55bf8b31fd3d79ad2bd836614ba0f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749836, "uuid": "05bc4ac4-7e5d-4427-9265-8fe2b7e6541f", "value": "T1F5E3E80E7E218F7CF795823447B7DE1A965833C637E1C585D1ACEA012E2068E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749836, "uuid": "20e81790-f90c-4a74-8169-409d65f73251", "value": "3072:1hdK+SE7ktsNOT8wR41M7qlkoKrMh8XQPr6elpURzrnPcH+14tTI7V7mFM7mY8rv:7dK+SE7ktsNOT8wR41M7qlkoKrMh8XQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749836, "uuid": "1490fa7b-875d-4a6d-8c59-e7ed77bdf7a7", "value": 153372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749836, "uuid": "248b077c-fc56-4ea6-a745-c54535cb1d2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749836, "uuid": "68bd9e43-7652-4eb1-8449-8997cbc8f455", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4a4b3c-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753542, "uuid": "25e8842a-f0d6-4e78-b282-fee320f76dec", "comment": "Malware payload (XWorm)", "value": "592fe04ea377f8e298c00dc2a16c50eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753542, "uuid": "83782cc8-91be-4a61-87a4-e62664dc77bf", "comment": "Malware payload (XWorm)", "value": "9052aa35e9f8dde494939bb03ef0b14bf50b27a71fa21ea65b7bc5bfb3493733", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753542, "uuid": "97a615f4-30fe-490c-91d2-386dcd1aed13", "comment": "Malware payload (XWorm)", "value": "d922f72de2a5b57690bc08c7bc1584f1ca7804f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753542, "uuid": "b19b63e4-e771-424b-9ae1-6d20e7c2bbf4", "comment": "Malware payload (XWorm)", "value": "ea0aded6c504e2d3edc41b3bda651d4fdb8e983234a99b2ff825e7a63ff70e8a91d0722c66b2a96a93586386b305e017", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753542, "uuid": "b876c84b-46f6-48d3-b0fe-c43af7af86c1", "value": "T1E843C892A48B7153E23B2ACF08B51CD23368584CFF534D7B691449CA6B4E63449B7EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753542, "uuid": "34fdadee-8364-4203-80e9-d7ef12fdb11a", "value": "384:mLSC8LXnmjotisw39R/WleZzb+OpyTTTqozLs:KSC8XmjotiswbWlex+iwXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753542, "uuid": "62465e6a-e245-45df-9aff-ea7c066a2177", "value": 59477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753542, "uuid": "21d24b2b-c6bf-4bc9-a5ca-f477b3d33168", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753542, "uuid": "6733ba59-00f6-4edd-9844-0a8eb5b2ba2c", "value": "09072026scan_20260709140010.jpg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2eb225-7d18-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783767819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767819, "uuid": "e27f77c8-072a-41b0-b854-8c97083d509b", "comment": "Malware payload (ConnectWise)", "value": "04a6c97bb8091ef3965f36ce828ff357", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767819, "uuid": "e0840e17-0c77-4e79-ad4d-80ecf9b2e04e", "comment": "Malware payload (ConnectWise)", "value": "907ce7110acc53b4c8dec9fa2ed4a90869e10c59a8ce242af582178bad4d2ec3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767819, "uuid": "5d164ea6-e521-4859-b926-e58546231329", "comment": "Malware payload (ConnectWise)", "value": "35d7cb661c88662b688b73e8f61ef77f5ea61370", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767819, "uuid": "8b6a670b-a587-42ac-ac2b-9e247e0f2e1e", "comment": "Malware payload (ConnectWise)", "value": "3dbc28a95fdc475c9f765f2c26c5f7ea32c7857e83af5d85f017487415006131050e6b562c587bce9958d700536e6023", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767819, "uuid": "a63d8cb1-b8b9-4863-854a-44c9146095d7", "value": "T11746E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767819, "uuid": "2fa522d5-7c08-4583-a252-25262f8f2216", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767819, "uuid": "15901f72-4408-40ef-a424-be34da0c63f0", "value": "98304:nzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:nhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783767819, "uuid": "2601e960-5329-4cd9-b26e-6dcb0bbde2c8", "value": 5653160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783767819, "uuid": "bfbb1b29-1a95-43f0-8fc4-30737924836f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767819, "uuid": "a47b914b-5ab1-4e5f-a3a8-321525d2e0d6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40994ecc-7d51-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783792335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792335, "uuid": "eda43695-1676-4a18-9c48-cbdda4f6a47e", "comment": "Malware payload", "value": "178357fa29ad96571b4ede32769b77e6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792335, "uuid": "bfc28ecd-09a6-4ee7-b0ea-a20293687d51", "comment": "Malware payload", "value": "90f59a43308e41fe58fc58ab71ad60dc5454fac4ddee5185d90a7f93a1de7e80", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792335, "uuid": "62e0408f-b932-4b89-aa52-d86755145661", "comment": "Malware payload", "value": "ec691e72df157fbcf89a7a7f6fa0fc98db7ac4a6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792335, "uuid": "14920926-6b4e-4fa7-b509-463ad808d8c6", "comment": "Malware payload", "value": "8e3df9e13b35705bd3f754ec97df8deccaf6a99602741a141e5ad563053e202c25c106d209f712e9662fd1ef0d968559", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792335, "uuid": "7891a3e3-1440-4ef8-b29b-821a05b7aaac", "value": "T126E6334C2AD021FEE3738179EFA129A6ED7470A16732C8CB0B548269BF875D14D3D52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792335, "uuid": "56000692-b4ee-4db8-aa37-46e64a354d86", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792335, "uuid": "4a39c578-615b-4e63-9094-e42abccca18c", "value": "393216:FgLG1MkveDp1IvJN3FhPLFXMCHWUjXWcuI3/PGTAI:FgKBv0YlrPLFXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783792335, "uuid": "d350a2ee-c802-438c-bee3-882842040d22", "value": 14281904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783792335, "uuid": "2a62a30f-0d3f-478d-914f-22f4ef3ec5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792335, "uuid": "72aa72aa-2bd9-4368-9b2e-854218eea3ff", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb188af-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749860, "uuid": "d9ff4971-411f-48e2-b142-8e009db04bda", "comment": "Malware payload (Mirai)", "value": "6c16def53e2282d7c5d18ef6e3681ed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749860, "uuid": "51532d09-763c-4575-8228-c5638954882c", "comment": "Malware payload (Mirai)", "value": "911024d73dbb0d160ee0e2c0a46726a337bb34f4e67ab7974b2f00ac4a24296d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749860, "uuid": "a3749c24-0137-4d05-b8ca-73addce82b90", "comment": "Malware payload (Mirai)", "value": "62d1ad8f4bbc427b1991d9d99280b18bc7dc7b49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749860, "uuid": "b047286f-5f14-4faa-ba80-8eb638d1eae6", "comment": "Malware payload (Mirai)", "value": "c1603be6802ac8c52f6692e03406b9e933447c0f439d78b960ea4df95fb02343fddb0d9481ce1f3e0e8eba5a1d76abab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749860, "uuid": "fc1e0544-2bd0-4617-9c86-28d34df1877c", "value": "T1C7D33946F8824A22C5D722BEF92D218E331327BCE3DE32129E245F6137C659B0D77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749860, "uuid": "4dfb0c55-094f-4b69-819c-568d1e17a78c", "value": "3072:ghn81dzzJI8mse4KEd7xa/qD+xCKmqR/oHfC:OnEJI8VqEddaIxKm8oHfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749860, "uuid": "803741f5-70df-40fb-9854-1a17c2ceafbb", "value": 132576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749860, "uuid": "a38dae13-a4b5-42ae-a2a1-6c7828298a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749860, "uuid": "5888bfc4-4a5f-409a-b0bb-bfb49c8b4706", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693111bc-7d6a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783803141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783803141, "uuid": "a4f27ccf-93f3-4ece-817e-367ccafb1303", "comment": "Malware payload", "value": "a7fd5ab5abbe24e0337e5c6317f1a17a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783803141, "uuid": "9709ceba-7d3c-4367-b722-87d41ee7cf46", "comment": "Malware payload", "value": "915a6f0c68ae869517620fc7c756c551378e4bde11c5f8adb80a0dc40515fb9e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783803141, "uuid": "2d7e05b8-16e7-444a-8e83-6a39738d02ce", "comment": "Malware payload", "value": "182eca8129b8b19e17d49b9a7cdf002412c2becf", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783803141, "uuid": "fe564b06-70c4-4f89-b131-3d2a40ac1fa6", "comment": "Malware payload", "value": "8a54e1366556e1c7c9872e693a22cdc66198e48439cdfe89c737fbf0f4a499303e738e4209dae73fe84c05607b66938c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783803141, "uuid": "1faa0885-9f34-4496-867c-2d2fdb81a79e", "value": "T175E633481AF022EEE5B39078DAE4A451E7BD70750B32C9CB2368C6B59E175D04E3DB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783803141, "uuid": "d529ac50-5537-4c81-9218-ca680299a3b8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783803141, "uuid": "ba772af0-1865-4f53-b1f5-3580bba970bc", "value": "393216:+UupF/hkaIZdNmybxBSubUPDtwXMCHWUjXNcuI3/PGTAI:+U8ItmylFU+XMb8X6H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783803141, "uuid": "f11c9e1e-b072-45a8-b6af-54cf2d2d6db0", "value": 14300081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783803141, "uuid": "42d59fc0-d5bd-4f3c-a44d-67c674168fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783803141, "uuid": "12a3279c-ee0b-4d3e-8c2f-2d68d13972bf", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7d59b7-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765508, "uuid": "64f855d0-f271-4bcc-bd30-6e31fc2ff43d", "comment": "Malware payload (Mirai)", "value": "c2121da812fd0afbfa13ed797909c2ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765508, "uuid": "b0df733d-4d8e-4192-b3d8-231c70108e3e", "comment": "Malware payload (Mirai)", "value": "929822f62ee5ac7197432b9876a64ee5e1a4bec4babc01b26d6333caef5caa4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765508, "uuid": "59b86086-4639-4b68-8914-88a1a02b431f", "comment": "Malware payload (Mirai)", "value": "6fb7d1b5e87f6cd837b3e1f65463403a214adef4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765508, "uuid": "561d83b6-3e1c-4cec-849b-f47092592204", "comment": "Malware payload (Mirai)", "value": "e902bb033d10bc84a4ce11a1468b8eca09521d57c61bdd30b3833616fbb824630aeb8b27ebfcc611a4872b944e9cdc46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765508, "uuid": "96c0935b-bef1-4f29-a784-6b6864d86c9f", "value": "T1F7B35EA1B801AE7CF4FA86B5473706096521D2454FA30F27F1B5ECEF7CB7098A60AD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765508, "uuid": "f7ec15c1-1577-44dc-adf6-ee6172413310", "value": "3072:KXCjUgk4YYDdm1vARzPAH6ZdyNVjsRKbZU05gETSGgRO6hFPjEFfTOOX:6CjUgzYYDdm1vARzPAH6ZdyNBTOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765508, "uuid": "e877bba0-5de1-4ed4-820b-47b0ed05450c", "value": 112588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765508, "uuid": "b6e3277d-0493-4dcc-bad4-a9f048e8487b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765508, "uuid": "6d5df2ae-8b83-4a4c-b4d4-80fa8dbf1f35", "value": "Ares.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083cb994-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788804, "uuid": "d16ad504-c487-49ec-a440-4143714eced1", "comment": "Malware payload (Mirai)", "value": "23bcceb9df7b22c658a2beb4f0946bc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788804, "uuid": "5bd74288-50c0-44dc-8f59-de1ca13653c2", "comment": "Malware payload (Mirai)", "value": "92b0563537f0687a68dbec4507d3b386b43a837322db318f73a8b7024e81cf38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788804, "uuid": "a2831442-4ac4-4e79-90e4-ef6644e12bcb", "comment": "Malware payload (Mirai)", "value": "0ca7360597f5ba2eebec43e3760357236f2c7670", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788804, "uuid": "e4639e46-c1e2-4a0c-86d9-5251003aef6d", "comment": "Malware payload (Mirai)", "value": "8585d3c823a7ae7e08107b89eb3d3a963fcda57d93a1fe5fce6a00e3d3b29b59d2dd37acfbd7270ed9a39482b4d01e5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788804, "uuid": "8d9fdb61-0028-4895-8620-01b8733e8678", "value": "T1A793C71E6E228FBDF769C33447B78E21A35C37D616E1C685E16CD2105E6028D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788804, "uuid": "e5fd91e7-9033-4fb9-9eec-843877cda5da", "value": "1536:Cw4h0fLnw2s8POwzHXH3Lrxowl0EqH0ueMOuBwINV/Bdo:Yh0fLw2srJw2EqUVIfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788804, "uuid": "45ce5ff5-8e17-4b91-91fc-fc2fb880f83b", "value": 95096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788804, "uuid": "22c6024d-177a-410c-9443-a0e8e62b7baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788804, "uuid": "3eedbdd4-4163-4cf0-a27e-1f85df271d5c", "value": "XDmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a85b18-7d80-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783812419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812419, "uuid": "9b578f3a-046e-4ee3-a70a-f7a194eb3136", "comment": "Malware payload", "value": "999699df7def173805f54e4b773acb21", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812419, "uuid": "1574a91c-bb74-4afa-acad-009b76db80f3", "comment": "Malware payload", "value": "94d90962079506e9c9d6661c69ecdf56fb0e16a7a2282d271942e2c7a165ffe7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812419, "uuid": "3963df98-7107-4709-b1b4-38e8037f8004", "comment": "Malware payload", "value": "8932db97a663ce30020981dff0cf52b617eacc3d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812419, "uuid": "3be67ff6-b31a-4816-940a-205525c233a7", "comment": "Malware payload", "value": "1e34db81e5a7b22507cf44b9cf5f4ba6325a96ac51553d965f7d23a12f720bde3da3aba5bbea97d53a83fe3272d833c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812419, "uuid": "aa925af4-09d0-4c71-9738-f6ae8d3937ff", "value": "T142E01265D7DA186B84BF5AC4B4730908F701E173BE154B1C3B8295A1CA74225746D554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812419, "uuid": "2aaea209-71c0-4955-9bde-e46a408e4b7c", "value": "6:ho2VLnSDNe3EeiNcAPovH6UFxcFs7smI9//P6Q//D7B/+bZJbKXFs7Yjs:NtKNcAPovH6KGTsJbKKEjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783812419, "uuid": "092ed672-3306-4bfd-a6e2-a51bcde3f8c3", "value": 297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783812419, "uuid": "8b03bec1-affc-4e74-a433-630196191d6d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812419, "uuid": "f6d24489-d78e-4a3f-b536-014ba7dc60f3", "value": "wwg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4145ab-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766966, "uuid": "2ca34cd8-c011-40a3-9bd6-17d80e1f7b3d", "comment": "Malware payload (Mirai)", "value": "577b27e83dd4ec7aee20de298ce7ec61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766966, "uuid": "099ea5fc-9f0d-4806-b690-4683f755abaf", "comment": "Malware payload (Mirai)", "value": "953fdb91c68bc5392aeb780b7fb11d36d4867326f55ef7f3152ade8f42553e21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766966, "uuid": "6077b8bf-cbfb-4519-b377-b0c3c02a65a0", "comment": "Malware payload (Mirai)", "value": "851c637c7d92a41857afc85eb8a2654bd83d1779", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766966, "uuid": "7788f3c3-fb09-4326-bea2-1da2e0aff9ae", "comment": "Malware payload (Mirai)", "value": "a987d43300464eeefe3715b11e5a47014ffc107be2e65e45cd80d77367b46cc801ba218722726a8e8ee68f17ad32a932", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766966, "uuid": "7bfd27a7-53cb-479c-98ee-0f89a3857ce3", "value": "T15241121E6F801F37DD76CC36054B275139CC842BB16A63916334E960BD3E605A7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766966, "uuid": "81717bd6-9fe5-49e2-b25d-b2ed9e59a35a", "value": "48:kff20KWnuDW3l6df9HOScTLmPkOTb5FSXZ:kffdnuq8f9uS4LmrTb6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766966, "uuid": "b346d3df-2005-483f-8922-78539e0db296", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766966, "uuid": "39014613-ea9f-4e57-a2cd-3a36d2c9f60b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766966, "uuid": "11e4780e-14b1-40a4-959e-38d7f5cf4bd6", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc46957-7d77-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1783808678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783808678, "uuid": "74e83865-c690-46b3-b495-42010b6fd9d0", "comment": "Malware payload (Socks5Systemz)", "value": "6b64cd8edd663a35111041d1aad54c9e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783808678, "uuid": "e6f1a1c5-2fba-456a-acc9-0dbee4467567", "comment": "Malware payload (Socks5Systemz)", "value": "963f836a69b3e3e02dcf177e0d34cf7fc37fa323f3f0011aac40dbbc9c06094c", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783808678, "uuid": "21771b6e-c38a-4180-986d-cc8396085b20", "comment": "Malware payload (Socks5Systemz)", "value": "5bd1df7712f99aeafdbec0d9fa154abf4f0af188", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783808678, "uuid": "f8721350-9584-4375-8c16-3f9e512d3eff", "comment": "Malware payload (Socks5Systemz)", "value": "afe028fd9d28c2bb829524d57a3a305a21eb60544ee4530347f079f807491a3a24da6e39c5a56128283caf7b3decb1da", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783808678, "uuid": "775b3e77-2234-4d98-ada7-da80dce708dd", "value": "T14006331293894E35E3B19FF1CFA35BA98713331532B612157896EC0B2E4AD51A01BFE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783808678, "uuid": "d62477f2-8e92-49fc-99d9-5b4ab5b984d5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783808678, "uuid": "44fa8aad-7ead-498a-b39f-f9d1c84a3cb6", "value": "98304:NnXpBJzjOtbPr9NWIuz7g5URuUohsDxTekHOtfdjhKqdQ6:FS90IuPZEwHOVdjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783808678, "uuid": "e4ae6c79-a723-432a-b839-783850a4d3dc", "value": 3937611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783808678, "uuid": "c764efe1-6cae-4677-940b-50143b0b7948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783808678, "uuid": "20fca05c-ac83-4d6a-8c25-8db6c1ca23b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04528db1-7ceb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748425, "uuid": "dacd4447-8c63-431b-bc1a-c33baa4b3f48", "comment": "Malware payload (Mirai)", "value": "a215885f4f79a41d43a28f72fc4b27f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748425, "uuid": "849e0478-18bc-4b1b-a87b-f59bbecc2894", "comment": "Malware payload (Mirai)", "value": "9764f31e638322ed6e43b854933cdf521970b0d7e3f89a8bb268a956ed790f9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748425, "uuid": "cf33ad48-a715-4abe-a738-f2075e7cfb28", "comment": "Malware payload (Mirai)", "value": "08357a29ef9784e3c3d16105cafea49282bb39fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748425, "uuid": "2414b1ee-4a0b-48f7-b924-3d44d3b0f7e6", "comment": "Malware payload (Mirai)", "value": "6ecab8f42a7a1059dd5135b96c642d393c0e81d90abfac250dbd7bce51d0f79ac1a819c917b2bf20d3eda214bf48389b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748425, "uuid": "5bbad614-a370-41ab-916e-f5cbe5ced451", "value": "T11F137B8AE743E0B1FC5B02B6107F17528672D93D50B9E786CB266832FD23601A72779D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748425, "uuid": "7c94fd99-bb99-4692-ab8e-3f94750aecd4", "value": "768:0e+m9Cc93HV152gc6MxGn/24IE+8HJytvu6v+5SWycSwLIhH:0gow31Dhn/FIEdwloycSwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748425, "uuid": "cfc76ecd-6bb0-4788-b242-9498d0239fba", "value": 43312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748425, "uuid": "98ac9ec4-3020-44bc-9b41-aa7d11fde11e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748425, "uuid": "35bd4224-b6f6-4ad4-90b8-92799f85c487", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3458762-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753551, "uuid": "16e855ff-cfc2-4da0-8a3c-e843398a939d", "comment": "Malware payload (XWorm)", "value": "3346eb633b6c7878670fc10a4deb908e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753551, "uuid": "c79b3039-e55d-4aef-871f-62d84c164fe3", "comment": "Malware payload (XWorm)", "value": "97add3fd34324f3d0dc932e8f79e256612e5499c1835e2445c128d87a0cf59a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753551, "uuid": "82cd1fd8-9365-4daa-a76d-e60400f717a2", "comment": "Malware payload (XWorm)", "value": "4c7152d2d8bc0b5d145707bc01e4c5898797c5c3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753551, "uuid": "4a29e55f-2e26-4a4c-893a-16e0a9cea2fd", "comment": "Malware payload (XWorm)", "value": "73013384c2294b3e5f983849c8b4df7956731a39aa8ff70a878ea684ce02274f77e1c0e0a28ac3998d875bf8549893e1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753551, "uuid": "4c994266-4ce7-458f-95bc-99bd64e3d299", "value": "T1DF752BFBE63C2429F64F0A73892B0635DDEBDAB11022FD167F6D91E59291E524400CBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753551, "uuid": "bd5c0e62-c124-4036-b483-fd066faf2543", "value": "384:KItNNHTOLx0lrGWk5GkIpap88Dg4tW/5q8qhw98LFU1fE/v+F:xoCv1LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753551, "uuid": "c1a07605-353a-48ce-b8b0-74a8f9515d33", "value": 1649358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753551, "uuid": "eaf2fad4-eb6a-43e0-9bda-89db0b8be7dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753551, "uuid": "238ea216-48a1-417d-8423-d3db36bc2baf", "value": "PAGO DE FACTURA 873850636056.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f65780-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765507, "uuid": "802747ec-d49e-49bf-8164-240a694b9335", "comment": "Malware payload (Mirai)", "value": "640aa08dbb8facf3b6be828fac8b3a85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765507, "uuid": "ead2d9bc-d842-4903-bf24-25fb1467cd50", "comment": "Malware payload (Mirai)", "value": "9be68856ed2435a3921d58f74e3fda6aa08fe2132be2ab80e01083d37aaefac4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765507, "uuid": "03fbb8d4-1590-4b66-9ec1-2dd68738bb9a", "comment": "Malware payload (Mirai)", "value": "0b183df520f577b8d86a8a9b1df964e9ea9a5c13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765507, "uuid": "4adbd6d6-d94e-4442-be9c-6e4748430a2d", "comment": "Malware payload (Mirai)", "value": "2a576e9e74a514110507a460473f02e612fe84daf53c43af2aa43083ffbb1626f331d56409452a27852ba4fac2927e4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765507, "uuid": "ddb820ea-5c61-43ba-9056-5c45f0e47791", "value": "T191B36C369D792F67C1D5A1BB01B70371A0E3178E35B8C62E7EA40D4CEF9CA64312652A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765507, "uuid": "66157726-ead5-4d1b-81b1-76479dd76532", "value": "1536:iX8XxAVK9jqpUb0seTIHfMPsP+ngfuetb7WpRMWFJPwPXp:28Xx8OjoQHengfuRRMZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765507, "uuid": "c75217af-7e17-4344-8c55-49711e96778f", "value": 108296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765507, "uuid": "aa32e266-fcf8-4d8d-9257-7d7d648a3bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765507, "uuid": "65edeec8-8a2b-481b-b6b6-809ad68f7fc8", "value": "Ares.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b530d2-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765507, "uuid": "9d76db5c-c11a-4ff8-a7d9-a944b389e83c", "comment": "Malware payload (Mirai)", "value": "f89010ac3a4a71d1ead4cb9118d54731", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765507, "uuid": "f2b6254f-05fb-4f85-84f3-d25cfe46b672", "comment": "Malware payload (Mirai)", "value": "9c04caf3e5988e7c30de3b2e2e479ccf51dc76a2758df00e7ed640a324ae9f6a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765507, "uuid": "50143e0a-7855-4f7d-b4e3-cb8b7efb0129", "comment": "Malware payload (Mirai)", "value": "d0ab254b25552c9a313aebfe60cf3b46cedc337f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765507, "uuid": "bd30f5d6-7ed6-4a8c-8f6e-1685edf076d9", "comment": "Malware payload (Mirai)", "value": "9920a02615297ffeb6bdc867190cc89f6060f9d46b2efb50227564886b54ed1baaeea591c0f3e921b28bdc0c1818cc02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765507, "uuid": "198a5e87-6cda-43ed-a857-7b40adc44be7", "value": "T157A3CFA190A02DE1C1694B3470F1B93D53739D1B78172FB2B642866D184BFC8787B3BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765507, "uuid": "93e1c7ca-cb9a-4e35-af6b-7f4a1e4887aa", "value": "1536:YCaNh/aXvRG9DRO9WRG5ttBkulwssTZae808oUL7DLnBidh4SrC77ppvQ5:HiSX5g9O9WRG5ttTeZaeZ0DLnBgh4Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765507, "uuid": "0907a97a-6653-44f9-93e3-e0e5ae77a54f", "value": 99504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765507, "uuid": "a76d80ab-5753-4e39-b621-bdc2f64c78ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765507, "uuid": "8d1cc2db-926c-47e2-a17e-145763f10193", "value": "Ares.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bf216c-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749765, "uuid": "d58acdf9-7b6d-480c-9ee5-493b7a912e91", "comment": "Malware payload (Mirai)", "value": "cadf61a26db5721034861004a738b45b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749765, "uuid": "a11bfd1a-fc74-43a6-bea9-b38ede374494", "comment": "Malware payload (Mirai)", "value": "9cc12d325ece68385afbd03d105a0cece93ced51d07138e76ecf2ccc660a836f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749765, "uuid": "92d63b48-f068-451c-a337-34a83d62deed", "comment": "Malware payload (Mirai)", "value": "0c805a98a5bc847d8c1d49935e58be2323f1b596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749765, "uuid": "34f328f5-4fa1-4d4e-8acd-99797afeb55d", "comment": "Malware payload (Mirai)", "value": "8ff891d6fe7725898ea9c8d5a796daa2a0c8e512ddfcb7fbd03a00808540f1f63d572f8c95278b3adb683ec6a62271f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749765, "uuid": "1d840493-0d48-4f34-bb0c-15711519434f", "value": "T19EC35B9AB4019D7DF94FD6BB48636D1AB930A35251831B26239BFD93AC321F47C12F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749765, "uuid": "a7b0d59c-97e5-4a20-ac8d-3a76fa9e5c6a", "value": "3072:wT/qXTVJICv5b30f8MWxYLOBJBq6WPE3hURF9EH0:CiXTPICv56WO6BjqO3SRF9EH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749765, "uuid": "99cbd184-118d-49af-8cf2-38043b553721", "value": 125912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749765, "uuid": "fd6cd190-5540-4676-be7c-500784e1ac2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749765, "uuid": "ff16d65b-1159-48a0-ac7e-55e6409345c8", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2212594b-7d24-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783772956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772956, "uuid": "18ebd84b-12ea-4060-a69a-30dd9be3c228", "comment": "Malware payload", "value": "b7cb33dcc5cde29a075525a880362e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772956, "uuid": "a34dc2b7-fa85-437d-9bab-a604007d5370", "comment": "Malware payload", "value": "9e46294aa07b45e3085a463f2b8f66c1c6b44ad5148569a034dcc6082b31cd93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772956, "uuid": "f1560a74-2abf-4bbd-b9e7-915f11348155", "comment": "Malware payload", "value": "f3bebc66701cdb3088e7d43a99b10a7d0a7e9f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783772956, "uuid": "3ecbbdd8-cbb7-4904-abbc-48346e793013", "comment": "Malware payload", "value": "31a14ec0ca373c3b9613218d5a2ab2e9f90165c317f670b589de5b14045b28f5a83139a7616bf47b03a8ff733ac4f9c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772956, "uuid": "c890be50-7e34-46bf-92f1-47faae8e67f3", "value": "T1ABB25C936FFC0162FAFE4F3098F205432E76BFC72862D26F9840504E4AA67A15D11B79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772956, "uuid": "6aee8aa6-aaab-4d8d-b2a4-8ff0c431c2d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772956, "uuid": "32ea9898-d495-4467-93ba-0687f6d3f3e3", "value": "384:86gVSL7jj+wmjjturFnOinkuDZxHafHJqsW76PthUuq4SDZp5KmMwUaym/B99R:VBj+dtkznkUUpqhytuOSlpIRwLyKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783772956, "uuid": "d35d876f-bcf3-4818-9823-164055e5cada", "value": 24432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783772956, "uuid": "59370521-62fd-4db6-958b-7cd8d2b33042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783772956, "uuid": "d39c44d2-2560-4637-b6d4-6109530f8d50", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecaf053c-7d09-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783761700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761700, "uuid": "590a6ed7-26bf-4085-a59e-e1e76726ae05", "comment": "Malware payload (Vidar)", "value": "a970f089f620d06331cc0769112ba547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761700, "uuid": "523d79b7-8fa1-42e7-b693-43c7fe857222", "comment": "Malware payload (Vidar)", "value": "9e6f233db42b1775a3102d3ae3c8f2562cb307ce8171242156e6dd4cb8470c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761700, "uuid": "f30491e9-8395-44ff-bfb3-1e1ae7a92849", "comment": "Malware payload (Vidar)", "value": "2bbd04216c7b2191b27cb2f7d8d3951fc8debb07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761700, "uuid": "fba6f0ce-d968-46b9-86c6-9e32dadc8195", "comment": "Malware payload (Vidar)", "value": "c1de03b3ce49950d560ded1c544c96afe3e0c86660dd8bfce72ecd55a8910bb7ed16ffce6ab9d7ed445d4b38d66b48eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761700, "uuid": "a213076b-8e09-4cec-b302-d3e57b8b38d3", "value": "T142E59C07BCD059EAC4AAA33189B255927B75BC195F3273D72E9077382E727C06C79B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761700, "uuid": "eff39044-499c-4538-985e-bd4cc6484afd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761700, "uuid": "eb0b106f-4003-4742-a5d7-0dd7a65a1d5d", "value": "49152:4+IIHkry0FUvffRQ0pdzRuXGRDQnOLKPd7ykR:4+IxUfi0/z/DQnYKVekR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783761700, "uuid": "5de3f507-0a15-40f6-bf86-1d98351b06e4", "value": 3282296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783761700, "uuid": "7070afb9-a4b1-41fd-9763-18e05ca79c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761700, "uuid": "8ca643cf-8818-4320-8274-3d1458bdb45c", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c380a431-7d0b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783762490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762490, "uuid": "fe7deba8-d434-4b49-b9ba-24449eeaf101", "comment": "Malware payload (Mirai)", "value": "b5facac8162aab8bb4605daec83bcc9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762490, "uuid": "8db325f4-2414-457a-831f-e3edf828ba7b", "comment": "Malware payload (Mirai)", "value": "9ee21f3dc391aa3f0dbc955e08d264618d5409a65e3aabe8693978c918dca71c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762490, "uuid": "704c58d1-6c47-4ac6-9229-0307013a7314", "comment": "Malware payload (Mirai)", "value": "649b6820e172bbe9d14d09142172a1766328a976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762490, "uuid": "0ce1e0b3-d228-4281-b57b-98b79e45d7d3", "comment": "Malware payload (Mirai)", "value": "62831ec96645188fe674626805020e722a6f5f36768c5a07fa0eb689e7b5165f6311a3101c389b4530e1f30ec5aaa00b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762490, "uuid": "0475799b-09df-4289-b6fa-2a04436e8004", "value": "T1AEE4C70B6E228F7DF674873147F70A24ABAD33D617E1D581D1ADC5142F2028E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762490, "uuid": "a28d0c50-6c6e-4251-b655-f2901c2f5c84", "value": "6144:/B4Vd3SfD7BTTOzOtVfi7SD9eRYGpzddaqTatdJ85c8PIFJ3NLNBAwZEBXsvITn+:J4HSJjbfi5YHETnqgiiqnmI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762490, "uuid": "a1c82c8a-aa06-4321-9df8-ee5067c50081", "value": 658676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762490, "uuid": "dcf66c5e-fe55-4faf-aa00-4e3252867dd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762490, "uuid": "568823ca-e45c-43e5-8096-706d81c28987", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaed9d54-7cf0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783750960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750960, "uuid": "6e51b861-fba8-47dc-a633-df0feb59c7f2", "comment": "Malware payload (Mirai)", "value": "3937a27d937abda62415865e5258cb69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750960, "uuid": "9133a35d-6771-4b52-89b8-14e1b24b3b9c", "comment": "Malware payload (Mirai)", "value": "9f44bf644db7bdaee5ffdbe66b5db29861fe10aa39ce3ed1738b1bc15a5ce6da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750960, "uuid": "31b5f904-f9b8-4a46-9881-42299ef2ead1", "comment": "Malware payload (Mirai)", "value": "103f4f3a8e4394a0dd805764834f6a82ef331877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750960, "uuid": "9fd4f47b-7137-4f2c-a164-de848d09e60b", "comment": "Malware payload (Mirai)", "value": "12463eca06088cfc9da95084fa39fe22706cb9db713331651548a755f4b4ae8f040433325c3294ae72f05a36fd84833e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750960, "uuid": "5c5a03ff-555e-4719-b72e-163b388a5623", "value": "T192B3A61A7E219F7EF36CC2384BB74E25935823C627E0D6C5E25CD9001E6438DA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750960, "uuid": "809806c6-3917-4f6d-94a5-bae2bf71aed5", "value": "3072:HCZSGLt5205MWFxdZyW//38r1FEz657R6dLl8wyZ:HCZSGLWWFxdZ73MEz65FYMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783750960, "uuid": "164d460b-9c4f-4967-b00d-a0791df4556a", "value": 109488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783750960, "uuid": "10ff81ef-69fc-47fd-b02e-f065de4c781b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750960, "uuid": "3b7c74ba-a31c-4d11-a648-ee211b08b960", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b74369-7d53-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783793317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793317, "uuid": "f72683a7-88a9-40a8-9551-86376683db13", "comment": "Malware payload (Mirai)", "value": "0d14e82f215b932797d47d588051bae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793317, "uuid": "46dac52f-6155-4f9a-8c39-10fde26d20ab", "comment": "Malware payload (Mirai)", "value": "9f66434f98f3fa3e9c36ca3c8e1bf7beb295f567acc70b04e120cf94d182043a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793317, "uuid": "952d8e03-3b31-441c-8efb-6b0e2c56fe2d", "comment": "Malware payload (Mirai)", "value": "13e42577f373beb4d78b06ea4345b36d546a86a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793317, "uuid": "7daaa0b0-0f7d-4ec9-85e3-6a654ffadfe8", "comment": "Malware payload (Mirai)", "value": "53f060ba5856128bac4a6f6649ce8b8481b541ecd8d57ef9b9f598c9b5550665b79bed0406483648a3302f0a0a51c7f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793317, "uuid": "2714d37b-fcda-4480-a9a0-a647e878a0bb", "value": "T14A934922FDB5193BC8C4A47721F34335F2F6478A24A88A1F7D610E8DAF2565032A76F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793317, "uuid": "841fd610-33ab-435b-9051-76b0e319d14f", "value": "1536:04nhLuA9FcStUTb4msamvcfIn7u+twZ0o95rTjpQg+xtsucr:dJfQeeGoPrTFRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793317, "uuid": "43e7ec14-a4eb-43d9-8c6e-bc3da0c1bca9", "value": 97312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793317, "uuid": "29811e64-c908-4612-9535-a45dfbbf7ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793317, "uuid": "4dded836-a139-4ba0-8c7d-882d96f32390", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9908c286-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783752970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752970, "uuid": "e43855d8-fd71-48b1-b936-49aab7101d30", "comment": "Malware payload (RemcosRAT)", "value": "064ae97c3322efca0e17ee7535e4d1d2", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752970, "uuid": "64d8ca00-adb6-4153-915b-aeffa55da532", "comment": "Malware payload (RemcosRAT)", "value": "9f77d4cebed0e040f9379bc539c17ceb291b44ab26725f1c1220ec46889f08cf", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752970, "uuid": "43dd3d8a-cdd6-4a91-af53-a5d0daddcfed", "comment": "Malware payload (RemcosRAT)", "value": "4bb56284dbc3e48c8cfa397b041fa2097d0000a9", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752970, "uuid": "babd07c5-7d1b-4967-9d32-fe82f446673a", "comment": "Malware payload (RemcosRAT)", "value": "df7710be0d69940b497cf0ea655b657c66168318a8f661e9e155170b445ff3c4c5a8cc928b35d3ef11205bd3712919bd", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752970, "uuid": "e97e2e82-df35-4be7-8803-2d614b2849e8", "value": "T1E1F42325FCE0D73BC26A883459D88B7B521CFC299B93A19B3281F30E077C7B551E2965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752970, "uuid": "e15be898-97ee-41b1-8307-d34b2603eed9", "value": "12288:i+32cSsLHMSCiAaLflE/MQUW4ptNy0xnK1zKaKlCFs0HyIH+WC6VL08:iNcSsIFiLLflEBputK1zKRlKNy+dPVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752970, "uuid": "c8abfd3f-d835-4685-bdd7-2c4f2ef91c25", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752970, "uuid": "4e9b74cb-1c88-4df1-b418-dbaf4cd800d7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752970, "uuid": "a86e8379-c9b6-4c59-a9b6-efdb224a2364", "value": "NoSF5134639740363.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8bd04d-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753486, "uuid": "da1fb62d-c38b-49bd-8320-1ddbb01c2e6c", "comment": "Malware payload (Formbook)", "value": "82fc9836e019a240b74082fee37f11ec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753486, "uuid": "85ee718a-fec0-4ccb-9703-cf35d34883e1", "comment": "Malware payload (Formbook)", "value": "9fcc1b3092a9dbbd94e71c3f0413f29fe862496b5c42268ad8679267d4de580c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753486, "uuid": "94f117ce-aa80-4cb1-824a-dd01d5b9043f", "comment": "Malware payload (Formbook)", "value": "5b85a2b6a384abf48cb989bc67f20465f83ae50a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753486, "uuid": "a2570781-e256-4bb9-8183-26977b73bff7", "comment": "Malware payload (Formbook)", "value": "be3de7b0c9eff84577327dd40ccfb7b765c9fb37f6689646b7757d2017cd1af6b8b5c7d88dbe7d132959434e6c73588d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753486, "uuid": "221e402c-9153-44cd-a3da-cdec406674ff", "value": "T139A5F1105FC42F6FC69C5A18E07F2A5EF3E0068A51666CCAEF737D49AFAA70052171B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753486, "uuid": "7c78a72f-fac7-400f-a5c4-2a6a2db81354", "value": "24576:bcoA1wcsbL9ZVaRL2otqf40r6aJTwdzd85TJpU9olDXhAt9zoed0COyUKwmiDCUR:bpr9TotqUaFyzdRXiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753486, "uuid": "dbe8590a-f659-46d0-9dc5-29d1a121b45c", "value": 2139868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753486, "uuid": "8f4948a9-752e-4df7-b654-ce3bf461b7c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753486, "uuid": "5c030921-84ab-4878-9150-c30500ab2ff5", "value": "comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f68ebe-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753444, "uuid": "8bb7a648-b129-478b-8aeb-3b852d716ca3", "comment": "Malware payload (RemcosRAT)", "value": "6598db8dfe375f4bef291365fa81e421", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753444, "uuid": "e756270b-72e4-47a6-9d70-12562ddc558d", "comment": "Malware payload (RemcosRAT)", "value": "9ff18f1e02141c1ef02b3ae37c4d7d8508de00bf633c5a3fdc9a3ec0503e4e69", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753444, "uuid": "6597b002-8952-4161-847c-e3b07e039c00", "comment": "Malware payload (RemcosRAT)", "value": "db2c6816691c760808969c8f02cdd2944b794703", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753444, "uuid": "117abf3e-2e96-4cf7-93b5-45680de8dbfc", "comment": "Malware payload (RemcosRAT)", "value": "b91ad67b9de84295d0734b4f7e06635310088f0382fb28acefd1d7271a9cfb84b54c167fcc5cf652869ce595c30f763f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753444, "uuid": "1c0ff637-e93f-4527-b98f-cb781920fc57", "value": "T1E164EFB7C5656C760EAC0258105D7FA2FCE85BDF806870A6743C64DEBFB42E2686C1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753444, "uuid": "00b0cb37-9d13-479e-8e03-94820c9f5f06", "value": "6144:qBr/4/lTGmmjiYWZ+YSd1D/kwhRvGKv4O7IZ4jHLMH2:Y/qlTGjWzANPFWKy7H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753444, "uuid": "e7926d46-d811-44c2-ad62-3efe3b163ce8", "value": 313768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753444, "uuid": "979cf3eb-f515-446e-832d-f03ee454227a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753444, "uuid": "b02172ce-765d-4485-bf0a-6ee2d20f8359", "value": "loader_b6182984655567f1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cc793c-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753496, "uuid": "b137ff3d-8f8d-4f9d-916f-f83ce0605cbe", "comment": "Malware payload (AgentTesla)", "value": "6415f58e145bcda6698b5995efb31bbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753496, "uuid": "d7461e73-c8cd-4f0e-a045-c35bb5d32d91", "comment": "Malware payload (AgentTesla)", "value": "a01716c2c7ea5cb234ee8b5b3b831b63274fbee0b76d8ee5d86a788c6caa26e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753496, "uuid": "92906387-0d56-45f9-b1fd-638524704169", "comment": "Malware payload (AgentTesla)", "value": "e9d322532356aef1e87bab35faf9195b54f24adf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753496, "uuid": "ac99f15e-3b69-491d-b3cc-2d2ad221547b", "comment": "Malware payload (AgentTesla)", "value": "1bcdf5aab035028feb5af77006f65cd3f211ef28179df7eda73b5f0921b0a6ec6b0631d04274fb7b7383f2a8eae467eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753496, "uuid": "25122a79-234b-4a45-83e3-9f19ae7fdcf5", "value": "T18165F2105FC42F6E8A9C5639E07F266DF3F10A8911676CCAFB227D09EFAA30056135B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753496, "uuid": "5a682125-d22f-4374-a479-2fbccc871935", "value": "24576:11Y90VXpvUkhtAarKMsUtuhG+nNDXiPRdffdiDhvQJ7GiyrjR:s90VXmIt9s9hRNO8dvQyr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753496, "uuid": "68e03354-c911-4852-80fd-205c5ee35e43", "value": 1497212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753496, "uuid": "3fff2fd1-94d4-49ca-b63d-c89e4686ad7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753496, "uuid": "134bf157-68cd-4966-aa96-b82513c21a91", "value": "Vessel Details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1b41d8-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753460, "uuid": "9b83a01b-d467-44ca-85e3-2086adf043c2", "comment": "Malware payload (RemcosRAT)", "value": "d503fa63b86fed7f2df23d331b1f7f7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753460, "uuid": "b7d74309-7601-4844-8d9c-0c9dbf83402a", "comment": "Malware payload (RemcosRAT)", "value": "a1391c592b986457334a361609a952d930182d892a7dd68ab17e6ea18fa4faf2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753460, "uuid": "b2609743-cb11-4933-a82b-86dc51b7cfc4", "comment": "Malware payload (RemcosRAT)", "value": "b0201aee800364f565a7be0c229f9c36d43dc6d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753460, "uuid": "cd694580-986e-4f74-a8bc-be01742e3494", "comment": "Malware payload (RemcosRAT)", "value": "1517b8b02fa65495b79fe542139964ea28c1b2697e74b243c5c1676bb510636671245faebabaf8dc3baca50766b6bd26", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753460, "uuid": "f0094352-4502-4245-a48c-9e77fa8a068f", "value": "T131A50283E47613BA3E35F41A98C1A20B6D1D009069F77E1B715AD7C645224ADB2EFE33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753460, "uuid": "be07b64f-fcab-467c-8b90-a14bb3e7c5cd", "value": "96:eFs2qWDZdJGX3l1jdnOfOIJVNPjGRE++474M/nqWi40l4PqRdgikjR2v2hWO+xYf:kj4Cm/E8eDdgnF4hAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753460, "uuid": "8e7c9607-3db5-4d85-8d2e-c39283c93da9", "value": 2204495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753460, "uuid": "dcd54177-97ea-4f53-9737-6694a28f85a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753460, "uuid": "17711097-0411-4e52-b009-a562dbe3413a", "value": "IMG-20260710-WA0007.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70126823-7d1d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783770081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770081, "uuid": "ad041b7d-a60f-4660-b965-9b7c83965bb8", "comment": "Malware payload (CoinMiner)", "value": "100f7253e0f031a98e1db996379cfc71", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770081, "uuid": "a6a96571-a616-4728-8f2e-6376da8c3eb9", "comment": "Malware payload (CoinMiner)", "value": "a1a89529c78a5f99f0460a3f834feca616a8d5d57a8255ed4ffbb9b0fbc9a75a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770081, "uuid": "66279349-348e-4752-84d0-fde1011347a1", "comment": "Malware payload (CoinMiner)", "value": "424ef80d87eadb3f8ac9751906ff52569c81b81d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770081, "uuid": "8183ed79-aeef-4ce2-8583-6ac298a0dc25", "comment": "Malware payload (CoinMiner)", "value": "93c3a10d6a1d988a4b9406c32649f7df0cef0fe25f14a8940a3733cc96ddc6fe831a4506c55f6a961381381e499674e8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770081, "uuid": "412f0547-3307-4a41-b183-e4397eb2cad5", "value": "T10522C41E6E4B0322DD5109B0F6B54A48517D5EE33786FEDBE632C5CB4AD6E4080C26AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770081, "uuid": "c01f1c37-5e1f-426b-93eb-4a2433aded88", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770081, "uuid": "68f99b83-b288-4758-ad55-4407a0d9fdcf", "value": "192:/WoVW0yS5Bg3zxSHO8V/A65PFJxTEZmFhqKcq:eoLW3zsuUA65PFwZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783770081, "uuid": "2f76d5eb-6f17-4bd6-9d24-87e7db839406", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783770081, "uuid": "0b418734-2f08-4132-b8e6-088728c83923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770081, "uuid": "e50f6b01-47d2-4201-9d32-b54ac187e7cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4542d11-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783753418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753418, "uuid": "d74d9913-8b87-4327-8a93-a5a7beade8c4", "comment": "Malware payload (MassLogger)", "value": "26bca5134794565ac358c39dc537a645", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753418, "uuid": "e5d6ec84-58f3-4e04-8fc4-93a2362b5adc", "comment": "Malware payload (MassLogger)", "value": "a2aec5b02b8cb753dbf88fbc8750c457d964fe3c275c6ce18daa10b91ed152b4", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753418, "uuid": "6ed45c4d-dd02-4287-8416-8ed47b9ff50a", "comment": "Malware payload (MassLogger)", "value": "efd70005936cc13a746a69e93156d169f22faf78", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753418, "uuid": "69521fd5-9491-4102-b826-7ca71bc05c0a", "comment": "Malware payload (MassLogger)", "value": "61ba899a15f15481ec16f40df9b4741db090a74bfdb7cec36e575506db54a64bf8ac241cface087721af377e511c2840", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753418, "uuid": "b3e6f144-33d5-42e0-8679-756d02c29cbc", "value": "T1D3E286C963CE61F597056C497F8CE75785DA12E9227313E32048D9CEA231FDC94EAB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753418, "uuid": "f07b7d99-048b-4a2f-b843-d645a7b24abb", "value": "96:VTpGamyZJkiOsIKodqmTM4QZqdWfCj1wZk3gDYnWsld+qhescU1:FpsyKKoUcZ3WK5vnWOsqIscu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753418, "uuid": "f891b9d5-500e-4585-b336-f64c33512f43", "value": 33945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753418, "uuid": "6c94cdd5-a651-4358-9b4a-fd8c83c84571", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753418, "uuid": "34199239-2624-4157-8938-581ab4ab9520", "value": "e-dekont.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0cb380-7d3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783784655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784655, "uuid": "00a0d450-0c39-4976-ada5-dcf81ba489ba", "comment": "Malware payload (Mirai)", "value": "7cdb39ad52de23dd567438d33e5aeb33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784655, "uuid": "07467130-b840-4811-8a92-369672360ed8", "comment": "Malware payload (Mirai)", "value": "a39223fd91d08e2012c9ae409e24cb91941f4d000f69c8b2261f0c80a90de4af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784655, "uuid": "6ffe2841-db49-4f7e-8beb-b49093e07ef9", "comment": "Malware payload (Mirai)", "value": "f41b627e210389d99cc3f0738271a3801923195d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784655, "uuid": "4ab7be66-5484-4ae2-9b85-ac42b80dcf9d", "comment": "Malware payload (Mirai)", "value": "9013bf26e03bd50aee18e206f5763f8a74f0f89c7ab37acbdf9fa3a059da2db6048d561a3fe6d9793c23d3b29a9c0191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784655, "uuid": "7bda6d85-1df4-473d-96cc-a6a10255bb38", "value": "T14FF38D33D8396F98D268D8B0B0318F792B93957581435F6AA577C6B58083E8DF9053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784655, "uuid": "eba6f79c-f2e0-476e-839f-b100c94a905c", "value": "3072:UHxZU+o6DLcDC9RMemrGEyeIDWoHfeszv/:UHRLcW9RMemaJSoGs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783784655, "uuid": "d8e2fe8b-fb08-4092-a16f-0ac63190d88a", "value": 162788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783784655, "uuid": "ca76c878-b717-47c9-8339-d262166b9fe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784655, "uuid": "bc889df0-2705-461e-96f8-a61604f2cfbb", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7add498-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783753531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753531, "uuid": "b952ced5-05fd-4af8-9c87-927292bc6a67", "comment": "Malware payload (AsyncRAT)", "value": "f624792f6489e042d4a4bdcb55609c3f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753531, "uuid": "aaa47492-1ef8-4734-8b2e-eb173149c288", "comment": "Malware payload (AsyncRAT)", "value": "a3d3e88ab510a5bd56a1065805afb82293dc304ee7173f043aa6c7d41c908b3c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753531, "uuid": "e1905a36-0f65-4310-accf-6ea65c81a30d", "comment": "Malware payload (AsyncRAT)", "value": "7ecf71bcb6a0ef5e9bdde2f991402282f9a0b203", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753531, "uuid": "088724e0-c51a-4336-a760-73972b13f9ac", "comment": "Malware payload (AsyncRAT)", "value": "cdff48b5eb86d3b689c7d25499d34ca46371cbcbc07472c286e95be07a097a4c98576cc8fc0204b407fa26aa276158ad", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753531, "uuid": "5603755c-0ccb-4a95-8ea1-89867cc5485f", "value": "T1E6B4AE0127C1FC9887DA5F3E612F70F9F1DA48E92689584AE711FC84FAE6305F9A2174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753531, "uuid": "f6e8c8a6-4491-42a5-a31e-e8760def67fd", "value": "6144:aSqBdU74ySYK6bJdp6cIJtAIJxM/xL8zGLGl3YcgnJq0BqOyqZKQ8vwmOExIy7WS:ab0XHK678cSK/2JYcwJqUqOy9ldwXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753531, "uuid": "f597b0cd-3212-4d90-8feb-bd0a12b47d26", "value": 530257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753531, "uuid": "0cb9bd23-08b3-40bb-b9bb-57a57fb4ddda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753531, "uuid": "80565db0-0f9a-474f-b6f2-ed334bbe4352", "value": "HG98763456789000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9028fdb4-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783767128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767128, "uuid": "531d5eed-5c82-4db7-a851-977d6a2c3447", "comment": "Malware payload", "value": "74537c95e295243f30cf1f184c55cb55", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767128, "uuid": "81e0d1d8-b61f-462d-ad92-c672d93f5b1b", "comment": "Malware payload", "value": "a404cfc5193b84595df118b9f60bd9fc487764e7bb13f3f88d20c680aada1639", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767128, "uuid": "026be215-9e75-43e3-b85b-f4a09ce9a525", "comment": "Malware payload", "value": "961df1562f4052c4298435d24e7b26d8152e2902", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767128, "uuid": "852410f1-6a45-47f1-ac25-07a2229653d3", "comment": "Malware payload", "value": "28c78998dbf645c1efcb9e92f575d22d500dda255d03b12d6a7fbb2633f42ddbb19f64f5d2d860adf46e9932031e1088", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767128, "uuid": "42f6502e-23b6-4982-9fe0-855ee0a0eb1f", "value": "T161E6331876E512BDEA33403CAAB116F1E1B4B8B91F72C9AF479843921D172B04D3977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767128, "uuid": "de51a67a-401e-49d6-ac40-cd7e2d3d02e3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767128, "uuid": "391d8729-b600-4fdc-9116-4eece6c5bf00", "value": "393216:WfMCgl4jN4rMPn4Y7uHvncVBOXMCHWUjX3cuI3/PGTAI:WEQ/nVCHv2oXMb8XMH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783767128, "uuid": "4a4f14d4-6754-4f92-a462-c6edb93ad10e", "value": 14288413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783767128, "uuid": "f2f346d6-734d-49e2-b18d-96cc98e41002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767128, "uuid": "65162e84-0fbd-4b37-a18c-aa254fedf850", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5253a6b-7d70-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783805845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783805845, "uuid": "80303624-e4cd-4cf6-8a1b-7bf62a68f5cc", "comment": "Malware payload (Mirai)", "value": "bec742f1a98e38d189e7a39c48430012", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783805845, "uuid": "79613c2b-21d9-4fc6-919a-45d9388f46ff", "comment": "Malware payload (Mirai)", "value": "a4a332b84be4855c71f6fec63b61e9b3703082b25547002140bc66e082e817e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783805845, "uuid": "f9819ffa-e4b0-4c09-877b-abccf8e5f969", "comment": "Malware payload (Mirai)", "value": "d7affa513f61beefc546324dbc817b561d554ad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783805845, "uuid": "4db72fbd-d007-4637-87be-7cc5860956e3", "comment": "Malware payload (Mirai)", "value": "2e10e95a1a0c67586b42bbfd754853fbaf12180a9a1761d7eee8b53d72f1e16d7ba5b8796a99c01cbeceda2d381f4d64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783805845, "uuid": "256871fd-febd-43f9-9197-bde58e06398e", "value": "T1D4A2D0409E9043D6CDC4BCBA1E8C6731E2BAAB80BEA6D43143D5C1A9D776D51DE32254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783805845, "uuid": "31f07454-b396-483d-840c-bee6317eaae7", "value": "384:GaiAgXHo4zkejSudOylMns6PmUipfaES8TR057HUkOeZHoc4wLO:GfI4zlmuIruFUZ+47HU49oc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783805845, "uuid": "7f4c9392-bdda-4644-b104-cbd4fba20d95", "value": 22848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783805845, "uuid": "6f402c15-0bf6-41e0-b5d6-5073ad017007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783805845, "uuid": "09604b7e-cc73-4005-8646-83df3967bae1", "value": "a4a332b84be4855c71f6fec63b61e9b3703082b25547002140bc66e082e817e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0aa4e2-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753458, "uuid": "3d998c29-40f6-480c-a53d-10a8d5b003dc", "comment": "Malware payload (Formbook)", "value": "4b161d52bd916d0da464c57f84e01af5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753458, "uuid": "a635011e-1160-435b-b16f-e94f2a53568a", "comment": "Malware payload (Formbook)", "value": "a4cae0413b829864dfb0b2a940ad5fe044fb5ff74a4466d206ffa9f871f1c6db", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753458, "uuid": "b28bbcb9-896e-4371-93bc-e4741cdddb88", "comment": "Malware payload (Formbook)", "value": "30926b33db0ecae533afcccdb7d7b4c5d1bcda1c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753458, "uuid": "b1089981-ecf3-472e-a86e-af66ba715d09", "comment": "Malware payload (Formbook)", "value": "a5570e72a25cf6a56b911f1b043707532029d711247ee63f4e230a75a66218574b010abd1d8c73ceec9209d3d0817736", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753458, "uuid": "cabc1b88-3d87-471a-8aaa-6ecc00f5112d", "value": "T197B2936AC9962478CF253788985B0D2254F8C50B8B63DBA77369C35827015A8F37E37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753458, "uuid": "02528633-d3d8-4956-850e-143bbcacf830", "value": "384:iXMQen7oZO/IK4/xr/+VCKUULgLV9T5xBzplwSAAFrYqR0O:77oC+/8VHU2QV4SAAF90O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753458, "uuid": "56f0f07d-a1f8-4c46-a4c4-90c273e00517", "value": 25573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753458, "uuid": "f4cccc56-d4d9-4f05-893b-f6aa17128fc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753458, "uuid": "d17808d7-a679-4f90-bebe-43f0ce7e291b", "value": "Pjokkeness.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96aaf8dd-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783752966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752966, "uuid": "915186b2-32ec-4a3f-9df7-3899deb6ef16", "comment": "Malware payload", "value": "16f839e7dda5f455366bee10dcd815c7", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752966, "uuid": "6c7710a7-5538-43a2-b9ab-4b0cc7f15c1e", "comment": "Malware payload", "value": "a58908b19f601e5dd1253346a2dac1ca24d266278e5b2d25fc22398e023268d4", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752966, "uuid": "aebea24f-395b-471f-8079-1adb078a95dd", "comment": "Malware payload", "value": "58a7ceb3186f2dfd62c46cedac5f7b1ade677441", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752966, "uuid": "5d9175d4-bfde-4b4d-9001-c3a343813dfd", "comment": "Malware payload", "value": "831f432f304e0be8cbcf745947ab9c316b74d76df818cc58713e2d0167a60dd3015a0af3b7d05c02cfbad63ebf96911f", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752966, "uuid": "98a2f29f-72d4-41c8-bf65-2f21ef1dd369", "value": "T1B3F42326F3D8EE17C5BAA47519DD826B848C3CA43F105363B086F75D2D30BF65198EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752966, "uuid": "bea90bda-e458-4ab9-a71c-8b3a927e1af0", "value": "12288:q+32U/Uz2OXuZfoeh/2fMDLHn2kQWOlB0fuYQdwHlC7BKif+Oqk:qNU/Uz2mCfoeRBDr2kFYB0WYQKFClKS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752966, "uuid": "52a55fa7-61f0-4e04-93de-3f35a6db24e3", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752966, "uuid": "14816cc8-2682-489a-9e73-7ac45db14053", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752966, "uuid": "1ba680b0-bc4c-4d47-94fd-d7ba5001bed4", "value": "DC12A1DBK0051P).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3322900a-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783293, "uuid": "4b137cf2-6665-45cf-ad97-102c2a0d4c67", "comment": "Malware payload (Mirai)", "value": "dc6f7d9a4b97af5c268853e12a68f744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783293, "uuid": "df79013a-818b-483d-8d7d-26e659669863", "comment": "Malware payload (Mirai)", "value": "a5e1e01bb88ba6e7e9adc99398cd9937e42e612e10d0843542703dbdf758e3f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783293, "uuid": "e074fbc2-ecd9-4391-b231-272883173800", "comment": "Malware payload (Mirai)", "value": "f030a8333a54bf03bd72e63b3e2479629d7c5b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783293, "uuid": "3ddaab4f-e4c9-4a4b-878b-095807fc10a0", "comment": "Malware payload (Mirai)", "value": "05cd75ecf3a8de68f1034a9b2f2a3f36f428afffb0465e2add2e96f2477c5ce3aa2547887c1b2697f44a76d75cbd1243", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783293, "uuid": "46cb6624-3170-4afa-81e1-ef898414fe07", "value": "T14C839C23C93A1E68D84845F0B0A08FB55763E215C1572EF7595ACA3D9083EDCF6863F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783293, "uuid": "30c90e0a-d5f3-4c25-8a5a-640ddee996cf", "value": "1536:4nxqxK8a8blOdCKs2C11KlVzkw4k8U9CGN+wOHyroFn:4xqx5sdfrC2vd8U9H1RoFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783293, "uuid": "4ee837be-8cfc-496a-96a8-d55fdbec9c1e", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783293, "uuid": "384a063c-c559-4d46-8b8d-80f3dd9f5bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783293, "uuid": "b84e3af7-7d15-4bb3-99a9-c7c021446b29", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d946545-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788813, "uuid": "78a2f3d4-f26d-46df-999b-7db4eab9513d", "comment": "Malware payload (Mirai)", "value": "81c56cef4efc722e2e9864412c79d04a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788813, "uuid": "ddcf01c1-febf-4a11-a774-878cf14b112a", "comment": "Malware payload (Mirai)", "value": "a69d189f06bc78e50496b7247deb5cb41569aec1c949481c2ac55a202cb1c947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788813, "uuid": "b773b6eb-3009-4f69-8cda-3a2e1a63aa09", "comment": "Malware payload (Mirai)", "value": "9c60e50b133f3f57d013220aff826c1ba43be964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788813, "uuid": "8b17bf19-1e5a-45c1-b0c8-5656d650b128", "comment": "Malware payload (Mirai)", "value": "6c9220474fed21a6bb2bbee803d23694cd887599bcd2c782dfb15553faa2205930abdc2722beaa11f4091226161fc1e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788813, "uuid": "472f96fa-521f-44a9-a5e8-fb062905a034", "value": "T127535BC1AA87E8F7F91602752177E7378636F4361129DAC7C7A4EC32AC52901EA2735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788813, "uuid": "8ede8028-af4d-416c-a5cf-d418d978bb45", "value": "1536:5xCTpF8kbRKPrW96GsAifPnc+L4LOWDRhGlegZLh+GvvtUmLXjWK:5xAv8kbRKSxfiN4SyhSe+9tRWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788813, "uuid": "ee58f5ae-bbc3-441e-8ebb-99c3648b0e01", "value": 62992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788813, "uuid": "f0e15270-9114-48b9-b536-f37ac4131796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788813, "uuid": "9c37b87f-6851-4f3d-a24c-b780d333508f", "value": "XDx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43a79ba-7d58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783795509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795509, "uuid": "14437bbe-2a52-42e7-9390-6ab20df7f576", "comment": "Malware payload (NetSupport)", "value": "0ae0f719d08a68c58763c89c332ebbc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795509, "uuid": "34af442c-57c0-473b-8bbe-8d0d23c11acf", "comment": "Malware payload (NetSupport)", "value": "a7475b46ac26987a5d9a6c7aca0cbae6ce2559ac0d4957743f38ce9ef70e4f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795509, "uuid": "8067bc01-b015-48fa-b180-98e8e6520090", "comment": "Malware payload (NetSupport)", "value": "8a0b0fc342dc1aac244262e34eac2deddf75bd97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795509, "uuid": "5d65fde4-b6eb-4c18-b8be-feceba20630d", "comment": "Malware payload (NetSupport)", "value": "1206311d0f5ed98a57c0f3e128ab6ec754c585529d066207ad36b65fc6fd9175bc7dc5c2158b882ae55159de4f2c59d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795509, "uuid": "3359b18e-b915-4c84-bdb4-e8635792a404", "value": "T110363303F1BAE0F6D953D0B995E8B3B5E212F4016D02CBFE2850D5792C6AD42ADF4B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795509, "uuid": "4fbad9d9-c1da-4e97-aa61-5e6cf083f328", "value": "4eab2188a80a18b3611bd2581bbcb919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795509, "uuid": "eb6c5857-fce7-4282-a7de-1e396d16552c", "value": "98304:RfY587MugUTvEQaLhaVmwUry3GeMAUo/IA1krH0M4DPGNVZq:RAq71gUTvwImwsy3rUo99INVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783795509, "uuid": "c7d97f8c-4a21-490d-8777-2fd77a42a8c4", "value": 4989668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783795509, "uuid": "daf69189-0ce0-4d6b-a115-eecfbd1d9b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795509, "uuid": "9cfa6d84-be42-45d0-942f-7a764cd2cf80", "value": "0ae0f719d08a68c58763c89c332ebbc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a4509d-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753469, "uuid": "c8586142-cfd9-4595-b769-4430d7f5e0f3", "comment": "Malware payload (AgentTesla)", "value": "35215786145f32823d1b4026aaf0e441", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753469, "uuid": "21b4e776-a012-4bbe-9ffa-fcbde73652c7", "comment": "Malware payload (AgentTesla)", "value": "a74a948afc694949bf99f9bee9215cc759c082cded0ab1b8f6be345630bfd81e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753469, "uuid": "3d645609-18e4-4e03-8195-5d66bbef0242", "comment": "Malware payload (AgentTesla)", "value": "9cc338e4d9b0797bf9cd21fb664e9467dbad9027", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753469, "uuid": "82b08e1f-fb25-4546-90de-9d9df5f3db65", "comment": "Malware payload (AgentTesla)", "value": "b22e0115543275929ba321fd963afde0c5bf0e0df9348a7abdb6404be33788bc0d00533aa3b45e13444daf136013e87b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753469, "uuid": "bb6f96f4-595e-4644-b672-9a33a877ec39", "value": "T1D365F1105BC46FAA8AAC1618D0BF2A5DF3F10AC5516778CAFF23BD49DFA670042271B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753469, "uuid": "129549db-d754-47fd-b7db-4451fc588f5f", "value": "24576:jAfEbCu1YAlYdqxbumWFIWxCBDQDqgt0JSEB6bWT4BIohLqMQhCBdt6:k5lbPBxPDn7+okX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753469, "uuid": "7aabee7e-94c0-47aa-a4bc-38bd2226f70a", "value": 1494119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753469, "uuid": "4a04ee3b-95f6-46ff-b1af-b5db07b30080", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753469, "uuid": "ca220328-509c-428e-925e-248afcc2f36a", "value": "Vessel Particulars.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ee377a-7d51-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783792606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792606, "uuid": "d6bc2488-fcf1-4ac1-acfe-211b9c292704", "comment": "Malware payload", "value": "ebfc77bfd190560838e4ba8fa41b82b7", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false }, { "name": "MythJs", "colour": "#A7466F", "exportable": true, "hide_tag": false }, { "name": "MythPrivate", "colour": "#8AA1CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792606, "uuid": "ab623e1f-9304-419c-a804-185d0721e17e", "comment": "Malware payload", "value": "a7d9ed955149f13f510804a3f8cdd123d8135a8b6bb9f37f5cbca43396001fbe", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false }, { "name": "MythJs", "colour": "#A7466F", "exportable": true, "hide_tag": false }, { "name": "MythPrivate", "colour": "#8AA1CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792606, "uuid": "4b5169d9-7264-49e0-a218-ab6ecb2ff87d", "comment": "Malware payload", "value": "0ebc16e5e861f6d2215edd1387c66ed63a221259", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false }, { "name": "MythJs", "colour": "#A7466F", "exportable": true, "hide_tag": false }, { "name": "MythPrivate", "colour": "#8AA1CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792606, "uuid": "8101153a-843e-4a35-a89d-936192d04fe8", "comment": "Malware payload", "value": "082594380e03737838bbf1388f2a23e2f7fc99af7e23de73a08596c60cae626c6f0f5e18ce8022b7c08d274c923bae25", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false }, { "name": "MythJs", "colour": "#A7466F", "exportable": true, "hide_tag": false }, { "name": "MythPrivate", "colour": "#8AA1CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792606, "uuid": "6fe747bb-d372-4281-821d-03ed12543534", "value": "T10961A5583DA6D11ED907427785D6FDE678681F4A5604AA0F28332F580CD0A8F0B0BFCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792606, "uuid": "5fafcefe-de54-449a-99cc-404042fb7038", "value": "48:9coV+mugzcT+H72LcJtcOcTcgtcetcAtc/tcfrSXxjK/TOa9/Q+bY0FPkgA0wJRp:NVJL2itcLT9Q1B+/BJY0GgWRoJxGSgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783792606, "uuid": "c95de9c6-6a80-43bd-ba40-6bdc1bca1049", "value": 3327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783792606, "uuid": "0dfb0d8b-aba8-4e1c-a0a4-a54931652127", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792606, "uuid": "4ff51014-0107-4c2c-8254-7c50ab363852", "value": "SMP-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1177dbb-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783750057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750057, "uuid": "de8e6dc7-33c6-4235-ab99-24e2f1037ce6", "comment": "Malware payload", "value": "b2ea403fb521306b81a3a4dee6b52efa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750057, "uuid": "8cbf3cad-4ace-4439-b62e-95ffa0717252", "comment": "Malware payload", "value": "a9ae957118ea2fe39582d935cdce037504cb343c216a0399260e6183dd3810fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750057, "uuid": "7962e027-27b9-4d2b-b557-67bf72c801a2", "comment": "Malware payload", "value": "a9c61ef8c74f5fbaba50560ba6cbe9c643289823", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750057, "uuid": "b4d7fc66-cd82-4bf7-a601-dd948dc5702f", "comment": "Malware payload", "value": "799aef033892878ead48c7fd473bb3348f67a03587149db1189a9a84d24be25e35d87ed16c52464a7825f68def774a87", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750057, "uuid": "a78f55c7-cabd-4327-8b8e-afbbed0a70a5", "value": "T105C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750057, "uuid": "51345199-b799-4689-b4ef-e81cd5811e06", "value": "768:y8vCB+25j6es8Rd9FYpMSUpi+20qUpi+20YQX:y8l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783750057, "uuid": "0c368aa0-c8df-4594-bc08-f0dbe2c68c3b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783750057, "uuid": "54c196ea-d7aa-4a5b-a453-2bc4c9646319", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750057, "uuid": "f1612cbb-7ba3-4708-97e4-21c9f127d54e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb988b35-7d05-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783759926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783759926, "uuid": "bd400035-149e-4bff-82e3-a41628c47261", "comment": "Malware payload (Efimer)", "value": "2fe90022a217bfec28e9b8d473994a22", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783759926, "uuid": "271b46ed-487a-46e9-b665-e99f5c52cb11", "comment": "Malware payload (Efimer)", "value": "aa0b300d5142ba5ef02a7b1112a1bdc658217e90b9d4b5e80fd987745ee8e489", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783759926, "uuid": "dc980bb6-1226-4d51-ae2f-e13215437e83", "comment": "Malware payload (Efimer)", "value": "698c1b82f3f464a3595669073dd840ce8eeb51cf", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783759926, "uuid": "602932b8-8c79-4c2f-a53e-857d27c2c19e", "comment": "Malware payload (Efimer)", "value": "1aff68b9ab530850995a194e90e234caaef4ae286ed64904908d87c849a4f40b1ae0e89d9ac6be163eb98a033e6c2c54", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783759926, "uuid": "db70c0c2-a359-4400-a5bc-67bbbbda5517", "value": "T114E63308A6E001EBD673843CDCE22E95F1AAB4A54772CE8F57A047B46D572E01C3DB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783759926, "uuid": "71d136bb-c4ac-4ddb-b0c8-e24d6aaa269e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783759926, "uuid": "5e1247e9-f62f-4672-8706-0bfd2242e528", "value": "393216:Tn3CNJMIyk9z9BFzFx0D5Eu2XMCHWUjX3cuI3/PGTAI:TS3MIyk9JBx092XMb8XMH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783759926, "uuid": "296e71ca-d50f-405c-b615-6aeaadd7365a", "value": 14305106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783759926, "uuid": "d3ccbd68-cf68-450b-90b1-c3c54fe3e19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783759926, "uuid": "4495215b-0701-43ef-86d4-66084988c3f6", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062b4315-7d7e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783811564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783811564, "uuid": "9be41dff-6409-448e-89f5-47d468793072", "comment": "Malware payload", "value": "c7ec7541e757a9de64891c917d9b00a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783811564, "uuid": "60e130bc-292b-4948-82f7-ba5f7a815bc8", "comment": "Malware payload", "value": "aa43f85f89297eb67a66198cb9d16373a9edbbc93503be45674d44ac8149c27a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783811564, "uuid": "3ed264c9-99fc-4e13-9ce5-3705c0912ee6", "comment": "Malware payload", "value": "ad09b2918b5c44ff381ee96dcfef6378f9871eb6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783811564, "uuid": "9f4f3e42-2351-40b6-9ee5-92c92f8d88ab", "comment": "Malware payload", "value": "50a628a474dbc7bdd0f2cc2758e2dd0e8ee73db73e00bdeec9aaccc225078baf6a061aa6de33e0ddcc05d9243f543ae5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783811564, "uuid": "e3d8de49-1c52-4288-8a37-b1175a831fd5", "value": "T11BC27D966A967C44BDC94A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783811564, "uuid": "d2550756-e43a-485d-9670-8ed90b50b759", "value": "768:E8vCB+25j6es8RK9FYpMSUpi+20qUpi+20YQX:E8l25J8d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783811564, "uuid": "cdab4630-8657-4dfd-8d1a-bff7d1002595", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783811564, "uuid": "f94ad30b-1a9c-40e6-8cbf-2b1607007063", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783811564, "uuid": "468cd29d-be56-4f3c-b519-352ec3f505d3", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf530fc-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783283, "uuid": "ef7a065d-0eb4-42d5-833c-0fc02f0e95c2", "comment": "Malware payload (Mirai)", "value": "8be07fc42e883a6cf4dce4aa6b44e169", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783283, "uuid": "7210b8da-d6be-4521-8c46-54285924876e", "comment": "Malware payload (Mirai)", "value": "ad6a2d876975f7051eafee1852d0287de8f792c8d64d5d0ffd41b634d391e195", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783283, "uuid": "22c20d5a-1a9c-49d8-bbf6-3b164220e130", "comment": "Malware payload (Mirai)", "value": "2da5aebc8c34d6c173507395f014e42170eb2d73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783283, "uuid": "269e0adb-03da-47c3-9ea1-2dc3a9a010ec", "comment": "Malware payload (Mirai)", "value": "70db67052cf750164b0e7c38cf15462d23a7a0bdf0f3b31a166f3a7f833873da1a364c27bb626332dbee61c6ef7b2104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783283, "uuid": "2ead1694-feb2-440d-ba3e-8974e0c0df83", "value": "T1BF13E1AC4F2058EFD00DD2F643E467A50DBA8A9DA2A3FC5F4895DA86DD841583803BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783283, "uuid": "ec4dbf36-9a86-4031-bb31-15ce47a2e29e", "value": "768:yXwRVbCpMvUGuAwqrKO668pRM0Pwt6t8iOouhgIESqFtb3Axw1lwJgGlzDpbuR1G:yXwngoKOTyYt+8GmSSqQQlwVJuAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783283, "uuid": "8fdf3ff5-5dfe-4626-ba8d-c723a24bff05", "value": 43928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783283, "uuid": "28400807-59cc-443f-a0dc-5b0c2f3e3b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783283, "uuid": "83fc4ed4-57f1-4619-9a5d-d425560b9a04", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d534a6c-7d18-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783767956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767956, "uuid": "0c901dcd-dd00-4860-888e-b78374adc86a", "comment": "Malware payload (AsyncRAT)", "value": "725e5268a858809158833edcf68694ae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767956, "uuid": "33307470-3a32-49fc-b445-b27525625c2d", "comment": "Malware payload (AsyncRAT)", "value": "ae3811913d691d0327fb5a3dd0ee0c7918bc163fcc7aeda31da319fa7978ec14", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767956, "uuid": "7b2fea3f-a16c-40d0-9aa4-d1403e3d9522", "comment": "Malware payload (AsyncRAT)", "value": "a78272ea4b74406474b658060a794afb0eeb1b8d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767956, "uuid": "0fbac73e-8850-49a1-80da-c48ffccdee91", "comment": "Malware payload (AsyncRAT)", "value": "94b151f8f6b08e68517c7eec475881eb34ea1fd34d88b3c7109f9a276fc0fa8f1b436d521067e04c217709397ec0cd0f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767956, "uuid": "41a13432-b6b6-40cd-a8a2-28be727deef5", "value": "T16454BF1079E1C472E8B3053408F89BB9563DB9610B7199EFE3C40BAE5E303C19E32B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767956, "uuid": "d2ab6e4b-be40-485b-af28-13c1365fef97", "value": "f460f2d982e017c6aaed90e5e56aafe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767956, "uuid": "aa62e395-8903-46e0-8852-499ff6d2f267", "value": "6144:bTCmFSxYsWgsnsTAeH/D8g8yAOc+dDMaPReLMLETV:bWmIYqTRMyWRWReLMLETV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783767956, "uuid": "0b39873f-bc67-4e62-9141-2bf3ea4ea4d1", "value": 283088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783767956, "uuid": "3ebb52c7-be93-4bab-9119-cff4ffe5e62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767956, "uuid": "d47716e6-e8d1-47a7-8536-a068e0813823", "value": "_APPDATA__primer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801eb72d-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753357, "uuid": "c9c73b1c-f038-4fc8-9020-a29ebed1f275", "comment": "Malware payload (XWorm)", "value": "36eaf19718e61208b6c13e2cdd693566", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753357, "uuid": "2298cc8e-8e54-4d9f-be2b-bf4cf13fc8d6", "comment": "Malware payload (XWorm)", "value": "ae5e5ae12ed257ab82efc258dce8da1daaa662159553b8107de78271113300c7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753357, "uuid": "003e62e9-f5d9-45c7-89e8-03b704c3cb39", "comment": "Malware payload (XWorm)", "value": "bede0517bda4b956f062869a5c130cfff7f24b42", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753357, "uuid": "67a15e18-738c-4d65-b6b5-9e8c46257f40", "comment": "Malware payload (XWorm)", "value": "17aae68b24245dae7de770d4655b0693e65eb51800cdbffdefc3099fb1d5f591d3ee32ae6f5b892976efe01de3693ab3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753357, "uuid": "1fa1215c-b74f-43ec-9324-29db07281dfb", "value": "T1F033D30FCCDC357E7A9E888875A5446C21368E8CF42A5C46D8D4A6487F82AF4DEC5E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753357, "uuid": "7e07ae45-f711-4bed-8ae1-c78495c8804f", "value": "96:FzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzkAM+7y6YdTnYXJSTYa1:ujrJeGVBUex1o0wQzn1E20+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753357, "uuid": "9bd781f4-418b-464d-b68b-09db39f7fa1f", "value": 53079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753357, "uuid": "dff922b3-f3b5-4854-80e8-d953ee618fa5", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753357, "uuid": "1572d616-6cd4-4ce1-aaf5-5a10d1875448", "value": "10. 2026_Purchase Order_PARS_4500002352.xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237540cc-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749766, "uuid": "86bc8e32-3018-4e43-868a-6ca66ddb8984", "comment": "Malware payload (Mirai)", "value": "62bea7e64af35c9d68106d16d6d0c2c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749766, "uuid": "eae00bf4-3dfb-4046-90a8-cc06a3106a46", "comment": "Malware payload (Mirai)", "value": "af062bc5584636c98907b1c0b8e8e8632b860b9af789c023284f797303dc7e0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749766, "uuid": "8642c3f4-86b6-4a60-b497-f9c026fd9753", "comment": "Malware payload (Mirai)", "value": "72ca92fedd303156f78f06f51ff8a3146c0d8c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749766, "uuid": "c43e183d-4a27-49d8-85c7-9b65ae826ad8", "comment": "Malware payload (Mirai)", "value": "4993a056825ab735eebc73d3a3746a0ddc35a5803a911ce7859a9bc05486b21de554c2bfcdc883997717c62a0d521310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749766, "uuid": "2d9b88bb-8171-407f-b12d-52761ca99f56", "value": "T1FD33F10C257040FCCA0854F589FB07B01A92CBF7D987E79A6861DA43CA45C2DBBA35F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749766, "uuid": "292f01ea-7100-40d1-a42f-7c9a3126861b", "value": "768:CRJ9gDyNXubkCSpwWbuWjwi9kuqVXycVpIsHOxue4n9TYrFAkvF4bEJFZg1JgGlf:QJdcapSWUi9LqVXD5Hdni6k9U3VJuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749766, "uuid": "1dabd8af-b26d-486c-80a5-4093076ff52d", "value": 50524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749766, "uuid": "552de06a-8d82-4818-a300-e8c876bc7c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749766, "uuid": "57bff25a-d04e-4ac6-b130-76c29771675a", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d33bb9f-7d3b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783782880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782880, "uuid": "48acd81e-4cbc-4c3b-a5ed-83bc499ad5df", "comment": "Malware payload", "value": "e2e8bc7a85da6b42cdff9398fe61fdb9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782880, "uuid": "8e5ada3f-f502-4724-b96c-17f600226266", "comment": "Malware payload", "value": "af3a21a5068bedaf9c5c6c6be8a45915e6d4480227b9c79fb7a55aae6c8cd05f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782880, "uuid": "a40a8e4c-9d36-43f8-a751-69566ff64ec7", "comment": "Malware payload", "value": "e0c4b3dd8c2872b909bf3387de6d57eaa1704a34", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783782880, "uuid": "9699341b-0a9b-436d-9d59-791ec756b1e2", "comment": "Malware payload", "value": "fb050586ceb2d87096c851a11632a7d9fc8e09d2eff6a6c1f50dec08c0eca052e693184124d5a17de221eb89a925caf3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782880, "uuid": "69cd938b-2937-4c35-85ed-44d36dd9a319", "value": "T100C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782880, "uuid": "da7d7dea-4509-4c2d-8328-6139b79ac2ac", "value": "768:H8vCB+25j6es8Rv9FYpMSUpi+20qUpi+20YQX:H8l25J5d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783782880, "uuid": "0b8f6541-3c81-4afd-97d9-318856d958a9", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783782880, "uuid": "413e7d7e-67ad-4820-b517-356eb2af0b6c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783782880, "uuid": "25812cc3-28d4-45ac-98f9-94a2b753b30d", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d730b328-7cec-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783749208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749208, "uuid": "057da187-0059-4baa-836c-9014c2f7a653", "comment": "Malware payload", "value": "92f662d78d380bfe9d31a55eedf40bd8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749208, "uuid": "101eb0fa-9433-4008-bdf4-84dcde7b96eb", "comment": "Malware payload", "value": "b094bfb701b47a66c06c562858c59232a28f61c481936dfeeb45614156f1c754", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749208, "uuid": "18c6cfad-d65d-4ed3-aba2-4be5ca824f58", "comment": "Malware payload", "value": "4e4ceb53e75704d3f23ffaa835176eedff9f0be6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749208, "uuid": "a833e30f-1ea9-4a0e-955b-7b12bc542a97", "comment": "Malware payload", "value": "32885f023b742e47938234cf14c486648f662181c6ef5da7e778c8b470adaba633acfcab2f8ba768fc876e4a4b03d178", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749208, "uuid": "61d6e984-071d-438e-a8f9-7e897dd5ac6c", "value": "T1B4337D6516857C14AA99C8365D7F2F0CBCAD43E6314491EE7FCE3CF28C4AA9CA21861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749208, "uuid": "1c161e95-dd6f-4520-b9ab-5df64b485f06", "value": "768:2Sqr9NyXsZztCgl9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:RUHusZZ2cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749208, "uuid": "0acbfdd7-e78e-47ee-bf55-a58a2a82c324", "value": 50382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749208, "uuid": "724118c0-e202-4744-be60-2ad6496ddcc2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749208, "uuid": "99893093-d996-47b4-880f-c235b4810dc8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba6f422-7d4d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783790609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790609, "uuid": "f0c9f7dc-220e-43d0-b513-5454c69c847d", "comment": "Malware payload (Mirai)", "value": "136e763e7692b70dba5638dd64241615", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790609, "uuid": "0b9729c8-d7b3-42ad-858c-cfdd4fec4338", "comment": "Malware payload (Mirai)", "value": "b0afa6ab7762455ad68d8e368b0e80341df9a4571e73d3165a93a33bbc7b23f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790609, "uuid": "4589d493-20ec-49c5-acd4-4b662f90ca1e", "comment": "Malware payload (Mirai)", "value": "1ddc56bd122d682c0051d02bee80413314464b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790609, "uuid": "fd14fda8-9088-4dab-b0e0-16df3c784f45", "comment": "Malware payload (Mirai)", "value": "852ebaa61aa7aea5ad3c8096a0c0ecc310f10e2195e8db54680dd3b47417e4c63c5adac5f357273d176a09aa9130dc0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790609, "uuid": "986736f4-9f94-4529-897b-3f2e71544afc", "value": "T184633C02B31C0E47C1635DB42A3F17E193AFA99121F4F789651E9B8A9276E321186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790609, "uuid": "862ad091-e1d6-42b8-92ff-3a7524249331", "value": "1536:H83cgtEbm75ZcWY8H84j2cBJlWFm9/8NIK/5DxwyRXLV/nu/:KvDjw8H8U2nNI+87/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783790609, "uuid": "558da38f-6fe1-4b47-a65a-dd6648789e64", "value": 72924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783790609, "uuid": "7387e6c5-4b7b-4d17-9cde-44c6982e969c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790609, "uuid": "cbaa81cf-add0-4d98-8a8d-fa0b52d2cad6", "value": "XDppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926557c4-7cf5-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783752959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752959, "uuid": "68c64aa6-8236-412e-a49b-e4f860373f31", "comment": "Malware payload", "value": "a75c8c78712257593a6ca9693691fcd7", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752959, "uuid": "bc0b6089-bc87-4451-9987-e2c8763e3425", "comment": "Malware payload", "value": "b10768d33d0e90c87a659decb86bffd5a3a64d089e05ce089d48aa4194bafb30", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752959, "uuid": "eb4596bd-725c-4490-9f8b-0b471751917b", "comment": "Malware payload", "value": "8d5ee6a871fc4fd18a02a3eea825e2911296ca5c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783752959, "uuid": "78d97171-4f77-4bf3-a41a-327e225ed90d", "comment": "Malware payload", "value": "3fbaf7e66435b3c506868f9a3a93adee6f21e621909d3e7cf32fa498a4718360a93dab1ea6cad6d0da2f8fafc3d5d5f2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752959, "uuid": "314b97c9-2748-4134-a548-824617c71e61", "value": "T1DE11682036FC6364F2372E39ACB153419E3DB91A8C30D60C8461D50D3C25B61EC25F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752959, "uuid": "aca75d2f-71bc-4e0d-9cef-071a7ad6512f", "value": "12:8ljNokPiqVUkmMU425YArWlof5F4SelvsjUJcVmtf82dtixhSpbdpYrn1Il6:8dRiqfEYAKlIYejUvt3CSVdd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783752959, "uuid": "be20fc50-f63b-4f1f-af7e-a61cec3e027d", "value": 857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783752959, "uuid": "2b31b9f3-0b71-4285-8f52-a43d432f7eee", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783752959, "uuid": "3a05e84e-9e64-4a04-b782-0ca78892ff6b", "value": "Document Cty TNHH Truong Minh023992494350.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a55fa4-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749770, "uuid": "03436e2e-ccc9-4097-a990-2ca89ff2af2a", "comment": "Malware payload (Mirai)", "value": "d14fa2b4a365e55a8573477d861f3df6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749770, "uuid": "4036b22d-9e56-40d8-8c1e-5a3807d2715d", "comment": "Malware payload (Mirai)", "value": "b116db6dfee3dc658ef940f4c58cf5a8b2e987ac77e45b12257132ea53917d66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749770, "uuid": "4269bd98-de75-4a81-aa69-faba2bb46af8", "comment": "Malware payload (Mirai)", "value": "a6f2db4556c3eb584e3b1982de28a927a4345b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749770, "uuid": "d4bb1a67-497a-4c5d-a664-fa6816c13ffa", "comment": "Malware payload (Mirai)", "value": "0d8e0a71349e0ae532dad7e0f2567020ae5381a88f51d868ff81672f4fe7e3bcf0a67f8e9efaf5319a9ab829849e236f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749770, "uuid": "dd851da9-0eb2-4802-8d34-5048e8ca54dd", "value": "T172B3AF32D81568E4C56E4578B9E4BE791B63E08052932EF706F6C6B29057EE4FC06BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749770, "uuid": "f452ea7c-b97d-4f3f-ae60-9f7f172d9186", "value": "1536:V/fNSYcg/lqIj4L6BxWFn8eDKfBPF7Y4K4VCrvRBR9EH3:VnNS7SII0MxNVfHxK4VOPrEH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749770, "uuid": "46d5535a-3062-4c28-8874-262e2f3dfba8", "value": 109804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749770, "uuid": "9a3df098-c314-4081-b60a-5c73f9742fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749770, "uuid": "1d7f10da-57c2-4693-a682-0f83b789ab9a", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0bc725-7d0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783762694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762694, "uuid": "354529dd-26b7-4e24-826d-50a5a5d93cf3", "comment": "Malware payload", "value": "1f3e74f54272a10d1727ee585016f52e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762694, "uuid": "00dfd209-c3ff-4c85-836f-7bdc164b0a5c", "comment": "Malware payload", "value": "b24a400f6f60b05039c096806ac869d9d6db146ac1955733e7ae197edcdac22d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762694, "uuid": "9147ecbb-1d4f-4501-8e69-e50b4eb62a08", "comment": "Malware payload", "value": "72ed48bbe56444721438297a99704808ad155d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762694, "uuid": "a9957f39-d2c0-4b46-8c37-07add3c595b3", "comment": "Malware payload", "value": "da6b44a13ac1cd8a5a1a02db3ff8cb49b39e05076a156eb1a85c1c40c4b5ec8d5ad5f2c0778cd840fd52f32ad0cf8aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762694, "uuid": "5d1ac702-c0df-42ea-a077-191acaf22b5f", "value": "T10EB6E66F22E54168F56A913BC0F38F40D8FF707A372A81DB0250C7FA9AA15C75D7A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762694, "uuid": "dd9bbc6c-a697-473a-8006-c1fb964facc7", "value": "c8dddb2d43dd7ad64cab9cd918876bab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762694, "uuid": "2e799dd0-d1f2-4088-acab-a08c2b8ca5ef", "value": "49152:eATO0GILCbQ6nBQwEeygpI1qSWihTbviZZS4Acs+oeojrpLI2o2dienqZe95ZuVH:VYnTNNLfoeojrdph9LuVHHsfN8RRyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762694, "uuid": "244c8c5e-a035-40c1-b55c-8b7f705c763a", "value": 10983248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762694, "uuid": "35003c7a-fcf1-45ba-a727-5674874eddab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762694, "uuid": "f8418847-da5c-42d3-b3f5-647be87b04bc", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5171429c-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748125, "uuid": "8f23cca9-d824-401c-9131-146a44dee36d", "comment": "Malware payload (Mirai)", "value": "eb724ecf8b2a6f7671f7c3dddd049157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748125, "uuid": "d811b8b5-3139-4799-a14d-acc0fe2e4e12", "comment": "Malware payload (Mirai)", "value": "b326230d8d04b69a557949e38c5616b7dc8c9e4ea6db75037fe50e342e848014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748125, "uuid": "956c5401-b4b8-4415-ad35-638682d8edc6", "comment": "Malware payload (Mirai)", "value": "966fb3503c22d90f5b249bce90153c0a65619858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748125, "uuid": "80729947-4d10-4121-915d-2390ad4d0184", "comment": "Malware payload (Mirai)", "value": "6ee30db9eb5a57fa21ba478da0cfc6b8b2d3e4f0f538eca20e40b631d75d570abc076989d520f61927da615d0ae5ec1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748125, "uuid": "adc60526-cf86-41b2-85f5-f5d435f7aa2e", "value": "T113E3E70AAF600EF7E8ABCD3741F9570924CC655722A83BB57534D528B64B50F4AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748125, "uuid": "9fb57152-7629-437c-9d21-69f62e0230e9", "value": "3072:Cqz2CpxY78bAz999lj2jY9zd45KUWXA8nbf:jdpxYDz99Tj0YRd45Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748125, "uuid": "42d3ae3c-93bb-46bd-9adb-98a7710ce934", "value": 146292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748125, "uuid": "a9e9e182-e78c-4a1a-bf6c-ebd81a5529c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748125, "uuid": "74cecb34-c36c-470c-a99f-9f50d2997151", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a24ff0f-7ccb-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783734906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783734906, "uuid": "3eb52ec9-0396-4e35-843f-a986374c6e01", "comment": "Malware payload", "value": "2f98c7a63264e13054f9a2535a0c712d", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783734906, "uuid": "57cfdb2f-fffc-4feb-b500-ac594c3f5ba6", "comment": "Malware payload", "value": "b36b132b5d8a5f3a3239302f8ca730c4a76f8abf4783cd670a5f4fd7a35a32c9", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783734906, "uuid": "60571834-b0ae-44bd-a5f8-0ddb294dd38d", "comment": "Malware payload", "value": "2e8a2a6e4775d89e51d8465d9a4b6e56040a6b9e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783734906, "uuid": "f0e667ff-c47f-4a5f-a23d-7bdd90e5828b", "comment": "Malware payload", "value": "8e1b050141ca71a6aff4628d292e4078a4c9b2cc75983795f793ec8dc85eda625bf3166380b5c49af1f8789d56962130", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783734906, "uuid": "5880c7fd-7cb3-45e2-b5e2-2647d6445131", "value": "T1A3C59E03E7A580EAD49AC138C7568223FB72B4891730B6EF57D48A253F67BA15F1D305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783734906, "uuid": "7168cc78-418c-42ab-8dbd-fd107f8068e5", "value": "a9cfe4d59b4347e623a95ee9979ae52c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783734906, "uuid": "d213155a-f768-49b0-b74b-f34fadc21130", "value": "49152:kMnxytwSJNrKzpmKBA8/8yp2ggP4ZQTAIzHY2uR:kMnMKzAoBxIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783734906, "uuid": "f51aa478-8a3d-46cf-817b-3dcfdf0322d7", "value": 2728448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783734906, "uuid": "c4f4ac96-a0b0-4e0c-b6d0-987366bd46de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783734906, "uuid": "f52b4617-db99-4ab0-9d4a-48ebaded580b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9360e721-7ceb-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748665, "uuid": "f4a46d1d-8c27-4531-a694-317c8394643f", "comment": "Malware payload (Mirai)", "value": "54be16f4d416aa73feaeeb99a60b43d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748665, "uuid": "c230dd4a-3601-4852-a025-207e925192fc", "comment": "Malware payload (Mirai)", "value": "b46f8ff995bc1c48567d8bde9b8f9f784796e1af9d849924e725453995d5acb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748665, "uuid": "d7d465ed-3074-4ccc-8290-2dda986438cf", "comment": "Malware payload (Mirai)", "value": "8cff8f0fb8f6db78fafdf91f205cd24ee94c7580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748665, "uuid": "524f3fc6-f4e7-4c7d-80f7-d7f2fa99770c", "comment": "Malware payload (Mirai)", "value": "999074feea35be7818b5e31dca1d186440281dd310dfc795b973e8449c34b895c0b34b3efdafb0e45e2478f5330793c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748665, "uuid": "b9d92c5a-1fb3-4612-9a0f-938fe5c288d8", "value": "T191542A02FF0C1E03E1172FF0263B87F197DFA9B128B4B640695EAEC54273C71A645A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748665, "uuid": "ef1d2d29-0860-4dbc-926e-8865e998621e", "value": "6144:URBDfn34BZFOh1IaYxQeDxV4PJPTKqaJXll6XYqxCPnqqVVrC6:wDf4rFCuzpm7aJmLqVVrC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748665, "uuid": "d21a7d9d-92f9-495c-91e5-0787af315534", "value": 295260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748665, "uuid": "0eed3cd6-0999-4997-b96c-4bb68c6a3cd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748665, "uuid": "457fdc6e-7b01-4319-8396-f6fcbee3e572", "value": "kworkerd-writeback", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f092d12-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749839, "uuid": "c3c974f5-ffff-45f2-a560-d169bacbe492", "comment": "Malware payload (Mirai)", "value": "19fba2b49294ed6932db7a2354dd9fcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749839, "uuid": "63b678cf-4bad-4eee-a0ed-0f976a6d42fc", "comment": "Malware payload (Mirai)", "value": "b4cbbb559004104056c092199ea59097f40737eb65c72b91e6170038df2d4e9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749839, "uuid": "80469a3f-fe2e-4d95-9f41-20b6d1ac74b8", "comment": "Malware payload (Mirai)", "value": "de6129792d2ade1424927a83eea322b5bc516133", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749839, "uuid": "09d97648-8b3e-4e63-b4cc-7e556a8354d6", "comment": "Malware payload (Mirai)", "value": "1d4dbd7ec54f6c370ed8a24d33b34e6c8fe17e1e11b1a0d97fd14ea5fa573ea8e28c6eb25a095e05bb5d0353a10500d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749839, "uuid": "7670a9e2-378a-4884-96e7-2ff26f4ba06b", "value": "T1CEB33BC4E243D0F9DC560534213AFB379A73E5BF212DDA83D3A49AB26C96AC1D40679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749839, "uuid": "5ff9099d-16ec-485f-aec9-424a66ad8251", "value": "3072:9d5qGekwumbRajd24WsA22811febx/S3HRQf:H5qGek6bRaj4V23GJS3HRQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749839, "uuid": "f27b67c5-a1ff-4853-98a5-77a9f34c1972", "value": 108148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749839, "uuid": "f34d3ad4-c706-4fd5-ada3-2f18f9392ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749839, "uuid": "b2401022-a354-4f36-8524-cd284b21179e", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b514a0d-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788810, "uuid": "3e6c0595-07aa-4407-897b-9b3f6eaac2a4", "comment": "Malware payload (Mirai)", "value": "ec7649e71cd8d6d9947b6944dfc9fc1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788810, "uuid": "9147fb90-4652-4b58-88cc-08b043420fc3", "comment": "Malware payload (Mirai)", "value": "b6ceeca61f6b65490b0451e300e8283f99f5c6c00cbe985ed057078b9638670e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788810, "uuid": "37366d77-a052-47cd-be39-1af89cb067f8", "comment": "Malware payload (Mirai)", "value": "1d415152dd54764b85f6b096b93d42b8a9929305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788810, "uuid": "ba20ad33-7879-4b96-9e6b-f70abe160d16", "comment": "Malware payload (Mirai)", "value": "6a97aae8a35a0e88696470af5df9c904eb20f2da12c6e9f62a63064127c0644ae83450dbdbe93dc70705de438593dbf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788810, "uuid": "c6a04818-4f14-44ef-abc0-fe9acaa856e0", "value": "T131831995B9814B12C5D512BAFE1E118E3323177CE3DE73129D206F24778B96B0E7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788810, "uuid": "bad576b5-bdf5-48fa-8b44-1766be606b23", "value": "1536:ZTnJWOzhCrfmhDECS4UIYaZaUDDYX/QTMCiob5c5eCqfZ737pY8V/hX:2AhFDS4NYaZaUj5cYCqfZXpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788810, "uuid": "63f296d4-e14a-4165-b70e-178a8192b502", "value": 83652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788810, "uuid": "2a7980d4-e1ce-4b59-b7b7-d9e901723888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788810, "uuid": "ae731fe3-7a1c-4bd5-86ab-1c201b9aef5e", "value": "XDarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473da40c-7d44-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783786763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786763, "uuid": "bdc4f5f2-a180-453f-8fe5-f292f6b17a0b", "comment": "Malware payload (Mirai)", "value": "54f14a2782f9c6a936d3bc66e308d63e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786763, "uuid": "7ed70106-7363-4cb7-bf0b-4bf738c7db61", "comment": "Malware payload (Mirai)", "value": "b7386ffd17a8ffbead01d91d34aec9156059c623cad5832a4a24487066f713cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786763, "uuid": "e389f1bc-7450-49ba-87a5-51e2afe222cb", "comment": "Malware payload (Mirai)", "value": "0cf3a7c0a7f43b03702ec30436086d8dd90920d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783786763, "uuid": "22b7827c-f391-4398-92d9-02579de0cb52", "comment": "Malware payload (Mirai)", "value": "0a82108d73d5ee7afdbf84ee4845e0eda38914d24d8f7f4198350e14bd86d2776d4c937da176b0e756897968b187b967", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786763, "uuid": "ae026ffc-b38c-4cd9-8b41-e5865f067ac4", "value": "T1EBC32995BC929A52C6C616BBFA0F82CD372223A8E3DE7117CD155B2437CB52B0E3B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786763, "uuid": "37ab9630-8eaf-45df-933e-8e15dbec6ce7", "value": "3072:5me3i0JuKADB1grmojVX9Mj8kfOIsUEnbbN:5meS5KUbj8kG1UobN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783786763, "uuid": "41e598da-c2d1-4d19-82f2-51c99989de55", "value": 124284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783786763, "uuid": "2c07252d-dd3a-47e2-83a1-9cb4c11e08b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783786763, "uuid": "954b0e0c-3a5f-4e53-b62d-fe9090dfd072", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c654342-7d5c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783797160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797160, "uuid": "86325c45-82d2-4dd4-9a64-bdbb33054896", "comment": "Malware payload (Mirai)", "value": "a378b43ee28bc268254b34d712d18468", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797160, "uuid": "4743f8ed-5612-41c0-aa0d-b2be5bd5f4e0", "comment": "Malware payload (Mirai)", "value": "b81ba14cb5fd16dfaaebc558de473723619700ec04292d3bad98df88d0876f2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797160, "uuid": "a647d41f-6cd1-4d0c-b84e-c33f90822122", "comment": "Malware payload (Mirai)", "value": "7e5ac61d1f9bafb1fe5a300df70c67d7500ab94f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783797160, "uuid": "d9f3854e-143e-4239-bb11-b5b9c53e78b8", "comment": "Malware payload (Mirai)", "value": "f656f300562143cfb5de02c98122bdf91bf198cc1f8e77b2cd6a4d5a98e898dd11da8cca1db24ba35e91d4b4aeb41bc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797160, "uuid": "0934bcf4-5234-427a-89c3-5708d4ef97a5", "value": "T1ECB43A51FC419BA7C6D12ABBFF6D828C732317B8E2DE71129D155B2063CB85A0E7B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797160, "uuid": "fc1a788c-c8bf-4eb2-bb70-f6a74c9192d1", "value": "12288:iWKjbFJJV28UZeDf6omE4ipfhRyhHDXzOv4rGfqe:iJj/kO6IT6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783797160, "uuid": "c7e83fa2-c218-41d2-ba5a-2475b2f3199b", "value": 504000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783797160, "uuid": "094dff90-2f0e-41e9-9f1f-158436648d68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783797160, "uuid": "d9892d73-5527-4b23-b34d-14019c55811e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b34371b-7d83-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783813935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813935, "uuid": "7edecf87-61b8-445a-9a3c-074a504faffa", "comment": "Malware payload", "value": "df66a72f23cb22a05bdc4ca67ed79b18", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813935, "uuid": "9d0f8cdb-82bf-41d4-9159-c126590dcb79", "comment": "Malware payload", "value": "b956c9732f3d5aa72bd2b8b78e03b519fdf15d9ea3ddcd5ada2c0f158105b96c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813935, "uuid": "8e389492-b3ce-4711-839d-4ff0678ef72d", "comment": "Malware payload", "value": "71c83615c1e7128a9cd191c47331934de89a2639", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813935, "uuid": "1cc44d31-e12b-49e1-ad0a-9e221f17586c", "comment": "Malware payload", "value": "eb6b7f623c2ff062aed7a65d5ada464e244d008fe1541d0a2aa28b4097cc6622bcad39f3ed89062151d53de2825b461f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813935, "uuid": "caf08932-f2ab-438d-9e4d-7b97fccad72b", "value": "T1CAE6339CAAF012EFD963013DBEF296A6A479F4324B30C5574734C3A52E471E0A839D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813935, "uuid": "c290db7c-7055-4dff-a35e-9229c0bfd3c6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813935, "uuid": "ce2ac657-f01b-45e9-b0f8-d8057cce88ec", "value": "393216:mwrmoxMfmr7dt65IiX4XMCHWUjX7cuI3/PGTAI:mONxM+dt6qXMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783813935, "uuid": "4a2af581-884e-4827-817d-c5ad1228462d", "value": 14313755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783813935, "uuid": "80cc0a00-e0aa-46af-b256-8551e1c9e837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813935, "uuid": "2e025652-92bb-417c-86b6-a7e713836366", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1db634-7d3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783784843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784843, "uuid": "1ea07157-c6ec-45fb-9d6f-fac215ae4d87", "comment": "Malware payload", "value": "1b3db2c665cd95ab1692b1e58510570a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784843, "uuid": "9286b71d-de37-4fdf-8668-2683a233b22b", "comment": "Malware payload", "value": "b9bcef908c60cf0822007f23a0f6aab4aee0c139b8bf6bd416fca2c6dbc50dbf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784843, "uuid": "a41828af-19db-44fd-aa45-a3dbdb0bbcf0", "comment": "Malware payload", "value": "4bad9217c16d09f7c144ad781344cac639b915a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784843, "uuid": "a6ce245f-319d-4220-9293-a1c2bb26226a", "comment": "Malware payload", "value": "0683b1e145220a55ff2b4ac899aa9c4486320c5aa5b9c95f984959ee459e1619bcd42adbfee0c2190d9a132ac262364d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784843, "uuid": "0e398e3c-c40b-4cfb-8fca-4863fa751834", "value": "T127336D6516857C14AA99C8365D7F2F0CBCAD43E6314491EE7FCE3CF28C4AA9CA21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784843, "uuid": "8a34a970-c917-4f13-b095-f274d90c99c6", "value": "768:nr9NyXsZztCZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:rHusZ3cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783784843, "uuid": "173abae8-9eae-4100-9030-04993a982bfb", "value": 50374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783784843, "uuid": "5ca4ba14-d6ed-487e-9bc6-6a4cabd43311", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784843, "uuid": "cc9e428b-0865-4d2b-9576-05b74d87129a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bb2aee-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783289, "uuid": "91e8bc7a-f728-4dde-8428-21679921e7a4", "comment": "Malware payload (Mirai)", "value": "fb2b425849f8759a999a27c20fc7a40b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783289, "uuid": "f2d33256-de69-4f6b-9bea-3ee7cf42f52f", "comment": "Malware payload (Mirai)", "value": "ba3833aaa12a252a4acc72b63c9c2bfd44a73559de3b1d54c87ab52dc8de087f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783289, "uuid": "556a64be-4711-4984-acc5-6f942db1b5f1", "comment": "Malware payload (Mirai)", "value": "5c1f406a99b8163f80d5f19c83665d78db644ae1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783289, "uuid": "6200b347-a756-40bd-9f07-49f3dec10a78", "comment": "Malware payload (Mirai)", "value": "8c1854db69d2504638248f19c9a733a5253f3c33dd35e450c0807bea6225fc0dbfa3fbdc80c263806f43a4ac773c90ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783289, "uuid": "fe625aab-6435-4aad-a1ef-f25972ad382d", "value": "T13E6302E67015ECD2B830D4BFD6F65D40BE2003F554EAA0B194790A68BE759C53EBE281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783289, "uuid": "13e5c9de-cb4c-479b-a3ab-2bde1521ac9c", "value": "1536:B0z5KA0r0uaANWpCGdi4uAz/2ombWj5aUe/vtL12atuM0GXlXxj:EKTrJv8pW4uAzuFWj0/lL13L0Ill", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783289, "uuid": "3b301ae6-a33e-4a3a-9b39-189eae4e1b44", "value": 68040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783289, "uuid": "85eb3b19-f89c-44bb-a68b-9f84ccdf68fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783289, "uuid": "39b692b2-29e4-4281-a235-a170f4a3e21a", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd682b59-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753487, "uuid": "86ae37ff-97c5-4e28-a0a9-e8fd95ba1ef1", "comment": "Malware payload (Formbook)", "value": "ac6fecdd9e65d5ec136b2a23e6b9a57a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753487, "uuid": "f9ab9a74-075c-45bd-97ff-d6605c6d2d4a", "comment": "Malware payload (Formbook)", "value": "ba8a96319609b430e9e976a639ae3af99a28cfbedb965ac67feb7482291b4a54", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753487, "uuid": "804d49a4-c466-4c56-a42d-67c1d677f270", "comment": "Malware payload (Formbook)", "value": "cce044872caae8843547c7257af5d9723c9c9cd2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753487, "uuid": "9bd7a297-1700-4074-af90-1a0c5f7d37bc", "comment": "Malware payload (Formbook)", "value": "e3cb9d3eafac87b947e13f2cfcadff3f4fc11c5be1f0bb750daaf6c4491f0d1840ba620d168122bd9e80aa9fc9d378e4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753487, "uuid": "5fc85ee8-ec62-4f39-9160-0a2e6e55b29a", "value": "T1E4C2815CDD1622744A05132BFF6B352284DCA608D772E834B28743AE794D98CE9F4BBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753487, "uuid": "db27ed28-d4e2-4be5-871e-dd1369b0ec2c", "value": "384:iXMQvnn7U+XkI7I7A9yyq7cc/rVu4UrvkFjy5xBiyiOAXh3C0O:Mn7U+UUPq7ccz84CvSjNOAXk0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753487, "uuid": "e0c8a766-8466-45f4-8f95-0f7fa479f63a", "value": 26261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753487, "uuid": "ddb100cd-b84e-4229-8eff-ee593922f2aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753487, "uuid": "f4e73f8c-bc1f-492d-9bb1-ca7d4a2512d7", "value": "qoutation 2026 a b c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b1c52c-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765503, "uuid": "72bf997a-9396-48fb-9a46-ad6f18c86d42", "comment": "Malware payload (Mirai)", "value": "220c90ae462607abb74e934d7da6fcd3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765503, "uuid": "23484dd4-7a91-4c6e-8d31-c04ea25abd4a", "comment": "Malware payload (Mirai)", "value": "bc1e8339753cee233869a2753cc5a3efa629aecf22173b3046290560d4579044", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765503, "uuid": "c6d720fd-8975-4c5f-a75f-06f203c12c1d", "comment": "Malware payload (Mirai)", "value": "3ab26697369c81652908fcdaaf914a2e388f413c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765503, "uuid": "b1935713-8919-4536-9565-4f14d46be1a7", "comment": "Malware payload (Mirai)", "value": "2b73f7ce0765affd52a9c7b5fe2d6ac60b66f226b0cac3c4475e79d0ec7ca477543f27a5aea3eecf578a0ca26ea5c166", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765503, "uuid": "2ba0acd2-8e36-4bd2-ae17-1e1c78c20137", "value": "T167B30956B8918B11C6D136BBFA2E019E3313576CE3EF71129E285F3827CA46F4A7B045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765503, "uuid": "182eeaec-4820-4dcd-9c2b-66a992c6811b", "value": "3072:rBAGty/17VYmZ6/rhEn9LOOni5GZ2qSfwjBSy71um:rrK1Hn9iOSkITy7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765503, "uuid": "f616a35d-87d8-4e8f-bc3a-c7ffed32d69c", "value": 116200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765503, "uuid": "be5a5ac7-67b4-4b29-bdbc-9b4ca4d9da18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765503, "uuid": "cc8e5e14-450f-4854-954f-5ed1b3304eef", "value": "Ares.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e892dfcc-7d56-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783794764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794764, "uuid": "a0dbba1d-7da6-4bb2-b8fd-b0a9c3bdddc7", "comment": "Malware payload (Mirai)", "value": "cd050a3b5f3c2e77a14ae346acb83fa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794764, "uuid": "55e41019-5f78-4ccf-b5e5-789985e5022d", "comment": "Malware payload (Mirai)", "value": "bc2ddf63fb0fba2d53bfc11e1f87dd466ad3bea900712eb9ae03f91119b67dfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794764, "uuid": "21bc9489-2d67-44f1-9d66-c5ac45e68e98", "comment": "Malware payload (Mirai)", "value": "f381508cfbfee69efc5f9de8e9a8ffd9c70e75a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794764, "uuid": "4a01db3a-9e5c-4f92-9600-63cd69804db3", "comment": "Malware payload (Mirai)", "value": "a0ed709afcaf433f88e34b95d828d16436218e85732b674a5671b62badec9e3aa753047e10c925e60b98f837c6e8274a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794764, "uuid": "920e11c5-f106-4e22-899f-c13cc9a49535", "value": "T12213F285159D17D2D73024784D590A02BACFEDBDED67B88DC664E9887DC320317986C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794764, "uuid": "73976a3e-8357-4b89-bebe-26324cc7f352", "value": "768:Lueeojfw3xI44IPP30ljtzPoGFkf2XAf9Irdakk5Q9q3UELOh:eo83m44IXAH82wy0ZL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783794764, "uuid": "9a3ca74e-4ebd-4cff-9bb0-3ada429cfea1", "value": 44560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783794764, "uuid": "bdd7e35c-debc-4174-b7c7-b225ba676c59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794764, "uuid": "015e1070-e451-4fa3-aa1a-cc0d51b3526c", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db9cf3f-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783284, "uuid": "2d5e8009-d7c3-4d50-84ff-c456035d8946", "comment": "Malware payload (Mirai)", "value": "b36e1da7844f9213728f589623a2d208", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783284, "uuid": "7d55bda6-64b7-4d3b-9b38-cb6a6cf7b42f", "comment": "Malware payload (Mirai)", "value": "bc44a47d9c38eef76b43a039437f62910bd3a5a9b16012848a21070f19c78af9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783284, "uuid": "d8fc0238-7c37-4ffa-ad9e-487bddaa8a74", "comment": "Malware payload (Mirai)", "value": "c13cdfdacec4e467c8d36eaca98fa0c6625f9e14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783284, "uuid": "4b20f1ee-92e4-4cd3-befa-f636cfe9de41", "comment": "Malware payload (Mirai)", "value": "5a82907829b1ed8b2bb6a4ec4ab91b0ee5a3224d2a5ea50b881e91b1d1cfcdb1cefa4ef7023978103f79b8d0e74eb2b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783284, "uuid": "417a39c5-588e-4085-8e04-9dd63ba85a71", "value": "T16313F1225541AC78E314597478FCA93B2BD28621D3E6167102CEDE3CB9F985378F4E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783284, "uuid": "bda1026e-fb5b-4e64-9760-2e1fe5cb4016", "value": "768:KqfvCwP1B3y4xwuV5wYUPXjEZRxsnesv2BBj1EATN4cddcdYzV3s3UozV:PvCwP11rWuQm7K16c+TqzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783284, "uuid": "76933385-bdba-42c3-8eec-45a37214b615", "value": 41460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783284, "uuid": "171d3077-fce2-45f4-93fa-7cc97e789a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783284, "uuid": "66a8b77d-6c39-45a6-8c5d-16ee360e250a", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2087b3e2-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749761, "uuid": "d92f1c57-7f88-4f35-a8f6-35920c8fe4d5", "comment": "Malware payload (Mirai)", "value": "421cc0b909b5ea1e2944a2fa85cbc441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749761, "uuid": "10176061-dedb-4ff6-8166-582b1ebe38f0", "comment": "Malware payload (Mirai)", "value": "bcefc4b61aebc8afbcde7b68047750547cae7fa0fb71951a751a351b1ac47e39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749761, "uuid": "2ad2c676-cd45-497b-854e-2e39b87c5254", "comment": "Malware payload (Mirai)", "value": "55dc200a92f368c989715e01a68a9bd8fafe725d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749761, "uuid": "268eeb7c-2a1d-4e18-b9a6-7585f541d914", "comment": "Malware payload (Mirai)", "value": "90e03c924589116ccfc54c2d461d59ad5e75c0d8c595e6af64f3fa6feedf57edd1560e099140b547915b404d2ce86308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749761, "uuid": "789ceed4-958e-4302-8dd1-07ed5bdb4ae1", "value": "T19F2302A4C8065A5BD73EBDE5184CE74EE1A057AEB7826EC01484DF25D743E9B320DC89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749761, "uuid": "5ae05371-c3fb-487f-95a2-a31e3104dabf", "value": "768:w4clb5fYALSMoPv9O1n6PEL60fT785xPq90vW9YEsdpbFYysaK/4uVcqgw090:wXllMln8RTQmC09ebiyY/4u+qgw090", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749761, "uuid": "1eb584a5-b657-4c9b-8e2a-7724b58551c7", "value": 46920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749761, "uuid": "4287302e-38e7-48d4-9477-8c4896446c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749761, "uuid": "f152d4c6-cf26-4476-acd5-8940ec832960", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a87cd5-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ChromElevator)", "timestamp": 1783753523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753523, "uuid": "d228e26f-ad20-4ad2-ac41-352d8deb50b6", "comment": "Malware payload (ChromElevator)", "value": "7e0152bc25c757133234908aecad9cc3", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753523, "uuid": "96ee5f26-3e67-4765-a968-9dc9ca0ec1ce", "comment": "Malware payload (ChromElevator)", "value": "bd04e770390448d65ec3e1350197e6f4286d8e69fbd5712296ea30948056ee28", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753523, "uuid": "dcd01405-28c0-49e9-83c4-12abb78d82f8", "comment": "Malware payload (ChromElevator)", "value": "77e9277c6e48cba0ec4524d7ec729f8bd50336f6", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753523, "uuid": "77b85ad4-f8e8-4f99-a9c9-3e5ef09d0c89", "comment": "Malware payload (ChromElevator)", "value": "d8e1fcaa782f590ead9501b4b68205d38b82683b594f37fac60914a49bc6b490e30a46707b677150454460268d9726c6", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753523, "uuid": "6da2bcd6-d089-4638-9d61-73bf8edda78d", "value": "T15AB5F2105FC86F6E8A9C1618E07F266EF3E1068945677CCAEF337D49AFAA70041271B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753523, "uuid": "1be0122c-7113-46f7-aa95-d6067d9467d9", "value": "24576:jI1+39aOnt1CwPaK4dRz5NwAXP5oEuTH205Rn0oYUUqMB9sRLoFeXYlBaFP3zE0r:01+3MOnUp54TAaM+UsPgAxLh1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753523, "uuid": "c3f4bf37-741e-49d6-a740-bc661dc1c551", "value": 2410688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753523, "uuid": "cd18113d-e553-47ef-a17f-ab4c40368b63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753523, "uuid": "d767d855-d330-4ec1-bafa-864671adf353", "value": "PH98765456789000987654.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcbe34a-7d09-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783761645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761645, "uuid": "41231b20-bcaa-45c6-9878-2f87e437a8ee", "comment": "Malware payload (Mirai)", "value": "5f989dac6e8c162573452bc80368a210", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761645, "uuid": "0003f838-4f0b-4ca5-b9e6-e33ac93a53c4", "comment": "Malware payload (Mirai)", "value": "bd7e593a835c88ae66561610b68e1a8813734cf9b4595821c1b9a6bc2637ba50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761645, "uuid": "6dc2e2a8-4120-439c-93ec-d3caea62df21", "comment": "Malware payload (Mirai)", "value": "e8270196ae5a9526ea20b02c06298055aae617d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783761645, "uuid": "d4e16b7e-9819-40fe-a221-147b6acac871", "comment": "Malware payload (Mirai)", "value": "f86a543163c077839fcc7cf4db5207ecd2b81cdeb6c09ea29d54dc52c567b66c44ad0895dc23cdc75eb3b609169734af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761645, "uuid": "0ca58d11-e140-4da4-bf4f-b071edcd2fe6", "value": "T15B937EC9DA43D1F0EC526BB1047BA7278E76D4365135EF81EBA52A31ED13B00AA0776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761645, "uuid": "a5a297bf-882e-439d-8355-390b311e46a0", "value": "1536:nA1g5Omn5DwjW3IMICI9jk0gjGbJUXnnJNVUjN1+TdRrkx69yV:AglmyI3C8jplMnJNOB1vxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783761645, "uuid": "6564a2b7-2e17-4f07-bb18-0069ecb3f2e8", "value": 95376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783761645, "uuid": "1b95c4cb-48f3-4ebd-94e9-5bfc4650bf43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783761645, "uuid": "aaf13041-58fb-4740-b4dc-094b5ef3345c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d950932-7d57-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783794880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794880, "uuid": "00c1795c-4360-4545-91e8-34e2ef458e28", "comment": "Malware payload (Mirai)", "value": "6e6bbca459ffa5a7cd7a40ee683853c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794880, "uuid": "de063226-c9f6-458e-a4cc-f1e60ae6e1bb", "comment": "Malware payload (Mirai)", "value": "bdb2209c0d4b4cc273541f9313385ba6a56b60ca9b7046987c0e7669bf06093e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794880, "uuid": "42b22915-b6d2-4643-bcb4-16fe24f34c78", "comment": "Malware payload (Mirai)", "value": "16a5456067f477fe6d6446e352571fcab5c6d633", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794880, "uuid": "0baf09d4-1906-4c63-a3d9-c25572aadbee", "comment": "Malware payload (Mirai)", "value": "031f3d3ee029604b3e2f4c10339046fdfadc0f0b0e4341861d54cfb767203334e0c70d7f90d827beadc35478f0794dd7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794880, "uuid": "179b5612-6c42-43ec-bb0a-146e28ebb659", "value": "T11E0152C7110623315FE2D9A6BBBBC99C7090C1D764C3BEAAA498ACB5C18ED1C7C42657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794880, "uuid": "09f15313-461e-47b8-b89f-8649bf91d55c", "value": "12:JCkp0FlkKrHkKUX0FlkKSPxHkKSPIhOf0FlkKYHkK8VZX0FlkK8HkKch:ItSKwKUsSKI+KIIhOESKtK8PsSKZKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783794880, "uuid": "57347b41-5030-4c5b-afe1-1867359aa63b", "value": 773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783794880, "uuid": "13bb4065-da03-4e1f-8258-b483faa2930b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794880, "uuid": "807e1a66-7396-4a19-a25d-ea07d2881850", "value": "3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f352798-7d1e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783770401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770401, "uuid": "0332f594-7409-4b6f-b2c1-427f21c8176c", "comment": "Malware payload (Mirai)", "value": "6a0e7ec97110e1ed22527b56c8ad0ce3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770401, "uuid": "0cbdbf75-3f47-422d-82b8-388dacb22721", "comment": "Malware payload (Mirai)", "value": "be62b44d3c734fa6d26f8f16f264bb4683f50011d444d4296575c92bb74620cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770401, "uuid": "2d0f12ce-0317-486e-8d7e-94c162ce9152", "comment": "Malware payload (Mirai)", "value": "5582d3a511f4a39b1e0f25df932c30603b78faed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770401, "uuid": "03dcc09a-1de8-494e-b651-4b84cd87967c", "comment": "Malware payload (Mirai)", "value": "29d9f8deca5099aa11718be41a37e415e42c1d9c2619f06d31b2737a52655aad4e9ec1911b8473b7dda3f84581cd1680", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770401, "uuid": "d4b64260-4a11-4631-a572-846099476681", "value": "T1580192C7110623315FE2D8A6BBBBC99C3090C1D764C3BEAAA498ACB5C18ED1C7C42657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770401, "uuid": "f3bbba3a-5119-42f8-a51e-a1d14f3da3e0", "value": "12:JCkp0FlkKrHkKUX0FlkKSPxHkKSPIhOf0FlkKYHkK8VZX0FlkK8HkKc5:ItSKwKUsSKI+KIIhOESKtK8PsSKZKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783770401, "uuid": "4bafc836-8878-4c64-9fc7-bc108059a486", "value": 774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783770401, "uuid": "b66c6174-4b43-4bfc-be67-ea756683ebd0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770401, "uuid": "de9f380b-9c25-4715-878c-175e35ed98a8", "value": "be62b44d3c734fa6d26f8f16f264bb4683f50011d444d4296575c92bb74620cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea42df6-7cf0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783750778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750778, "uuid": "9bfa6e04-2f4e-4752-9ece-65bb46f9b7b3", "comment": "Malware payload (Mirai)", "value": "876ee93eadcbc9b39ef3fdfb2f733d49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750778, "uuid": "a8d6278c-b13c-4878-8b94-493d50c1d303", "comment": "Malware payload (Mirai)", "value": "bea906fd065da9ce2383a68038cd3a81970dcb38b5a0c0048686cf39914f5152", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750778, "uuid": "3727c0fc-fb59-418b-8092-ef388951809e", "comment": "Malware payload (Mirai)", "value": "d15042f77d68391ee98d1d1469c70de61743f100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750778, "uuid": "12828cb5-ba5c-4480-b643-e0c834d2d7fb", "comment": "Malware payload (Mirai)", "value": "592a8f0cf6cc414f1e479badaa82867f8cc0d07eebd47e7f00fefb57d23f8b7fc1c4ee1dac69d4188d0143c9f48b0fb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750778, "uuid": "bb2a08b0-82b1-4501-8552-9eb0e16ce11c", "value": "T114B30806BF615FF7E86FDD3746A91B09259C541A12EC7F3AB630C828F68A14F09D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750778, "uuid": "3490ccba-b41e-4a29-8c9c-132e1af196e2", "value": "1536:DVtTuJDFkspIW6haSRVtSf+VJ4tJBcphftgoUdoSs7eq4CwSGB:DVtTsqh1jtSHeUdox1wFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783750778, "uuid": "3723d915-69f9-402c-9c29-57d9c4d39d4f", "value": 113520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783750778, "uuid": "7b7985c3-118d-4e6d-800d-925897d04b24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750778, "uuid": "817fd37f-a5df-4288-8740-fec3dbd16bea", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e010ce-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783346, "uuid": "2c5738be-8294-4905-91b4-2609fc98b6ad", "comment": "Malware payload (Mirai)", "value": "d9e15294b78c695afe804882cc6a7142", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783346, "uuid": "553739ce-659b-4d1a-8b1f-dcec00921396", "comment": "Malware payload (Mirai)", "value": "bec641710bd7c5fa5ed3d998e8b735123d7e340895e3bdad040dc7481c9f5d6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783346, "uuid": "215febff-5a0b-42c2-8cd0-fcf8cd889e47", "comment": "Malware payload (Mirai)", "value": "1bcc06db8a72b87a45d67df7e018a3247502ff31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783346, "uuid": "681bfe2c-2696-4f68-92a8-9722529f939b", "comment": "Malware payload (Mirai)", "value": "32cd76c8134600eba8ae2432b62b3d041adced4165e3d61ecb1966589e1a4c52fde24a3e2974c2889ce4d73ca137fd3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783346, "uuid": "49614eed-6786-4395-ab91-067e8ece045b", "value": "T174C3F909EB614FFBE86FCD3746E90B0529CC551722A83B7A3574D828F64B24B49E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783346, "uuid": "85e5ad1b-47a0-49b2-975d-fe5e8e3a56d3", "value": "1536:T7wh/zgJxtcn+g6z3jLo6AyRj14qoS/Tj8Y/Z1h+NnitrZcGN/3oWMFiZ82R6tfx:Xwh/zgJO6TI0INn+rDpuwmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783346, "uuid": "d7d94924-5d9b-42e4-8bfa-0566981dddcf", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783346, "uuid": "2af72184-89ad-4252-808f-d53da94a41a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783346, "uuid": "c66fe22c-7393-4a42-8f43-da65a76797ea", "value": "titanjr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1a7a05-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1783753517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753517, "uuid": "75025b58-8e62-4324-b646-e305aedf073f", "comment": "Malware payload (LxBaseRAT)", "value": "37fd39f666a921ed5baa9e520cc58730", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753517, "uuid": "3c45af6c-4dd4-4a4b-8c9d-2ef71cfaf23d", "comment": "Malware payload (LxBaseRAT)", "value": "bf168a441ff29c5260dc258a9a0b42be7d3a4a5bb102112580b135a1eb47d17d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753517, "uuid": "81ff2088-54ce-4c2b-ab01-3f5a3126edaf", "comment": "Malware payload (LxBaseRAT)", "value": "a9d48efdd8622252b91100951fab70bb88e28c5b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753517, "uuid": "76e3304c-287f-4b7f-a138-c735cde2979f", "comment": "Malware payload (LxBaseRAT)", "value": "1d1b4b0d484a076fbc67cb86e6bb197ebc336211ac7e55edbd937217f291b3ad2d93ec957b2add2daf4c8184a08ff711", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753517, "uuid": "a113493f-9aa9-4d38-b861-026e47bbefd6", "value": "T153959D3793D727ED393A4B29105D4C5DCAC9B665BE0DD1039A0DB208DE672612238FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753517, "uuid": "8e6f12bf-e1b0-4ad9-b656-f893b99c137b", "value": "24576:1inier9w9rkSVO50llG6S5fH4OtE4yfqFlr9eSVC2t47YTv+cmx5SuDwUvPPhoUy:1izatk0OAlGzfbE46+ldRVm/SuZ+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753517, "uuid": "4b806179-ae33-4d11-8c16-27bd0ede57b5", "value": 1982728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753517, "uuid": "123b37f8-8ae1-4377-8bb9-b3cd5cc6ed61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753517, "uuid": "541813ca-fb61-4937-a034-63126617ea82", "value": "PRO150 PO#6098 Quote 6_2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98530bf-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "e81c50e6-086f-49bc-b669-1b4da342ae95", "comment": "Malware payload (Mirai)", "value": "79521193fa053225217db78cc50d9724", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "06e1d055-abbf-47ce-9c1e-577fd214823d", "comment": "Malware payload (Mirai)", "value": "bf52522d9c9ebaf9679a9b94e6204196d6b95b64f27b20a0a3676d54f8253677", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "a5545c70-e0ff-43f7-be29-0f30cb008c43", "comment": "Malware payload (Mirai)", "value": "f6d7fd53f6a47a0708b81f2d64e95edac631d1d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "8ffa3351-129a-4b6c-b5c0-3530e88d02b1", "comment": "Malware payload (Mirai)", "value": "71994d915a80c9630ffa72f410bbb6f7c6d8a81bca2754713bb0398922a589665cbfa2533657b92545a2e52649c06851", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "67d17e51-adba-4d27-b854-c31ebe89d1a7", "value": "T1CAD3C54A6F314FFBE8AFCD3745E91746095C581A23A87F717630C868F68A24F25D3928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "00c2f2ae-7994-4292-a13c-7fdf012fe24d", "value": "1536:Boycq0RA7LZbg7pH9238TbEi+lVye77gL1NRmS3y6p9nvHxQxedgfZ72jDEnp/Q6:bcXRA7L1g7pdE8TbEi+qbxNZvv9gfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765506, "uuid": "7dc806ad-40b2-497b-807c-425cf5dd5a2e", "value": 138148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765506, "uuid": "9a27415c-8100-46e7-a6db-e7f6d25836c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "fe92252c-bf28-4605-8051-73cf3da0698b", "value": "Ares.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76b6769-7d0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783763006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763006, "uuid": "2cb46ec6-47d3-4fe3-be6b-e46bd60bdef5", "comment": "Malware payload", "value": "663bb3f62ebce407ec68de6600915a25", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763006, "uuid": "e14b5b30-9586-4823-a554-501c2fee6ed0", "comment": "Malware payload", "value": "c0d3c83c468895da716816ae2c94d253eeaaf1b18f7beccfa05caa1d85d0a881", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763006, "uuid": "8c8fcc4c-07a2-4e5f-b272-ccd236a92e49", "comment": "Malware payload", "value": "c9d701367b2d4336f88707e5666c7461f6aa4963", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763006, "uuid": "2204f052-1fd8-49d2-be26-f677d31c484f", "comment": "Malware payload", "value": "065a8cb807ca5c38d1443dfaf79b8f6c299b560368d8f30adabecebc0478f6e2e337b2c9c28bd962f373d36c222e9a13", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763006, "uuid": "dc502656-1c65-402d-b42b-3537a7ce2739", "value": "T133A2991FA360CE3DCCC4A279548B523451B5B070AF32531F2A5067FA2DA3E984F79B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763006, "uuid": "b8ed8b57-adcd-4887-8cb6-013709d14d83", "value": "384:J41Okv+oEnfXPH/3vnfXPH/3vqiaSKvi4vxafVurN3yUz:J41OLoEnfXPH/3vnfXPH/3vqiaSKa4vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783763006, "uuid": "08716df2-8566-40a2-bca5-62214736b259", "value": 21464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783763006, "uuid": "56308ac3-e419-4401-92be-22b87f994c64", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763006, "uuid": "fd8ea993-f65e-4b7a-84d6-1555ffa4bfc6", "value": "ntp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01f8e81-7d0b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783762484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762484, "uuid": "edd36d18-e4b2-4956-a410-225716a6f516", "comment": "Malware payload (Mirai)", "value": "d0aaa3ef47cd326dd6448a43057b85ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762484, "uuid": "9e4da281-dcb2-44a2-8fd2-1a99473dc031", "comment": "Malware payload (Mirai)", "value": "c3457390026b6cc4690310f0af06c0a50da4941881ef3d8defab8ad15474d5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762484, "uuid": "c5c208eb-35d9-4724-ad55-1d4e8d0c1a70", "comment": "Malware payload (Mirai)", "value": "33ee7bcfa7c5d30092517c99ad7d54a74257bc6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762484, "uuid": "57227851-7238-458b-ab71-2edede734af6", "comment": "Malware payload (Mirai)", "value": "8ebb62856c6bb7980bcbac83a32d107e9df88c097e8d3f47c0ae3517562517a09f44ebe16c2501d3fbdfcc52e7530763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762484, "uuid": "472fb5bb-ab10-443f-9c23-7a5173921b37", "value": "T16AA42955FC809B96DAD12ABEFF1E824973531B78F2EE72119D151B3063CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762484, "uuid": "b573b57e-81ee-4bc1-be1c-dcb907b8ecda", "value": "12288:o0jGhvVMu/aWo3ZKyQbxARs72NhVIWFWZydW3gUW6caLbs7YhVsBdx:7GhNI1HsqKirv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762484, "uuid": "0ce75a5f-68aa-4e91-b00e-0be0a6caf513", "value": 485060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762484, "uuid": "7429d9f7-5969-4c20-aa93-9834397e68c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762484, "uuid": "c29a844a-f41c-46f1-97b3-00a1ed64a65c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb76b98-7d17-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783767604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767604, "uuid": "9ab0ce3c-0cfd-4a8b-bcfe-c1829fbeb718", "comment": "Malware payload (ConnectWise)", "value": "3560fe2da909cd41a9d7e821569e4e36", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767604, "uuid": "46942c5c-6b49-4959-860b-331a63145b0c", "comment": "Malware payload (ConnectWise)", "value": "c3699595a32ae9316813b770799f5d10ddf215d50d55b45425b3f541885d4f63", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767604, "uuid": "072c12b4-60f7-4c6b-bccc-a5af9fc68a59", "comment": "Malware payload (ConnectWise)", "value": "ee66a398604886f9e3816bd8af98565372775749", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783767604, "uuid": "746c70fb-5dc4-4a9b-869b-7c2a48f91634", "comment": "Malware payload (ConnectWise)", "value": "8a6c2d04e87681e189baa27ad93b7e81920cedda0e2f0c2bf9ac180d587cc44e8eca02d2306485de930c7695335ab035", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767604, "uuid": "f8a49d8e-ca2a-4c2a-bce8-e5f9d7305d88", "value": "T18B46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767604, "uuid": "bfd67ba0-3716-4e09-8255-fd45b1b4b56f", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767604, "uuid": "08788442-0947-480e-9cb5-1b8bd8de554c", "value": "98304:3zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:3hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783767604, "uuid": "e74af12a-41ae-4e0c-865f-c8290e84295e", "value": 5653144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783767604, "uuid": "82d44662-f82d-4e1b-9fbf-64e6935d5a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783767604, "uuid": "166b2897-f67c-4fd5-a659-2a67a44f3c06", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6332353-7d72-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783806733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783806733, "uuid": "a97d6dfb-ec58-4acb-8e4a-2b266c50557d", "comment": "Malware payload", "value": "f2e958826bd6e14b123ea5fe4f55fc74", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783806733, "uuid": "da8b1988-8795-42a0-aea0-1c914681fde1", "comment": "Malware payload", "value": "c47be75ba9204ee9cc3d812bde65145e09a13a389bcce8cc15171aa4c04d1a4f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783806733, "uuid": "431f9dfe-310d-4b9a-b1c5-43648aa287fc", "comment": "Malware payload", "value": "0b91d2a4a872fe800002285b813ad8f981eb6c8e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783806733, "uuid": "bc10a9f8-68b2-4e0a-9834-3eed66b1a452", "comment": "Malware payload", "value": "e3692c774c3c70a603d20f6a7845cbb2e27dd1faf698e03a315497f35d50d8943b016d8473da0425a02bc88f062bf485", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783806733, "uuid": "7bc51842-4d89-47b5-a2ea-383df760b626", "value": "T1BEE6334485E001BDEBF3407DEAB165A4E5E9B8730771CADF57988366BE231E00A39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783806733, "uuid": "f785e903-1a31-45d0-b25b-50fbe2eeec18", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783806733, "uuid": "ed70a124-9c41-4389-b447-2ad72ff93b04", "value": "393216:khqy3uPvYedF3FZq0Uytt6lfjfXMCHWUjXCcuI3/PGTAI:kX3uPvYedVZUyt6BjfXMb8X/H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783806733, "uuid": "7547c841-e985-4d9a-8ffb-14d0519111f9", "value": 14319491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783806733, "uuid": "f0351ce1-f332-4f6f-af29-9bceaef7f033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783806733, "uuid": "3af70d6b-db63-457b-b3b5-e02c65109902", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad536413-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753433, "uuid": "cf64b6ab-ed39-478c-9ea6-04775ebb740b", "comment": "Malware payload (XWorm)", "value": "4c14c7f402872e32058304bb4919e68c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753433, "uuid": "496fdcd8-b15c-4ab7-9696-676e0766c02e", "comment": "Malware payload (XWorm)", "value": "c5c7a9e148ee943262c9a5f67f5ce65a276dc04beddf5e12900c0acac40ece89", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753433, "uuid": "9e5f21fc-8db7-47ee-b2ef-1a6515106e19", "comment": "Malware payload (XWorm)", "value": "5ab0d156893590ac4cbf1a1f52408935d1a9b80b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753433, "uuid": "aca346e8-8e09-4a27-93c7-1662111d4a75", "comment": "Malware payload (XWorm)", "value": "cc5bb433625c049e125e407047fdfdcf217a673c869dfb0db858e40fc662d1a09870d5e2f34df54509c224b481cec878", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753433, "uuid": "4c19c4b8-4a55-4d70-8e85-1315f4d58065", "value": "T10AF20C6C56C3B90681706B3F32C945229D644CFFBCECA692BFD789971D437A40ABB024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753433, "uuid": "cf14b2ad-0b02-4fff-844a-4c8ac4118b0c", "value": "192:Fpmi8uPyCD0t8k5oopvZCj+2fsIMv3jzfxA/B5nB0L:Fgi8DCD0d2opvZS+ehijzfxA/B50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753433, "uuid": "dd79f994-a39d-4eb3-baf6-dcd7ba2786cd", "value": 35031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753433, "uuid": "85228687-ddd7-46e6-912e-6693f2a03d24", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753433, "uuid": "f77469ce-0488-42d9-b1d4-0e6e0d7f9f7b", "value": "USD5704.05.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27143d8b-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749772, "uuid": "c65e4362-e08d-4514-af55-c3e35fa4739e", "comment": "Malware payload (Mirai)", "value": "f09ac735287924aabf8afcde718972a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749772, "uuid": "4b6a25a2-ddd8-4ac2-a98a-73a0927c320d", "comment": "Malware payload (Mirai)", "value": "c6d6f2a52c4b1047f399481d23d965cae1909152ef487addd9b4d626d5adba98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749772, "uuid": "ae7f4faa-d904-48ab-8e46-16cdaa526fd6", "comment": "Malware payload (Mirai)", "value": "39f246a833de1bf8c32f8295ed4cb7604c641b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749772, "uuid": "71e20cf5-527a-4304-9b03-1ffbe5a3c079", "comment": "Malware payload (Mirai)", "value": "814445473f3f0cdd5a52c0ef375e48c290195eb3f5bbb56028754fba0b69baffc1defe10207f36443ca205fa52635227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749772, "uuid": "5bffda5a-eb1d-40d4-9e29-37c72c415e24", "value": "T19A330278F122DDCAD1621CB7921604F919115E75A1FBA03733213CF075E7A9643F9D61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749772, "uuid": "e49c6bee-660a-4a79-ba8d-783186dc86ea", "value": "1536:dFcJtF6Gp9a1IF+dptJMJ9NJJtsniVoikzTLY:dFczF6Gp94IIztGJXJ03DLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749772, "uuid": "ef9d0b77-ab0d-4269-80bf-407cdc0d767e", "value": 51864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749772, "uuid": "70bc41a7-76a6-4748-b306-12d1a794c9c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749772, "uuid": "0699f5cc-32de-45b6-8f56-e2fce1852f79", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78864adf-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753345, "uuid": "e7c3d722-1ed2-4c6c-a5e6-6c24d5b9110c", "comment": "Malware payload (Formbook)", "value": "c4fa39a17f0512fd83ac8d2a9bd398b0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753345, "uuid": "f7a764dd-f39e-44d1-adcc-8fcdeae324af", "comment": "Malware payload (Formbook)", "value": "c84b27346b84457e3d760dc9db3bfb32830dffbbdd7740491cfe5be4dddc2b31", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753345, "uuid": "a784926d-318b-4b15-8e78-cd83b835754b", "comment": "Malware payload (Formbook)", "value": "71a808650ae63d4cc658822e077e22d5ff058d7e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753345, "uuid": "b14d8623-be86-4dd4-9a02-3317080582d1", "comment": "Malware payload (Formbook)", "value": "915a5cada54722809e4819af115127140f48ee8bf536b4c94216397865615e15e812b7d7e199bb1e09c4553c04e8bd91", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753345, "uuid": "bcfb17dc-152d-4750-ab76-d6f1caa23814", "value": "T1F2452341EF8F3E300FB4AA38B07E6F0D9F30CA9D9456F499127169831476BC153AE869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753345, "uuid": "0b376633-a6f6-4892-8a9c-e759646bbb02", "value": "24576:00cOj1cR8v7rP7QiGem9wouCUBfgVXpbi31BK2NBnrc2k5jwvPH:0XOJTrjQFCFCUZmYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753345, "uuid": "889ce4a7-04da-4585-8d3a-9489a78eb17a", "value": 1276023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753345, "uuid": "72dca21a-9cb5-4fcb-94ee-f2f4d88ce2a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753345, "uuid": "bae0de97-378e-4141-9656-f6d246d2c30d", "value": "HECFfn98j1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd708245-7d48-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783788733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788733, "uuid": "a23e44c6-88d0-450a-8dbc-87c442db6958", "comment": "Malware payload", "value": "4d52702c10ad81188e708437cd0ee771", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788733, "uuid": "7b7b3a3b-658c-41bb-9c15-91add9188302", "comment": "Malware payload", "value": "c89032246cdf3a73988e6b96a20580d7df11e65fc556575881a1f3549097e99c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788733, "uuid": "907af4ea-00ea-4910-846e-75ec67e0b2bb", "comment": "Malware payload", "value": "42b54a1ae297e89d0325ac9bc33927f9a321aec0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788733, "uuid": "120221da-da2f-4908-80e1-686deb5302fa", "comment": "Malware payload", "value": "677bc3eeaace9fe36fd77c569780700b52736c9e1c45221a9a17ef7e054e2408382e5c141fd621848af8d30829cf59ab", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788733, "uuid": "d97358c9-c595-4cd8-a848-951bdfd7c059", "value": "T111E6335D59D102FED9B3803CACD19AD5E52278320B72CB9B87E983E71D572E0893A707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788733, "uuid": "d359311e-d22f-436a-8337-02ce5fb8d755", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788733, "uuid": "0a7bc407-d599-4f5d-95a0-3a59a86f93e2", "value": "393216:senwGhon/VjnDgwgBddzQ+XMCHWUjXrcuI3/PGTAI:BFSn/VPg7dJQ+XMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788733, "uuid": "9e7a3e69-d301-4ea7-b5f9-619b547cc01b", "value": 14257096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788733, "uuid": "c3fb477d-3770-49c2-bc80-593e1aaa5cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788733, "uuid": "8038b08c-5def-4129-badf-36ea7ebbcc15", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd91156-7d83-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783813728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813728, "uuid": "3014aef4-c36c-44dd-a6bf-89399f852e60", "comment": "Malware payload", "value": "312d795dc8b1af6956c9217c9e7f0285", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813728, "uuid": "241e6d43-d141-4ee3-87e4-8594bcdb2784", "comment": "Malware payload", "value": "c8a2d4ff2c12a7f081244dfa55a14bc7b0a4e029afd96fa06111c21eaf44c096", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813728, "uuid": "fdf11b42-b226-464a-9156-4cf590d9e329", "comment": "Malware payload", "value": "222807af34580411589863ef424ce7c16ee0882a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813728, "uuid": "c67bfaa7-fb5f-47a8-89ae-c9b666c30dcf", "comment": "Malware payload", "value": "5187714698b0eb801107976efec7019ddd05c39fe39cb7f8e02edd29a312d78ecbfa8960da27c7c05462fc305221af24", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813728, "uuid": "4821bd6b-7a9f-47cc-87a9-0a429f8c6eed", "value": "T178C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813728, "uuid": "04cb6abb-789c-403b-a525-0c46a2bde0ce", "value": "768:Z8vCB+25j6es8R+9FYpMSUpi+20qUpi+20YQX:Z8l25JYd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783813728, "uuid": "74c795a5-144f-473e-9b92-3e5ad83a9f56", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783813728, "uuid": "0da26fd6-f4b6-4104-9b95-37224969d71c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813728, "uuid": "110fc014-12e7-40d3-aa0c-4f630bcffc6b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a9f885-7d11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765072, "uuid": "9796cc59-fa02-42d4-84fc-c78740fcd166", "comment": "Malware payload (Mirai)", "value": "f4fd5df8382e0dfe88d9b31036e9df7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765072, "uuid": "040c239c-7f8e-4e9d-bf1c-8f7663f5fbfb", "comment": "Malware payload (Mirai)", "value": "c94003ae9522e21d02c8bea78af09c882df7f2463d717e5024ea177058db8c37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765072, "uuid": "cbee02ca-707d-42e5-8c33-7dfc4b45cc79", "comment": "Malware payload (Mirai)", "value": "cbd336ff0c8f3ccbf75bc552477c6f40a73596b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765072, "uuid": "063d3d0e-1770-4c5c-9a13-f5280a18ee9c", "comment": "Malware payload (Mirai)", "value": "232b73b5891e056d76c36b0c7c0a173c65fa054424181d33539c75af06f378fa2ed85995d4e77b7c3860fac826823cd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765072, "uuid": "4b7c4ead-2e4f-423b-a455-d0164dff5b6b", "value": "T1D2E3D50E6E218F2DF379C73587F74E25A79973C626E0C645D1ACE9112E2038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765072, "uuid": "fe7706b7-1a1f-4c32-9388-34351c2f1106", "value": "3072:oGEO06njmfuL7Gas1dIxZRckJgiDZLCEkMddPWGWT86rEfUObnbLxh:oGEO06ndSlgFnLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765072, "uuid": "5bdf8ef9-956e-4cea-90cd-e160822bd7e3", "value": 143772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765072, "uuid": "ccbc20e7-8e88-470a-996d-fe966a01abc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765072, "uuid": "cd884235-307b-4026-8f6a-b946aab2d550", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad67e69-7cfd-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783756328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783756328, "uuid": "3b0fa0ae-3508-4643-b2cd-4c130c0467d9", "comment": "Malware payload (Efimer)", "value": "9eff382f00ee270c5c093ede9e3cafd2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783756328, "uuid": "872212b6-4be1-40a7-8fc4-bc50278c7ae1", "comment": "Malware payload (Efimer)", "value": "cc84d3dd96b92a1e6e55003205db75e4b1f1e2ae4111d32d0fee5027f7612585", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783756328, "uuid": "fac9f9ec-0892-466f-b763-392c3d3c7df8", "comment": "Malware payload (Efimer)", "value": "96e51fbcb539f3867c1185e0a0c0bb96f08bc344", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783756328, "uuid": "7f117172-825c-4231-aaf5-7344e7dcc4ad", "comment": "Malware payload (Efimer)", "value": "36490ecdee4604ed648788ebad254c0b640586369676e871b9da2de4a55bb5941e37865f3e99e28384411915b356146f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783756328, "uuid": "cebc937b-6bb9-4255-b6a2-c1b22f86e747", "value": "T115E6335CAAE412E9E9B31038B9E39599D1F9746B0BB3CACF0E94C2137D931914C39772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783756328, "uuid": "35d227f3-e560-461c-b933-6a95737395d8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783756328, "uuid": "0ac160c5-95db-4ae8-ab71-0f92b1985e94", "value": "393216:m+DF2RaSEzS2WXMCHWUjXacuI3/PGTAI:maF2RaSEzfWXMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783756328, "uuid": "1b6775d5-8432-4c86-a2c1-753fabd8e09c", "value": 14257810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783756328, "uuid": "6b045132-f71b-42e9-9a54-998121492038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783756328, "uuid": "23f8d42f-4ade-46e7-8606-45dce914a692", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47814915-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783327, "uuid": "8093e698-09dd-4c73-9fae-da370d021291", "comment": "Malware payload (Mirai)", "value": "b56bdd4564ee1793ba2d1f51fddd7c4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783327, "uuid": "c3a9897b-44c8-4a00-8457-77169984ed77", "comment": "Malware payload (Mirai)", "value": "ccd3f61b1682707b5e102bed6c84ec7162a08ee81dcc121e62fcea66c8aa1cd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783327, "uuid": "c0640ebc-5916-4d42-a93a-bbc86fd7c24b", "comment": "Malware payload (Mirai)", "value": "92b5241eed78335bcd989a98bef4fec97539e513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783327, "uuid": "b1ef500d-376c-4bc0-b626-8c14c1d565d3", "comment": "Malware payload (Mirai)", "value": "fe2b573533cf1c035907c2524cd19e96ddce8fb2ec6654dfb8792e01d1b808a38de701818777194531474ea9b5d5eb7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783327, "uuid": "274e55f7-2e0b-4d05-8e56-b84520534d69", "value": "T188836AC2B743D0F0F8660631217BB7769A73E13D0069DA43D7699832FD12682E76A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783327, "uuid": "c294dc07-6e50-4fd1-b41e-fe129a79d31e", "value": "1536:Wr94m7jGb2acxFyiL0YjAyQTfdsDvpRrR1Zj3A7vySLDVZlPLxOxBl+:Wr9X7jGy/FyiLPjAyQTf6RjZj3mv1fHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783327, "uuid": "ed3d48d0-6dfb-414b-96c9-c1ea23a41617", "value": 83632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783327, "uuid": "773caf1c-aa16-4e3a-8fe1-f208b194cf58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783327, "uuid": "088ef294-3c60-481e-85a0-65f2d34ff1d5", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a41784e-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753321, "uuid": "35bd4cfa-6b4e-4fc7-91dc-f7e10c8f648d", "comment": "Malware payload (AgentTesla)", "value": "9e0ae17a8d4f51172e86ec3a81d860ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753321, "uuid": "9461dcc4-eed8-4e32-88f5-931b086b6aaf", "comment": "Malware payload (AgentTesla)", "value": "cd244ab745581d8183fd5d42ef60134eb94cfd8677a87187dc2f71134fe38fea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753321, "uuid": "c8f6ed03-89c0-488d-b298-d810ed7cb296", "comment": "Malware payload (AgentTesla)", "value": "298bee76ab7087dbbf4a4076de8000549d0d2f3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753321, "uuid": "db7abec6-6e8a-429d-8089-9dbda3b5068f", "comment": "Malware payload (AgentTesla)", "value": "bd4afd7e8f75fc78e24f15552bb5405dc5735a088bba2aab46461eda41e434be197930866c78fcb736c72438d23ff210", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753321, "uuid": "b7b1b298-2122-4071-bc0c-c353b215126e", "value": "T1BFA57CA371F6820944B49CC19F0F753948A1E8DB70A1B58A2E1F4F98BB740A4577BE3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753321, "uuid": "63e1609d-d479-4caa-bcc7-69d305ba02ca", "value": "192:jlblblblblblblblblblblblblblblblblblblblblblblblblblblblblblblb8:1f0gZWoJbqjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753321, "uuid": "c2ad54c4-959b-4b18-8d6f-059689b79760", "value": 2204715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753321, "uuid": "e7bd54d5-b8cb-4ad3-8839-e9e4109caa93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753321, "uuid": "ce190b20-0ef6-4a2f-9880-214fe4126edf", "value": "JSKELLLLL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e637e1-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783753439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753439, "uuid": "a4ecbb4f-8089-43fe-ac56-0dd397481c02", "comment": "Malware payload (MassLogger)", "value": "1bc46d872c4dbbc008feb93b7ade7254", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753439, "uuid": "96080638-68f9-4c14-9566-3f0ab598de6f", "comment": "Malware payload (MassLogger)", "value": "ce24e71ee2ab12ed1f1e2a79be41f76e97e84fb04ede98ff71944cb96c744e0f", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753439, "uuid": "733910db-1a35-405f-86ad-2d401100c86a", "comment": "Malware payload (MassLogger)", "value": "6f05ec25a8c478ed8c46c596f743092ecdf5e921", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753439, "uuid": "55e1046e-a5e1-4442-a9af-f6c2e999f3bd", "comment": "Malware payload (MassLogger)", "value": "60306a1b87efe98e062524092cbd58b996e88660bb63ad2c11cf2ab063725712ff1e26444f02a7113cfa546b47d82aed", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753439, "uuid": "d21df1c6-2b15-494e-ae03-bc84c9fa9cf1", "value": "T132F2867EF863BE801C5F702D25E5612879401CDB12B4BDDC9FFA64BBAA940618CB5B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753439, "uuid": "116b03f2-d665-4ea7-a494-4947cc1e37eb", "value": "768:FcPYCac6/w4Nfwr/NQNKOPsNmIhhANsKOPwNGw/a/5sNm7Cac6/w4NqON1w5/IhK:Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753439, "uuid": "d1b62a3b-6333-4ee3-8d93-1a3e68b0b3a8", "value": 35616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753439, "uuid": "c7d6e3f8-e693-4b22-b25d-123b64f78fa6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753439, "uuid": "c035ee48-4a3c-4b30-8a4a-0f22fc455c90", "value": "dekont.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c357d4-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783766948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766948, "uuid": "83a7d7a9-5ca3-4f91-9f4c-72677a72c5d3", "comment": "Malware payload", "value": "14a86cab6ea4e4027b63607db9d684d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766948, "uuid": "724aeb43-a8c6-447d-bdf5-3ecca8b75b8f", "comment": "Malware payload", "value": "ce67962a37bdb23dce9ddf6b1660ad99769addb68099326b95c5ce63a5a25b5b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766948, "uuid": "890f4b1a-b88f-4674-8530-1ce7e6de4885", "comment": "Malware payload", "value": "356ef5eee8e4cbfe43ecd816e344940c52d7d886", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766948, "uuid": "239af786-713a-4ab6-8418-d689a9752a44", "comment": "Malware payload", "value": "2526938602dc669b773a452d36f80792d531ba7897b62d5743c51efb622800dae02edfd4d299ff5713f144ff543bd997", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766948, "uuid": "afcf65dc-abf7-4946-957b-dbc3e55ac81b", "value": "T1EFE082E074A152328A40CE87C853C0BA3577B0E01B222BD5629DA2F482F5280F8706AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766948, "uuid": "a2d1066e-4438-4bbc-a8b7-53a9a085d0e3", "value": "12:ShJS+3FL0fi932xfU3aLKV0fI3c5fn3yF:Shdx0W2xoAKKMc5PyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766948, "uuid": "f71e5d75-3b03-483e-9a0a-441e21b48793", "value": 432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766948, "uuid": "f37175d3-b506-4b6b-8f14-0fc0703e7918", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766948, "uuid": "acec44b7-8355-4cd2-a38c-5548c4b1708c", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e59452-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783753310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753310, "uuid": "6fc3ef83-7952-4b2b-a3b2-8b8644e7096e", "comment": "Malware payload", "value": "e03ca1b34e53bd39728f3b25d58e292c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753310, "uuid": "054bb992-f8e0-4b8f-9d58-e15c614ce0e9", "comment": "Malware payload", "value": "cff1ba5cf6691864063ae843983d093e4d2353a859110f75dee0a7e025cf530e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753310, "uuid": "2c805e30-a3a0-45bd-a35a-c4a21faa9f80", "comment": "Malware payload", "value": "a4a69caa047ed23d25246d3497e3c5eb275851f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753310, "uuid": "86b99d5b-ca95-46e6-9e6b-e876aa3573d2", "comment": "Malware payload", "value": "4932cbcca42dd01abbe1e178927d8bde8e8576616ae97fe104ab5d3a41f51c0c0beabd083b3bcaad7985a4a23d733313", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753310, "uuid": "6fdda894-68fb-42c0-a75f-b512a396618a", "value": "T13CD5F2105FC82FBF8AAC1A18E07E265EF3E1068505677CCAEF737D499FAA70052171A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753310, "uuid": "16ab5f54-eade-460d-9c62-2a554cd5fcae", "value": "24576:EZAfxeH0zk29VitoF9mydFH0QPEUllAvse3UGpufNLx0HoLObMW0HGiuacoiOZhA:c2ZvNDGpONUoLObMqWSUhfXhA14J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753310, "uuid": "81a352fd-838d-40c7-a223-d8d41495acd2", "value": 3004236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753310, "uuid": "95da011e-f477-47b3-9e7b-97b4056aaa4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753310, "uuid": "59a3dbb2-4cca-426b-9b32-ce0e582500b7", "value": "new po.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc5750a-7d3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783784544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784544, "uuid": "e1ccb065-0327-432c-9f38-00a0df24b6b5", "comment": "Malware payload (Mirai)", "value": "618afb3a441764fe0c801939e2cf8fda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784544, "uuid": "6f610c29-86c9-4ff9-9e50-deb0b43cf8f0", "comment": "Malware payload (Mirai)", "value": "cff6787d0f468bcbc5023606df03263d15d71e955b350309f93d747a279127c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784544, "uuid": "3a2291d7-8afc-4a90-ada4-9f80d1ea511d", "comment": "Malware payload (Mirai)", "value": "fb4b5cd9b64eb99ef245703c2f622fb216d5d396", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784544, "uuid": "037aa374-63e2-45aa-a856-afeca3506df5", "comment": "Malware payload (Mirai)", "value": "25906446cf99a709885770815283ecf69233b5a29a7da47497870bb545b371fb3b33e880fd5f02a6c134922bce14b631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784544, "uuid": "0418c7a6-bec0-4f5c-b78e-d80280aef68f", "value": "T14D142A56F8819B15D5D111BEFE0E128D33232BBCE2DE72129D246F207B8B96B0E7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784544, "uuid": "6b3c6459-8d7a-49f5-90ff-cb0e4deab71b", "value": "3072:8UTMOJujbMWba5UAoZRuXzVoq9aCpkuCoxPjqw+QC/b6xy:IOJu/k5/GuXJouaF8xPN+Qwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783784544, "uuid": "7f513962-045e-439f-86ff-8ae79600d34a", "value": 194044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783784544, "uuid": "063b686d-dd5d-44f7-b6e6-64e4a76348b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784544, "uuid": "8edd1a18-4c31-41a5-99b4-885ba73e7831", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7ed7ce-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783285, "uuid": "1e31e0e7-56f4-4c9a-9b97-2b48e1a76e8b", "comment": "Malware payload (Mirai)", "value": "2adf570573c859c8409d94b8972d9251", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783285, "uuid": "e89c3212-9946-4579-8ecb-0ab04071fd36", "comment": "Malware payload (Mirai)", "value": "d0c4b995f35b1ddbf6134199e71edce69594d1def5c90fa899eca2c8e8cc4a21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783285, "uuid": "dce0eb97-ddcb-4e6c-ab04-5d453f1946a8", "comment": "Malware payload (Mirai)", "value": "695f772ca46340be958bf48ca6611b964c514f4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783285, "uuid": "d56c313e-5302-47eb-9396-f9501d4dadcb", "comment": "Malware payload (Mirai)", "value": "e20a39ffb39780ec32628232d25ce54f71fe2bedeff4f172d1b427baa15e50b650aca973e4f836668f3461aff7bae815", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783285, "uuid": "b69674d8-3c26-4a6d-a30c-9562185034a4", "value": "T169617C85215C2B31AC99DAD632AB403C619790E74FCB5FBD98D828F948CCE1578C36A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783285, "uuid": "273113e0-94c0-440d-aa21-98dae705544c", "value": "24:Itssm7v+ltsInhc0JgAjCLM858NIG4ksayq037xzv:iBm7mlWohcut+LTJa237Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783285, "uuid": "7eff9463-8110-477b-b72f-f5d279abe4cc", "value": 3254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783285, "uuid": "a94eb099-0aaf-4feb-befc-0e990411408f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783285, "uuid": "e6934c7f-1021-47e9-b1ce-bec6ccb08d94", "value": "titanjr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0e45cc-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1783753431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753431, "uuid": "a2001fba-bfa7-4bcb-a221-27b541e48422", "comment": "Malware payload (PhantomStealer)", "value": "e26fc3d1bdf6012b2ada8e452744c58e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753431, "uuid": "49e0aa53-534e-40b6-8772-4b8af86ffa51", "comment": "Malware payload (PhantomStealer)", "value": "d11696a1fff07a188f3fb0494212eacb3ed8ae125bcb4da03b09b3f689c7cecb", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753431, "uuid": "c6c8e03c-1ff7-4560-8c9d-26f31d53e7fa", "comment": "Malware payload (PhantomStealer)", "value": "113a4a4fab3a534c46a958a965e08c5a5756ef00", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753431, "uuid": "fd7a4035-9bf5-4772-8da0-0e78e8be591b", "comment": "Malware payload (PhantomStealer)", "value": "471c12808278de7c3b91f3f43e612e65baf2f172b45c574010e762ee6c75137ee0294b5c6f1963b51e6d292226fcf7d4", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753431, "uuid": "d797aa84-eeaa-4d7e-879c-3878cccddada", "value": "T10103867046CB3E640368656BE1B91D723C2F1761B788E476A10493ABAD7E7C9C24C72F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753431, "uuid": "618163ea-fc73-4e51-9447-68899d461295", "value": "192:Fpt00+3d7Ig/EJgZgD9Cq3MVjYAGTDXH2:FA047ImEJgMgq3MVjYAGTDXH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753431, "uuid": "dbd7636d-03d7-4040-bfe8-aea91f8d67cd", "value": 37773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753431, "uuid": "8e40d53d-3fd2-44bd-b9f1-18dc83722a60", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753431, "uuid": "56df3865-68e6-449f-b401-233643f47bfb", "value": "rrrk9906123.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ba5ea2-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753400, "uuid": "3b29c378-aaa7-44f1-93a9-6a0b9588a1ae", "comment": "Malware payload (RemcosRAT)", "value": "5d2c7b09db4b45099ef3138e1e02e45d", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753400, "uuid": "b349bff3-0779-491b-97ea-1401b1763d6e", "comment": "Malware payload (RemcosRAT)", "value": "d347162e4e050202eb1f1635500f965a8c1512343008e24dd26360ff12e39269", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753400, "uuid": "f18ed88e-5f0b-4759-b64e-871b29aacefe", "comment": "Malware payload (RemcosRAT)", "value": "66761c32392a74e57cd1f8e6a04d567088b45b03", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753400, "uuid": "3a460bac-0994-4586-bec9-ab52a0936c8f", "comment": "Malware payload (RemcosRAT)", "value": "35af8c5c318f11f5947fc0c15f1a029c5fe1a3ee9af629f29656c485beb6b8ffcc4dc28cc37bb4a31a03f1ffd1beddef", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753400, "uuid": "e6f53b83-9039-4a4c-847f-3161ec0a773d", "value": "T113D25B1532B6C11AD044997A8CDAC6CB2A21FD53AE438B1B36C6B70F183A5D0D963B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753400, "uuid": "fee9ae8a-affb-475c-ad1e-015c172b4805", "value": "384:MV7lvzxlAhXYNcko9jDBQTxkPfDKV0qVTfAy3dsKNrqzeKNXI:GvlW6Nc31K9MDs+yBrSeKBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753400, "uuid": "c643c1f6-7580-4701-9b67-6469a9807140", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753400, "uuid": "41bcf42a-eb38-4c67-9944-0c0a84bd9e62", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753400, "uuid": "d4ee2a8e-0697-4625-81e1-eaf731de8967", "value": "Invoice Bio equipment Network 2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785cce51-7d57-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783795006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795006, "uuid": "4ef98456-1b7b-4f15-bb74-892d8c0fff30", "comment": "Malware payload (Mirai)", "value": "ba10cc8ab0a49978f046baa079710174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795006, "uuid": "9b3bece1-ab98-41c1-9d14-89c75c095e7c", "comment": "Malware payload (Mirai)", "value": "d39b90c9e009ce32e161f0dd70bec898213dbb35edabe01047a0b6419b755652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795006, "uuid": "57ba9189-472b-49ca-8d8b-ff818f159868", "comment": "Malware payload (Mirai)", "value": "c4adb893efe8c916dae5940f8e491415a2a6688c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795006, "uuid": "10c5bc73-7cef-4979-8679-29122fb3fef2", "comment": "Malware payload (Mirai)", "value": "ff70b20bbf16579734b54da74d4b64cacc03f838224d70e8f200546799a19cffd5028c4323a5e4feb8ce0dd616b95caa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795006, "uuid": "38264a42-d1c7-48bb-a256-506119670e20", "value": "T101C31999FC929A22C6C616BBFA4F42CD37262398E3DE7117CD155B2437CB42A0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795006, "uuid": "7dd3b4b9-e3e1-455b-920a-39bbd059b841", "value": "3072:uci8lKOj2FjUYbQ2pIXzsc7bNYCvdyIomnbfd:ucd4AYc3NYIdoqfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783795006, "uuid": "8e294e26-0d65-4b96-97a5-869672c4a729", "value": 120188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783795006, "uuid": "41e882f3-137c-43fd-a64d-49459f207e73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795006, "uuid": "22913866-57ac-4602-9ea1-91053f133d4d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3718f2da-7d51-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783792319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792319, "uuid": "5482fd5b-85f7-47cf-9937-fd4b15158412", "comment": "Malware payload (Mirai)", "value": "402ee9befdfc5c5b425f9735c53cd77c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792319, "uuid": "0e6e93e7-9df2-4f53-9c75-952d086194a0", "comment": "Malware payload (Mirai)", "value": "d3f8a2e798316d3138ff713661de2edaed8bbc33a8ed13796806032f0568595f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792319, "uuid": "59efde54-a15b-4eb6-b1df-42012f69e0f7", "comment": "Malware payload (Mirai)", "value": "967d9df847e27ac0e2e8e8f35692eae3de8510f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783792319, "uuid": "62c4cce9-9abf-4439-a9cb-7f51f77d46fc", "comment": "Malware payload (Mirai)", "value": "fd7ce5aa58e164cd6dda96813385dd2fd6531bcdef930841d8908dac50a43716b98f1f06627f03f0003894ed6ecae9a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792319, "uuid": "ee2d3c98-5f56-4b54-8917-73c24ed18ab7", "value": "T1BCF3C50E6E318F3DF779873487F74E21979873C626D0D685D2ACE5111E2028E681FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792319, "uuid": "765ef37e-b4ab-4652-9c45-461f8bb57843", "value": "3072:6j1wrZPZtB9pkTWPv2yMxvIbdJOgXcu9RnmG4wKYQUjVcnPaxOocNnbEvj6:6R+ZPZtB9KvUePaxkJEvj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783792319, "uuid": "928fc7da-cc45-4d06-b49f-9d96641171dd", "value": 162144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783792319, "uuid": "51581500-8ef8-493a-8aff-84d0ad16227b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783792319, "uuid": "6669c43c-825d-4765-95f1-3cc01354c807", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41d641f-7cf7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753901, "uuid": "5ac8c5f1-f0a2-4a0d-a240-38a1c478ac8e", "comment": "Malware payload (RemcosRAT)", "value": "3165e03933fcd40df28a26773d21a736", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753901, "uuid": "120c26ae-0f59-4fdd-bb9e-740ea657cdba", "comment": "Malware payload (RemcosRAT)", "value": "d503c1d9574deb89855643ab0d1063bc28331cc3a580fe7286a56bfc8b09afc8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753901, "uuid": "ce7f6f01-d5ac-4d04-a9b6-45ef5b2303ae", "comment": "Malware payload (RemcosRAT)", "value": "a6be48edd66df269a5993d632f26087ef33a0d3c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753901, "uuid": "a2050178-e4fb-40f1-bc0b-c12d49020f02", "comment": "Malware payload (RemcosRAT)", "value": "da423fc64eb6c83ec5bf1c0248fe44df09557bf204020a77f57306265018f7d5cacfa905767c20a90ac742fe3df2858c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753901, "uuid": "3914278a-2e21-41e0-ace2-db2a22a3bdd6", "value": "T126F1DE64238AD2DBD2FDDE17C021A9D1D3735001C60D7622796EA3E48F2685467BBE3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753901, "uuid": "d8392dd1-322c-4141-8dff-7338d669270f", "value": "96:VTpB3RVRoli0g/ert3grzkE67Oto4/E21:FpwiN4tJEEwoaEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753901, "uuid": "1ad8c566-8aa5-4aac-9dda-43d36309fe1b", "value": 7517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753901, "uuid": "b3186e89-c785-432f-af6c-a214a53e674c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753901, "uuid": "4455a771-a443-4820-b5bf-87ff523ed456", "value": "mygoodnetworkingskillforgoodpersoncome.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ea4714-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753451, "uuid": "484dee07-2b7b-438e-a57a-f3da67390dcb", "comment": "Malware payload (AgentTesla)", "value": "c22ab92adc9173cfc59e49f521ef49cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753451, "uuid": "0e9f10f0-b1cb-4f39-9518-29cdbd9a9ed1", "comment": "Malware payload (AgentTesla)", "value": "d5a5eb1de67b57a59ac715ee92541ac6570191844b315d0b408f86d3e56ea2c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753451, "uuid": "759317f8-56b8-4b7d-b210-b1e829f5e0b5", "comment": "Malware payload (AgentTesla)", "value": "2ed4cde8cd5394ea3c8cbdd0412d34ee3b984309", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753451, "uuid": "e63b160d-c27d-4ea0-b413-21b98fe1f473", "comment": "Malware payload (AgentTesla)", "value": "5409f723589b104260312a0a06f4e2b5ab72e0921d83b30d71e5ad07a370de9a9d6dc6207c17564f22a371c80e7a90db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753451, "uuid": "989722ca-f8ca-423e-9a8a-63262b4230f9", "value": "T1CC65F1015AC0AEAC5BEA4F2D717F3199F7E10DDA5804A84BFB22FC41FEF62059A52174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753451, "uuid": "536683bc-7115-4525-aa95-9a02fbce9d25", "value": "24576:QDMXEjV9QYrELc/zqbnV3gNufxK5+A/MnGP4t/fKcAmgaF10fstCH5g:KjLQlWON60Gwt3KHmTTltWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753451, "uuid": "63a8b0fd-bf6a-4506-bfc7-adaa60367557", "value": 1488958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753451, "uuid": "1fdc740e-9d57-4f2e-8df6-273335aec3db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753451, "uuid": "7dadf465-844a-47ac-a87f-2c8d099efd76", "value": "01007 XROX DUBAI QUOTE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce92efb-7d81-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783812891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812891, "uuid": "afe17e2c-0911-47cb-9465-d590abd60ed8", "comment": "Malware payload (Mirai)", "value": "1a278828bcedac955a99034f5ab16dc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812891, "uuid": "4c5e1979-2568-4454-8101-ed2225e2e76d", "comment": "Malware payload (Mirai)", "value": "d5d7ba7df2e3e90930879859614cdebacce22236a1d6d15486a8187b63f81082", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812891, "uuid": "acd892ce-16df-45ab-ae90-1d9eb0aa3e11", "comment": "Malware payload (Mirai)", "value": "62bc6551a3814ff1aa4741dc36d1245fdd82fe01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783812891, "uuid": "7bb87981-0b39-422f-b693-e5ff3944d0b6", "comment": "Malware payload (Mirai)", "value": "a3e1d2de7672f624f1719e167e8bbae2d8bb5d36a10900be390eeeac7bd91f59b610af80726fe5b038ad4d06e6703e25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812891, "uuid": "8c5ac0fb-d9f4-45d7-b31e-2fdb85f04211", "value": "T163456B47B2B364FDC093C43087DBD6A2A931B42546226E7F65C4CB312FA7E641B1DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812891, "uuid": "e6e7136e-f93d-48e5-8046-f6066222b061", "value": "24576:NLHe+4krUyvQb9xcundjFLQgg2H0RKYYVBd9qvB/eH:NL++4krUj1jiT2HpYid9qkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783812891, "uuid": "bc8b14aa-9aa1-4ceb-9c38-084ae61c2078", "value": 1241344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783812891, "uuid": "f9297607-73ce-416a-9630-ce30e1ef0123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783812891, "uuid": "093a579b-6aee-4266-a7d2-ddf43fbdf1f7", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e33846c-7cf7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783753784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753784, "uuid": "be463f13-8ad8-48a8-bae7-1a27c8b36dcc", "comment": "Malware payload", "value": "b643f177ffa7a01f4d05eff8bb1a3f9a", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753784, "uuid": "3f535448-e1e5-4ea3-8ffb-5d482df5e9c7", "comment": "Malware payload", "value": "d64a23eab337c0097a9572703201a409ba01d345cc8239f0901942b487676c6a", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753784, "uuid": "d4f17af6-d756-4fd2-b4f3-31b3681e902f", "comment": "Malware payload", "value": "a40671a669d11608d7b5695d228307831e422003", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753784, "uuid": "3f065d09-bc50-4648-9e36-581231f8da64", "comment": "Malware payload", "value": "95d41802402e7619fdf43e927c2adc79ef2a7c8474339202c8d53b5218cd8c0fd682d4fd3f96861724dfdc9c45d67582", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753784, "uuid": "dd56065c-06d2-4996-9754-639af9d90878", "value": "T116768E0BECB548DFC8D9B2388463B245BD91BE004B357B6779D0BB542E337A05699B38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753784, "uuid": "37b79214-7d40-4463-81f9-3f4a59cec7ed", "value": "a949866e342223e7ad099c8d5f588731", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753784, "uuid": "f408868b-254b-450b-a6e8-40ce6494ae9e", "value": "49152:Qy0GbMSEXq4PjOXWIn04UwpPqi8eQ3ULcgxz544ATjEVYIMTU6XOp3IWA/bsSJic:Qy1V2/cjh8eBfHF/QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753784, "uuid": "01d30895-5130-422f-84a7-e235aacc08af", "value": 7706520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753784, "uuid": "09080cdc-565c-449a-8c54-bbd27b5e58bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753784, "uuid": "6a154980-f8be-493b-b352-bd2471cd7016", "value": "gc.key", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243d54d0-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783766947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766947, "uuid": "02bed028-3dfe-450b-92fb-9af4252113ab", "comment": "Malware payload", "value": "0f4b2598ff9110e8516c138719d1e0aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766947, "uuid": "54222462-8e4d-4a6d-84a5-29c5d212d224", "comment": "Malware payload", "value": "d65089126c8d2d97e61b400016453794494651c234949023ffb9d4535e2f2ed3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766947, "uuid": "05432bdd-de5b-4c34-a069-d9a4263a82ac", "comment": "Malware payload", "value": "b1cbb161db287e7cb2f9a6fb68a3673b4cf3ce56", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766947, "uuid": "6f3e86f8-97dc-4789-8cba-b7adbe894490", "comment": "Malware payload", "value": "fde595acdb673345375907db57ceb098077dea3ede82b4ba4fd269c145052a0b6d688bc7d490e6cef652b53673c64074", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766947, "uuid": "3b848798-5407-4ab8-ac98-409b19ed5fe1", "value": "T1BDF012D1F2E507F38ECE9E0BFB07896D206F76899A5717D96C9DA249D3206C6F060088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766947, "uuid": "536a2d63-00c6-4bc1-a930-0a05cdd7f92d", "value": "12:KpxRtbh3JoBbLTWktbh3MFioBsAWktbh3qkoBgLKVTWktbh3TfoB6YWktbh33RoA:KpftbxiBv6ubxMFZBsbubxQBOKYubxMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766947, "uuid": "2e8ad4f0-fa63-4d46-a82a-f23acfc83d70", "value": 589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766947, "uuid": "09e14b1c-f7d8-43ca-a92d-233bd2363ee7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766947, "uuid": "18301260-1129-4246-a84a-001ed73491f2", "value": "ftpget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40112b57-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783315, "uuid": "d34c1c6e-58a6-49fb-b9ff-ce6d1a312b2f", "comment": "Malware payload (Mirai)", "value": "eaea5fcded1d16a470a0765d469ea2e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783315, "uuid": "e1efeb48-ae1a-4574-a691-d20d4bebbe90", "comment": "Malware payload (Mirai)", "value": "d68b34ee5f1d59f73087f642aedb291c479c21d531346b9628c2e7a5c23d7154", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783315, "uuid": "a235b439-8e02-4865-a245-a21f93624fec", "comment": "Malware payload (Mirai)", "value": "144dc9936c66b793d8c64c5b9f5ea125a4a6cbe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783315, "uuid": "127716a6-569a-4855-87e0-bc664783f531", "comment": "Malware payload (Mirai)", "value": "1107d90d085a2a9adbb664cb4dd42734f53b2fb896526739547d04497d4680008aca154f8ca72b1ba5692a58de019ead", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783315, "uuid": "8c65b3aa-2859-496d-baf0-84dbae686976", "value": "T153935B13B9C080FCC849C030579FA637D923F17E5239B25B6784FA16BE8DE512A6DA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783315, "uuid": "417afaea-c615-4837-9cf6-c1510f1d0b4f", "value": "1536:wXqLjS24u6xTQvd3ES66pDG1u18s9Kk/+v5/ulFxgcbNrym:w8jS24dTQVT6681u18s9KkW5/cFLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783315, "uuid": "61581b3d-30c5-4087-a116-6019ef579417", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783315, "uuid": "6243effb-194c-4226-9b55-03831c47d4b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783315, "uuid": "fbdfd18a-03f9-42dc-8d6b-87ee6bb7a0c9", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d74faa6-7cec-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749031, "uuid": "2d66d8d3-b223-4a82-8081-2ddb4d05f1ac", "comment": "Malware payload (Mirai)", "value": "867c21b831b408942848f1b094b04e28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749031, "uuid": "22299d9b-7528-4cd1-9264-80ed6929e4c4", "comment": "Malware payload (Mirai)", "value": "d86442c4c6bd78c712ed4b0fd3d74046b6079ec793699b496206113c27c8077a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749031, "uuid": "cc999a43-7840-4f98-80a3-68a32323b55a", "comment": "Malware payload (Mirai)", "value": "6e7a762d8624364ee0389e9bccf365a0aa8851ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749031, "uuid": "9bb30f26-e200-4c2d-8a63-044dd51fd963", "comment": "Malware payload (Mirai)", "value": "384d58b64a102e7b8bca926b03c47a1335a0a2d86da92307e64354198dc2d7fd2114cb0acdc593715a6cbdb9760ff0e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749031, "uuid": "f6fdb42d-d962-48cd-bd77-c863330218fa", "value": "T123448E63DD37AF86C122A9F0B1F2CE380F16BD2A48571E999576E9B48183ED8F501374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749031, "uuid": "82aa7ec3-94bf-49dc-82c6-d73fbfdae8aa", "value": "6144:TNEJ2LNIkfv7pdhRptRbuNV4TjD7mRuh+LXqqxCPnCqPVr0:xEJ2LNIkfv7pdHRqNV4TjmRBTZqPVr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749031, "uuid": "afa96db0-70ca-4a28-9c5c-c3cf6b793af1", "value": 254220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749031, "uuid": "bcab3dae-6248-45a3-aa55-640e4700e087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749031, "uuid": "0f8e0828-36a3-47bf-bf30-da89d0e800b8", "value": "kworkerd-crypto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e7904a-7d0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783762739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762739, "uuid": "3b7fdf7e-55e9-457e-b643-150d700d1f41", "comment": "Malware payload", "value": "5689f9f52ab99fd05e73f00981f41575", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762739, "uuid": "ee07c260-5929-44ca-a165-24375a762e44", "comment": "Malware payload", "value": "d8958e179b21b4d1209beb1d0e878898cdb0e934c8ea24cecc9499e876ad775e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762739, "uuid": "d28d9a11-9f1e-4334-9313-0f8330704f7a", "comment": "Malware payload", "value": "c03f6f840f4e7f8857078971551ad6a9f509aedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762739, "uuid": "19050b7f-87fb-4e45-b7b2-bc4bee8293c0", "comment": "Malware payload", "value": "3ddc214b9f265a150ff11b3ebb6d8fe2553ceb7810ce7c47c342b3731867c5b6e0455fde52eeca57e9334c9c836edf1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762739, "uuid": "da251d69-a7cc-4ff2-8330-fbfa53343e91", "value": "T13D75239261F124A5F0B64774C1F24A6B6271BCD3E7349BEF668186BE1F232D0AC31B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762739, "uuid": "b1293d51-a545-48a6-91c8-a164b88e45d5", "value": "e387f9bdbdc891a56417c52c45ed0b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762739, "uuid": "7378145d-b92f-4766-972b-043fdec91d93", "value": "49152:0sdHglTCxPyciVD8BD+SKskM9vcnOoDiLm:FiciV06QWnkLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762739, "uuid": "e7c564c7-235a-4591-834b-215438d6dff7", "value": 1671168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762739, "uuid": "b57c8fe9-de4a-430a-8a91-fa56508a5477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762739, "uuid": "499e681e-0c19-4c69-8608-16ca148ab44c", "value": "lnstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5066b1e1-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749841, "uuid": "e8708b6b-3b54-4ae4-b5ab-f84d57951ba4", "comment": "Malware payload (Mirai)", "value": "d2ab7cff6e6c793cdd374390aec22f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749841, "uuid": "09701899-50e8-4fc9-a4ea-18c504be294e", "comment": "Malware payload (Mirai)", "value": "d8adb898a14ce5482f6578a7d04ab6f5cb840740d605cf836b01621f476c6b60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749841, "uuid": "ac339f18-04f6-452d-8c90-62cd5ffb490a", "comment": "Malware payload (Mirai)", "value": "6f698803dcf96989618ad6b520c0695f9aa1aed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749841, "uuid": "7c96f3a4-95b8-4bbd-84c3-99fc91ede6d4", "comment": "Malware payload (Mirai)", "value": "47c8cf10822c789cc083c7e3148eb5eb1d022ac0e19e2be958ba6952e46317f6b7abde3b5f1cdbab1799640eff4f7179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749841, "uuid": "5f8b71ad-154b-4c19-b8d0-8d46f0f86af3", "value": "T19DF3F805BB610EF7E85FCC3706E9270128CDA51622A97F36B534D958F64B28B26E3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749841, "uuid": "354489ec-a522-4eef-9de9-b8cfc03a0e1e", "value": "3072:pdrx+vzsw8TONAdQLty5l6Gm7UxbiuyZ6RlGP4FQQm8DrfIHI:pJx+vzXUONAdQLtKlTm7UxbiuyZ6RlGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749841, "uuid": "94bf1898-709e-4a77-ab9d-ba1e15483d84", "value": 161084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749841, "uuid": "5f4f9a62-0a12-4b5f-8449-05aa4abcd4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749841, "uuid": "d2336f8b-6de6-4e0c-b706-19220b4f1751", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83599fa-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ChromElevator)", "timestamp": 1783753478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753478, "uuid": "80ff6aac-e194-4d3c-9b4d-4d864ed511d5", "comment": "Malware payload (ChromElevator)", "value": "e764db16eca4af1770a3927de013e29f", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753478, "uuid": "d894b588-ac33-402e-b199-6535e5e9db4f", "comment": "Malware payload (ChromElevator)", "value": "d8e5823cc45796a8ebb20fe84bb7543b994a7b4869a886e3b35d5b7cfc5c8df7", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753478, "uuid": "d9540698-6564-48af-b002-93d82b375382", "comment": "Malware payload (ChromElevator)", "value": "c2bad59f25a4b34fd49466eccdf899248bbc4191", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753478, "uuid": "26930a36-1c80-485c-99bf-14dccd1fd4c0", "comment": "Malware payload (ChromElevator)", "value": "e5ae2adff4f9f94e77172e55a66469aab01a7c425088254b177d333a4a72c9f7b6fb24455beb66b7f6d7e98e76ff9deb", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753478, "uuid": "4037cf15-0e25-4714-99a7-b4ec5afdd82d", "value": "T1CEB5F1145BC42F6E86AC1618D0BF265DF3F14A8500A7BCCAEF73BD49AFA670052271B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753478, "uuid": "2e462238-6675-4a2e-9efa-7e9057da63cf", "value": "24576:hr3TsoHEuV2nR5ZxkIzbmpvpK/iwKhdtU20YlFbHmgjkFZ7vPXlliTzPmaPS90uc:h7T1b2nzmdpRgOlMn1lez5SD3yoc4+w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753478, "uuid": "8aececb9-c13d-4212-b39d-2bdb16fada60", "value": 2407595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753478, "uuid": "6dbf4f1b-b870-4220-a9c0-cdfbaea8861b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753478, "uuid": "d4ff0761-55db-42a0-a31d-a74692146fef", "value": "PHQ9876567800.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cd247d-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783753533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753533, "uuid": "87d444fe-3e75-44ee-ac1b-4cfa8395bae4", "comment": "Malware payload (RemcosRAT)", "value": "b18de8172c17deda9dcb66685d4059f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753533, "uuid": "1f8fd558-2186-4e24-a978-eed56360922b", "comment": "Malware payload (RemcosRAT)", "value": "d92f3155a058d19c81eba292df6fa7d5080c684ba6a19d3d04d2bdd24796d53c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753533, "uuid": "b0209b05-50e8-4e4d-b41e-6b31730c01e5", "comment": "Malware payload (RemcosRAT)", "value": "9528156ff8ba6b0cdd213fd53fc5c18aa45648c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753533, "uuid": "ffce5eb2-8b36-42ee-9c38-4367b098f7a2", "comment": "Malware payload (RemcosRAT)", "value": "8be5c5f6c1b302cdd37061f5563ff269aa83b98bbe6afb395665e9be2fec6c982aa69fc22f95148cbca7d3fe979cffe2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753533, "uuid": "661afd18-e1d8-4561-b756-2ab803eca89a", "value": "T19C856F68CB2AD11218336EA4BCA97847FDEEFF25337E494141564708C22358EEE58F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753533, "uuid": "4a8f1031-a1b8-4b56-b94a-5ee16e08b032", "value": "12288:Dw5AZ3iyBUNxQSE9U761wZ1VUSf636OzAnuyVonlyO1GTnB3lYme:hiUUNxQyYme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753533, "uuid": "2ba176bd-3145-453a-8e63-aad2c2fc8748", "value": 1817876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753533, "uuid": "cfb9ddda-1543-472d-9d06-8131681e2d55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753533, "uuid": "1df4e5ea-da17-45f6-b17b-45a88551237f", "value": "MV DRY VOYAGER 1 Ship.Partic.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f332a38e-7d81-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783813250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813250, "uuid": "2a6943f0-98f0-4ab5-946e-597c25eb21c2", "comment": "Malware payload", "value": "b0f54f4f794bdaf3535b13358894c8e8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813250, "uuid": "cb41f79d-462c-4d1f-887f-8b2f09a18361", "comment": "Malware payload", "value": "d95c3b7ae4b91b28b942f8a150f0da86a0c5c19641933a3edb80800aab67775b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813250, "uuid": "da699dcc-388c-4885-8ba0-d11bb89664f4", "comment": "Malware payload", "value": "7ab417e614dedabefb9020be1418459392db80ba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783813250, "uuid": "09cfd1de-97f2-43e4-ac1c-ed451d9410f9", "comment": "Malware payload", "value": "5ce368880888cdf8d78c62037e49701b0b558cf3bc3677f6de1efbdaff8ee2766c515d0223bf8031808170bbb7ce630f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813250, "uuid": "3f46f296-1437-4524-8718-72b2f99fd372", "value": "T123C28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813250, "uuid": "8e7e40c9-0864-43d7-b899-3bd64ede2c0e", "value": "768:B8vCB+25j6es8Rt9FYpMSUpi+20qUpi+20YQX:B8l25Jbd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783813250, "uuid": "25a9c18c-deed-4d4b-a0f3-d084e770d9fb", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783813250, "uuid": "ed52bf40-2ff8-4b89-b26d-343a44cc0d1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783813250, "uuid": "b50ac3bd-0098-498c-84db-a36a194f5d28", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e76fa3-7d4c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783790493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790493, "uuid": "febf04b9-e9cf-4e3a-95a3-7b441f2f699d", "comment": "Malware payload", "value": "395cf5151f59f3927d717632aa5c881e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790493, "uuid": "56ac16e1-0ca8-45e6-a015-99b0306ddd0e", "comment": "Malware payload", "value": "da50ab4a0d77e1e1a518a0e3baeda28ede523deb958d28e33af8fdffb4d88c5a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790493, "uuid": "30fcffaa-e035-4785-b22f-ddc9c1128351", "comment": "Malware payload", "value": "735429eed2e8eb65faf1ab57e3e79e0af0609786", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783790493, "uuid": "ba4927d4-1661-4b21-8c08-df47f06edc86", "comment": "Malware payload", "value": "7d81d9d7f62a9d7a3d309dfb4bba5cde67611e8f2d6e9325413fee597d28e6c1372845ce42660fff3de0444afd4c2c7c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790493, "uuid": "e06212b9-fdca-4931-8ece-bce42ea6f51b", "value": "T1BEC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790493, "uuid": "d492f821-db2c-4999-9171-0ca4938d363e", "value": "768:K8vCB+25j6es8RI9FYpMSUpi+20qUpi+20YQX:K8l25Jed2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783790493, "uuid": "24f7818f-c118-4f7a-aa7e-797756cdbe04", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783790493, "uuid": "3be4d2b4-9d3d-4bb4-bf71-c43506e2ef2e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783790493, "uuid": "67d8b19e-f368-4d2b-ac02-11bc5139dff3", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472b0d2f-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749826, "uuid": "522eb0aa-6491-4d6d-9cc1-073e97409655", "comment": "Malware payload (Mirai)", "value": "d0894887e636614983125c989c8f1945", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749826, "uuid": "eaa41708-bcbc-43de-99bf-46b4b9d68fc0", "comment": "Malware payload (Mirai)", "value": "dc2d0fed6710883263e86ad664f0e8f1defbf6461248ff9bc7b2c115dd7b6771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749826, "uuid": "2adf7057-3906-4f0d-a696-abe7cc1d046b", "comment": "Malware payload (Mirai)", "value": "89bf29bc01d8f748b30c5f7d4b3d9438d163d9a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749826, "uuid": "fb8e8c13-3bb9-4b39-b21b-1074a8e10c67", "comment": "Malware payload (Mirai)", "value": "a3dd8374050b22441b4ca35cc6546bc3162bbea37be994e31f9fd416054e9a3054040533f50faa244acb44b844c0a458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749826, "uuid": "0dc61255-f4ff-4c6e-bcba-bf25573d30c7", "value": "T1EC930781B8824A6AC6E02379E66E728E33A0B3F5D2CF3127DD615B1177D518B0D67F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749826, "uuid": "6657d8e8-8472-4aa8-a6ba-67becf83489b", "value": "1536:lmAL9q1B6mDftrSq1hu9TnTb4UUhL2o2jDthODH8kL8ofYH:lXBq1BtD6wq5AIlwYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749826, "uuid": "4f991c79-7953-4443-aec2-330d98e9472c", "value": 91584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749826, "uuid": "d58b974f-6b76-4728-9831-bdcf0c19787d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749826, "uuid": "afb3d17b-9745-45da-8cbe-1960e26e1c00", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1986128-7d48-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783788740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788740, "uuid": "c67b82b6-545c-433f-8470-37dc4ae1ed32", "comment": "Malware payload", "value": "8696960710609c4277297f844ce6ba9b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788740, "uuid": "65d3b166-dcb4-4555-8e3c-4e9239ed5928", "comment": "Malware payload", "value": "dd255b896e9bb61ada543cc6ad859ba9ba9578fd9140c9a9864a8e303bb0d36f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788740, "uuid": "09c195f5-4ca3-4aed-94a6-083b8e444789", "comment": "Malware payload", "value": "793b7db8b14f64a3fef2817c6e4d76212045ffe1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788740, "uuid": "90d7491f-66f4-4afd-a24a-615070fd35c8", "comment": "Malware payload", "value": "f26b30842299077ee24f9316b1f35afe12e60e5a87e02d2b840753f1f03b54f27d340bd8fd4fb842f1517441cade21db", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788740, "uuid": "929dec0c-bf0c-4725-9d99-a7c8e97d6bba", "value": "T1FB752326B1E49162F0A5033589F642A769317C221B71DDEF31C0A7BD6F329C6D636B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788740, "uuid": "5f5fac9e-b425-458e-84fe-4a3fdde1d8ae", "value": "e387f9bdbdc891a56417c52c45ed0b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788740, "uuid": "61eea45b-e4c4-4335-93b2-80c628e12821", "value": "24576:Cys+dkd9/yCj0sT4RP+M8hdx7+MqM7y0S4nJHGPauA0c5mH/IgpAjxdDLsUWeboA:o+I99o718vQMqNpoJ7Z0cMHQjL8GLTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788740, "uuid": "5f1666cd-96b8-46ad-8aca-5c2feebf6f55", "value": 1601536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788740, "uuid": "cd82ce5b-1eb4-43b4-9b8a-ebf52792b9a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788740, "uuid": "bd4dc8f8-9b1f-41e5-873a-27495e375631", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba369873-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1783753455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753455, "uuid": "79911778-0825-43d5-a628-70465b1b2163", "comment": "Malware payload (GuLoader)", "value": "1b68cd92ebcaa0483256026cbd0bcb01", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753455, "uuid": "dee3b60f-17d4-4bc0-b136-44c62fcdcdbf", "comment": "Malware payload (GuLoader)", "value": "dd3a09ed97f62ddcb37392273e052fe0aa33bb3b67033e9d90e7be85cb4062a5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753455, "uuid": "b400e48a-5090-46b9-bb02-ddebae559d30", "comment": "Malware payload (GuLoader)", "value": "c48be1e85875993e63836251dc0b033c9149c632", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753455, "uuid": "75dfc906-1371-450f-8ca8-63c84aea1ea6", "comment": "Malware payload (GuLoader)", "value": "1208434b19280552be94a1a5a87aed4495438177acef2e7379a9bd16c0538853be12198ef32f8d8e95ba074d56d0a4e0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753455, "uuid": "cdcdb23f-6cac-4060-96d4-84d3f9623df5", "value": "T19FC22E68C71A23392B07138D9C77C53844FBED0985A7A9F063B9726B61235ACE177368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753455, "uuid": "962de93d-ea5e-4ded-ac72-e055b7d11cba", "value": "384:iXMQenTa2e4uJxde0Q4jzVZe5uABIIcZfPZt21mSeIQ+5akjifh6D2RrmXdx6ywW:HT3eEkrWkb31fwgHGDSMialLW5Y0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753455, "uuid": "d6a623e3-a359-48f5-bcbf-6e0f7573e08c", "value": 26533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753455, "uuid": "6f15d516-b297-4feb-b5fb-4feb1bef4286", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753455, "uuid": "7a6ad763-383e-445e-88bd-7bdaadf39460", "value": "UTCB 8578\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85837c1c-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783753366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753366, "uuid": "1b60c40e-4b56-4ced-91e1-53a27c777a5f", "comment": "Malware payload (njrat)", "value": "529510a84ba8167bcd4188998a09cdec", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753366, "uuid": "a33396f5-76ea-42f3-b0dc-640a7f154731", "comment": "Malware payload (njrat)", "value": "dd5d6e714667c0699571435b4d4ada397372f49b11fe7f0f4007b3b5fa766047", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753366, "uuid": "d3612d2d-9ad8-4336-b133-4711e680941c", "comment": "Malware payload (njrat)", "value": "5b9645677e9474cb59f6ec07c486ed0384b73060", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753366, "uuid": "0db2c614-4f39-47a9-ab2a-6b6cc81f7ee7", "comment": "Malware payload (njrat)", "value": "ed5365ff9ce5cb12ffe5d99a7e2473246f39b080e29dd4d6eaa57de658076744f435e32289a93136054b8c4325f1a759", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753366, "uuid": "4d0a8647-8213-4788-8d95-ec21d6a29301", "value": "T133A33A05F8DB8A08A1B15A874A53F2754B7F791E2EFE808814CDDBC60BC35429951BBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753366, "uuid": "9c73295c-09ce-4eeb-8202-e8f5c3324d1c", "value": "768:SDtPKTYCWKd4Eu/Gh310MFj0RyeqqnIphjs98sBEnEwEXag0ZHfY2kMudw:SETsKzBB10ZW5TtHfYrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753366, "uuid": "a654ab6f-83bf-4f2c-9337-5bbd81ebaa50", "value": 98358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753366, "uuid": "c2b3512f-6c3b-4480-bed4-aa4cc07c6991", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753366, "uuid": "776b0b8c-6ab2-4fbc-941f-2686abc71a2b", "value": "TPREQUESTSPROCESSING.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9731f6-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753351, "uuid": "c873e504-f87a-47cf-8558-409427604b6b", "comment": "Malware payload (XWorm)", "value": "9189c16bf343fe61b67509c947645255", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753351, "uuid": "daca9084-2b42-4b24-adb8-d07d3bd79923", "comment": "Malware payload (XWorm)", "value": "ddc5a9b45c817b2095762c523c38ae28a816ef5c0639d74dae1855ce18f2298a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753351, "uuid": "c7970b05-d49c-45a6-978f-4b175d6f0579", "comment": "Malware payload (XWorm)", "value": "57ac3d9150677c03e47c1ade3a9b46815a50a866", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753351, "uuid": "2bac3b82-de94-4370-a52d-e211558fe13b", "comment": "Malware payload (XWorm)", "value": "2f774ead7d7383f3f718e0a984c4b488adae649ffa4b44ac39682b65190dd213050ea9c9051516190c9956faadd251c1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753351, "uuid": "b2bc6bb3-1f67-4a22-b18a-bbdb1d999048", "value": "T170555132A92D7CF4E00B2A5709828C91DD86DB7C243E1C95F4EF644E8C9589F2A5ECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753351, "uuid": "df2ce706-78c7-43bf-b050-f9e3e21b971d", "value": "192:cnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmdnmC:KNEKrgwwT6tR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753351, "uuid": "d554e9d4-6f01-4cec-bc28-5525929d84b1", "value": 1284472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753351, "uuid": "21fcabf6-0be6-4607-b3b5-1273a6a4940d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753351, "uuid": "e40c57fe-7b45-4a58-85fd-3cd9a97b0d6a", "value": "KMMHHHH.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054674b5-7d57-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783794812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794812, "uuid": "940034a9-4115-42a3-a56b-646298e2a35d", "comment": "Malware payload (Mirai)", "value": "57bdf1fb197a281083d175d006f0886a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794812, "uuid": "45903ad3-1e5d-4592-aa28-b1695553e14d", "comment": "Malware payload (Mirai)", "value": "de56f039a49168eeaba7aec02e0be7ffcb1062ca0c0714df29808a8f27188552", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794812, "uuid": "11757f71-12e0-4723-b19a-00c4dd295ac3", "comment": "Malware payload (Mirai)", "value": "49466c10b3ff149b097918e97b1fdcfaf7a3abb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794812, "uuid": "b946f922-058f-4caa-a04a-ff71947aaa4d", "comment": "Malware payload (Mirai)", "value": "2c14200889af1633b6910819f0b871292f2eb2b2154963f0c6a37f5074d67399cd716ff67a6b1f574b9d01664d6dd5e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794812, "uuid": "ebcfdcba-bfd3-4667-9664-6d65e04bcf51", "value": "T148A32956F9818B61C6C112BAFA1E528E3313177CE2EF73129D146F20778B96B0E7B845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794812, "uuid": "a4a24f87-5f04-4a1f-8b4b-22c3b104dbf0", "value": "1536:MOnuJOg2qNIOclQ9nCzrgEB6+WC5dmfaFeB9oV/UnBiPkshx5dyL769YVkp5:kJOgUOQz+ZCXmfaFIEksL5dyLG9h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783794812, "uuid": "b1562928-f738-42e0-a916-97865c3798dc", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783794812, "uuid": "0569888a-c57a-4c45-a839-d5feea86356c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794812, "uuid": "a214082f-a9bd-4a7e-9d20-003342e28f7a", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d43df0a-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783765325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765325, "uuid": "4f62e6c5-9f8b-4b19-b51d-0234cf343a9e", "comment": "Malware payload (ConnectWise)", "value": "0fbddfef0120cf4473f444bd16d98c67", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765325, "uuid": "6212c9ab-d6b2-4c2d-9f86-570413ae43e0", "comment": "Malware payload (ConnectWise)", "value": "de63e613dee432601f67650b0fdd2d4cebe88838b6ba180fe5702686585c17a1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765325, "uuid": "7ea88f89-0507-4b8d-9def-df21b7e6ee0e", "comment": "Malware payload (ConnectWise)", "value": "3c008ebe2ea5a8d5dde792e92728fdb6aafe3950", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765325, "uuid": "c39dc094-18a6-42f7-af61-66f1918338af", "comment": "Malware payload (ConnectWise)", "value": "cf3d4d9179387c3b8baa612b986df056eb792a0de45caa6d60ff9db13b61c1eecda322617054a7315e80811d6f9b0faa", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765325, "uuid": "50571d89-7758-4074-9396-481a486a947b", "value": "T17FB72356E2F900E8E57AC0B8C6575717EBB234090730DBEB51A48A692F23FE06E7D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765325, "uuid": "bae3bc98-5aef-4cc6-93b3-c56eae01dc65", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765325, "uuid": "5b0d2ac5-78c7-4663-9a8e-121a453c814e", "value": "786432:Q5psAVYbWlfFqnD7DfJ12htzhWNsKpjGct8To61nEPwd49C880Xsp:WsA7MrT2htzEnpjGi8T1nEPtw8z8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765325, "uuid": "d45ab3c7-0062-45c9-ac43-d7659b11e057", "value": 48400760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765325, "uuid": "8df11dac-a3dc-479e-887d-1e1210140516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765325, "uuid": "899fb44c-2b2f-49a3-9a55-1eb9e8fbc1f8", "value": "App94c370bd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da47310-7d3f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783784545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784545, "uuid": "6c34a959-9480-4c39-8c72-8fbc469e0f92", "comment": "Malware payload", "value": "5550fc22e086f5b41325bf1e39b37a41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784545, "uuid": "8c081a40-502e-4a50-8538-8c1a212b2b7f", "comment": "Malware payload", "value": "de709cbcd048eea3bcd5a23ba44b7726285f36f77e7bbcf351a1a468b5d5947e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784545, "uuid": "34fad82b-d0ac-485d-a16c-a5b6a4907b7f", "comment": "Malware payload", "value": "4f40e098bacceffe1081c0ec188032f3542f2d4e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783784545, "uuid": "28e7baf2-99e3-470c-a55d-de48dac43b21", "comment": "Malware payload", "value": "8d6899048878968693c6302aa3cf66d5ce2eeb67c732912d993bf314d2b5a8866e1ed44bddf70fc5e20f430f9197b662", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784545, "uuid": "5369f804-bc85-4f84-9571-73a11f68f2ec", "value": "T188C28D966A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D4B3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784545, "uuid": "f0d1111c-b4dc-4427-afb9-310958b6a081", "value": "768:s8vCB+25j6es8RS9FYpMSUpi+20qUpi+20YQX:s8l25J0d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783784545, "uuid": "e138fad4-259c-4d54-be4d-4a533063b8a5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783784545, "uuid": "22c2525a-cf21-4a8f-9c22-9c2dba3e55c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783784545, "uuid": "70aaba2d-5386-46a7-882e-8e3903e8690f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3253a22a-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783292, "uuid": "42a2eb91-3d79-4991-88b3-1adedf88895a", "comment": "Malware payload (Mirai)", "value": "10148eebe91202697a66b8a369daef15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783292, "uuid": "2337824e-abb7-4b0b-a980-47a6e64b5e57", "comment": "Malware payload (Mirai)", "value": "deaf754ff44d89f83ff622b7996592407455c9bd9485249933ee8029162bf190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783292, "uuid": "fe3ed678-58a7-4d9e-9745-d2176f176aa4", "comment": "Malware payload (Mirai)", "value": "471e6ac9520bbebcc8644d6ec26d42c21d1ed18c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783292, "uuid": "ec36a268-7e34-490f-a7cf-6834e2a8c19e", "comment": "Malware payload (Mirai)", "value": "a395bcc4fea9a3e5de03287a2326104be5f729eb7dfd3e782ea09d2ab9e2c4e94030019e310085956f2396261f7d8da4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783292, "uuid": "ab75a11d-1e3e-48d8-86c8-93eb063bd110", "value": "T1FB03F1F1E8594C07EFFC2BA23E81EEF27BE41F7E715AC19268A01E02055617D2A94DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783292, "uuid": "a8b48b31-ff1d-4312-8a16-649e59b5c714", "value": "768:VWBv+l1+5JTTamPOMZHxSQQPKCHaq3qswMr7a2Mnw4bwIo4uVcqgw0IB:uv+lI/p7ZRVQyMaq3qWr7fMnjbwz4u+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783292, "uuid": "ebaa16e0-1154-4cbb-92fc-70ddce3f00c2", "value": 40684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783292, "uuid": "c8c86510-5c0d-4771-89ca-bdb6046ed26e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783292, "uuid": "55553338-8b37-43c3-98a3-ab51ce19c98b", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a416fde-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749831, "uuid": "5d52425a-5d96-47da-b557-ae976eeef078", "comment": "Malware payload (Mirai)", "value": "ee2ecebaad072162911d857eab45fe2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749831, "uuid": "71d0cbe2-b597-4a68-ae8e-0c5ddd9270c0", "comment": "Malware payload (Mirai)", "value": "df991502dcfa6df4dce28737a575230a50eb47b835ef48366fcd1fc008add104", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749831, "uuid": "b6341d2f-320e-4fef-90b3-ba0bac2c942b", "comment": "Malware payload (Mirai)", "value": "ddbcbb85c4f62ffd6782d5facfbaa9ba20f33db3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749831, "uuid": "98583dec-dd6a-4082-92c8-06ef21bf3959", "comment": "Malware payload (Mirai)", "value": "0fd174bdd25734ce3de78308bd649e310c6676e76ab5eb96236cc29ea6a13f9c64d7537f1e9476f24f0fe64196512a95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749831, "uuid": "ba9363c7-a18b-46b9-87f4-02fe7188f689", "value": "T16CC34B0273180B4BC4A319B12E3E37E687FBE5E021E4BF89251E8B164575EB76449FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749831, "uuid": "e3b74e8a-ca1a-43a3-a655-028b1d52a1e1", "value": "1536:watoxRYHlJgblbLJnbUAoomi4JN2sZ2rKF9+1mGlXyykjIH9o:zmxRYHs0LoSJT7FQmDiH9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749831, "uuid": "dbe975a3-aaa3-41e9-a42b-cd3eadc1bf86", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749831, "uuid": "792043b1-3391-491e-bbdf-6f0ad33a799c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749831, "uuid": "794e595d-f1d2-4322-ad5a-394e34c7f5ad", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ffd195-7d1e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783770728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770728, "uuid": "2d4761ad-1322-4c5d-8930-5b75f0a1115b", "comment": "Malware payload", "value": "bb6ffcd8f5c888ddf779505789c631e3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770728, "uuid": "82cb13b0-4339-490a-ab3c-a8a4b23ef850", "comment": "Malware payload", "value": "dfa93b74300df321b1be16d78ec9ca746716f435a4c7ef830ec728620fafad22", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770728, "uuid": "92d5903e-7ef0-4499-bf68-6e116487f9df", "comment": "Malware payload", "value": "6f5a51cc4a22bc9658113549ed30854e6984b0a6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783770728, "uuid": "bab497d8-9ae7-4a3f-9150-015086f57a22", "comment": "Malware payload", "value": "a956bfd176e4d6d7bf2b444ca6aa624f101a84d2ee00c25660090183774872bdf5dbb9be2e10517c0be3a6c18f412350", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770728, "uuid": "2e2cdf63-bfa3-4a88-93c0-def2ba2834ee", "value": "T161E6334826E103FBE727403DEEB35991E47674752B3AC99B475C8BE62D1B1804E3E263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770728, "uuid": "561e1a73-1219-4abd-ba07-0afaf2e68602", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770728, "uuid": "e2d77cab-ad7e-4e45-804c-864673eadd6f", "value": "393216:qhBItyRccQXw7Bk7a/VCqXMCHWUjX2cuI3/PGTAI:qhBIj+k2/VCqXMb8XLH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783770728, "uuid": "47dcd885-1a52-44a2-bf9f-7661bcde03b8", "value": 14327527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783770728, "uuid": "c26411d6-be36-4e5e-ba62-7b46e6804302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783770728, "uuid": "bb27f67a-9369-4f9a-b105-f90561bbaf50", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f1898a-7d0d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783763331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763331, "uuid": "2526bc94-d639-4252-8a81-e18683839ff2", "comment": "Malware payload", "value": "5e78824e5a2f6c49d502ba72321a4016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763331, "uuid": "87e22438-cee5-4a3d-9c48-751ea4b2d9ed", "comment": "Malware payload", "value": "e2f5fa3fb54ab1da789789e7f33d12daab4665d72b99200018211fc1517907f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763331, "uuid": "cf8fdec6-d514-40ed-a60a-d1436ae03299", "comment": "Malware payload", "value": "9590cc6fc2bb4ef4b424aa0b4e96ca3d1188d50c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763331, "uuid": "3499d9ab-85a1-4211-9faf-b25769a36fc9", "comment": "Malware payload", "value": "8f755cc9ad547000cc92fa715a563b977930429fc150399ec0d1eb407d9a6e25b3cf870207f3b4245084f7e2920ce54b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763331, "uuid": "4422f60c-5473-4f39-8b0a-5b3b3fc7320e", "value": "T188F7333C8AF5719FEE3D4CF41170F973F66AA06E9E2C64E69AEC35613132008057E59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763331, "uuid": "211e8ca1-77f9-4839-a66b-340c85ecb679", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763331, "uuid": "788b6159-aeac-4eee-8bc4-781fd5189133", "value": "1572864:At9IKPUxR7bGYLeTqowzKYypCPRfYLgRLlPBnU6InslAWQAx7:AUKMxR/GYpoyKYyuB/5PU6InskAx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783763331, "uuid": "d056af10-7b7b-4af1-94b4-85a5095b7f52", "value": 77134447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783763331, "uuid": "5bbc2352-8579-4563-a8af-96b84a291e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763331, "uuid": "961dc09a-5dc0-4219-945e-db16784c744a", "value": "Nightmare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30269d86-7d0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783762672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762672, "uuid": "d1438fef-248f-4d86-93e6-a23e51a75ba4", "comment": "Malware payload", "value": "fde590d06d0eacc96c535d65e302124f", "object_relation": "md5", "Tag": [ { "name": "pw-un1K3NO3w7N", "colour": "#925F05", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762672, "uuid": "84f11899-386d-4bf4-a167-dae8f3a70530", "comment": "Malware payload", "value": "e36480982a5276bbbc8a8057b74986c7b1eed112739314d41d73c1a9fe5024c4", "object_relation": "sha256", "Tag": [ { "name": "pw-un1K3NO3w7N", "colour": "#925F05", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762672, "uuid": "59a4c281-f7db-4309-afd8-a0254af1444b", "comment": "Malware payload", "value": "b4e48887a6789bf78e06bb7294cb57f67ffb80ae", "object_relation": "sha1", "Tag": [ { "name": "pw-un1K3NO3w7N", "colour": "#925F05", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783762672, "uuid": "1e0f51ce-d7f1-4a66-87d2-62fd13ef8f0f", "comment": "Malware payload", "value": "d8214d65adf3d876a0a7fb80269305e660bc790b73d2b856c2034389f03db9508c7aee401c96898acca0c931db116e8a", "object_relation": "sha3-384", "Tag": [ { "name": "pw-un1K3NO3w7N", "colour": "#925F05", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762672, "uuid": "5d69d1d2-8be7-43d3-a224-25a750b4c034", "value": "T1F4D5339AD8A91D0FCB0A93766444E3DE43B4AA2E2F679C7D39B9C404B918D137CE47C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762672, "uuid": "bf127994-21ba-4093-92ec-0fc1766ecfc3", "value": "49152:U+hB95pMFr+vgM1df0oGnG7kJmFrL1c5S/Tmllkhh7MmVs04gBogewmGqZXv:UoO6L9kU1L1ciyllLmSAB2wpq5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783762672, "uuid": "400321b2-a656-4873-8441-02d3a3ba9cec", "value": 2772875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783762672, "uuid": "3f16bc47-e45d-47a8-aa66-7a537a8abb23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783762672, "uuid": "defea276-4a12-4a99-8e40-e2c16ece6c93", "value": "1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ca3532-7cf7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783753962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753962, "uuid": "ac3e0270-9582-468a-9148-359896f6ca33", "comment": "Malware payload (PureLogsStealer)", "value": "42324196954b21c39a664ee1991a2b87", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753962, "uuid": "e92afac6-1085-4506-a903-3320770c6a8c", "comment": "Malware payload (PureLogsStealer)", "value": "e52af1bb74ee3f0368ec1779791328961c86c18b73e15c3ab28b422d7cbe1b14", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753962, "uuid": "7927e95f-5a7a-448f-b557-9244bd1ff21f", "comment": "Malware payload (PureLogsStealer)", "value": "6ede732ee3f4e266d06ebf1b951959424801e72c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753962, "uuid": "f0e1378e-3664-4b8f-92ca-6925d4232466", "comment": "Malware payload (PureLogsStealer)", "value": "3af55a021e0f9480d63fc833bebc5b6948704e222bb567bd0982c2f3b8c0a1ebd3ca1ac5d41e783d94273e8068342c12", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753962, "uuid": "051d061c-2a7c-4820-b05a-02fc041021c7", "value": "T13A03C66E8714947D699314AE24793F816DEEE2BE83C9C806BD5D2CE747ACC634A2C048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753962, "uuid": "f97ae9e0-737f-402a-aa09-6a2d903212a9", "value": "384:fdofuQpu4yucuAWuPumUAH2UNjPfHtL8cFOPl/rc675:fdThoxAfm7AWUNjPfNL8cFGFrc61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753962, "uuid": "46e6f165-118b-46f8-bec1-fbb124ab99fe", "value": 38497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753962, "uuid": "8016198e-4e48-433a-9689-67f3e69d11c8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753962, "uuid": "8edd6659-0b88-4bbc-acea-d9086c78fb45", "value": "goodthingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44671359-7ce4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783745526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783745526, "uuid": "009fea21-d189-4b2e-8f6d-c97d4a6c268f", "comment": "Malware payload (Efimer)", "value": "d75bd763b7797b936d414bb696a6bc77", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783745526, "uuid": "0f3ba7f0-4727-474a-8bdb-3ef1c4bc3421", "comment": "Malware payload (Efimer)", "value": "e584366c9abd3968857b726a9403027eb6a6de036e0b3ce5c73d28db5aa6d78b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783745526, "uuid": "35525784-7c5f-4777-91b4-eedaf731d3ec", "comment": "Malware payload (Efimer)", "value": "fd71ed207c2f1921e57ee2a4544dd444ef4ce127", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783745526, "uuid": "8f3ff303-0876-4875-ab64-097c863977f4", "comment": "Malware payload (Efimer)", "value": "ed32935e63b11f7c90f30b32f878d623fa064393bb462a05018c481d5b9ce000b7ee4d11ccdc3a7b7a4f17a2065703b4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783745526, "uuid": "7e7608d8-3c77-4165-a28b-25aa0f762e72", "value": "T1E7E63348F6E402FEF4B3503CD9E09291D1A9787A1BB5CAD78754C3A1AE572E14D3E223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783745526, "uuid": "bbf517bf-dcc1-4da4-99c0-c406075a534b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783745526, "uuid": "668efc42-005c-497e-b00b-177f5e3880bd", "value": "393216:MlGjCdCAITbih+s2yvRoXMCHWUjX8cuI3/PGTAI:MiXAIvihboXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783745526, "uuid": "98f88c40-6c04-4577-b408-a79b5f966bec", "value": 14286714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783745526, "uuid": "1a04763d-c069-43ba-9341-714b08ab91ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783745526, "uuid": "82c6ba02-168e-4fee-bff3-145cfdb5e772", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad630858-7d56-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783794665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794665, "uuid": "9fdefdda-5438-41af-baf3-8f0b199ba2ef", "comment": "Malware payload (Mirai)", "value": "08118f1620c2f86f17eb01631fdf8b0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794665, "uuid": "d61c3c91-d0fa-4f6c-8d66-83ebb97a3750", "comment": "Malware payload (Mirai)", "value": "e749175fdc943fad5f97ef2d384217fe0d80c5c0795e0c804baa212c5e21c747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794665, "uuid": "c5884e92-ffb1-4e4b-ac69-2ad428dfe087", "comment": "Malware payload (Mirai)", "value": "db41d8f3f63ac6eac764e7394da014559d549204", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783794665, "uuid": "299bda8f-8990-49c8-8a5b-59b125eddcb2", "comment": "Malware payload (Mirai)", "value": "d7d41d59cf3ea6b5d5b0cee7cb71f44b94f54ef4d3ab46017fd301de5c5ef54026c6ac8eea06b7b47de5a9a34eb71fbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794665, "uuid": "a716b677-10d2-41b6-9062-3ea485a5a9c2", "value": "T178E3075AFC819F21D5C626BEFE4E518D332327A8E3EE7112DD245B2437CA95A0E7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794665, "uuid": "b27c81d2-a480-4685-ae9f-24786e998267", "value": "3072:VhrqRxgGd5Zk2k/tjhuYp/A25JMSaz79ARbNagxw/AiCEbB27uoBh8fnbzN:VhrqRmMnk2GphXprJ3anqZNagxw/AiCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783794665, "uuid": "10ce8144-bec6-498a-bfc4-e6f8e5285f67", "value": 144964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783794665, "uuid": "5e2f2ee2-cb43-4f00-a525-c99f74176e60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783794665, "uuid": "5569f331-b68a-4ca2-a5bc-824d2d3057ba", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f21a21-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788801, "uuid": "22b62db9-bdd1-4522-a66c-9a8cd50e119d", "comment": "Malware payload (Mirai)", "value": "21fdab08a5e7bed980b07e9d7dcc64a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788801, "uuid": "ef56969d-496a-456a-b82a-e3f18270e0fb", "comment": "Malware payload (Mirai)", "value": "e75e182b99efc06504b2ed60b6c8c0d72d30c9a3c13a8223888e0fde0215c1ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788801, "uuid": "873eea6a-376a-4bf3-b957-68218a7a58c6", "comment": "Malware payload (Mirai)", "value": "edcea0e5daa04e98d7474ce4ca970109e9e68dd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788801, "uuid": "a4e96de0-8ae0-4c99-ba79-3f1ce8bca794", "comment": "Malware payload (Mirai)", "value": "d62f459063bd35354d27011980965d8d009e205c0bc1d0bca8871bb5f03f43c8390fe266d70432472752cad7072c3f23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788801, "uuid": "f101530f-ce15-4756-ba36-b9c0bea4fc97", "value": "T143538E77C92C2E54C25542B0F871CA791793B08482971FFA5A99C6BA9483DECFB093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788801, "uuid": "a6df3acd-2398-489e-9ee1-fa525c30048f", "value": "1536:hIatwtTyu6UlGF8te90OZQgzHLLitKUJnl6/4nCCM1iVuQfV/nm:hIOXu6UlG6te90OZDzHLHUA4nCpikj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788801, "uuid": "d9f459c0-a840-43d2-9dfd-cef613c0e43e", "value": 64744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788801, "uuid": "24a324d6-931a-4983-a17f-7e3960206f2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788801, "uuid": "2474e2fd-baf1-4abd-9037-f90b5eb17992", "value": "XDsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce51319a-7d53-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783793432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793432, "uuid": "332f84b7-7982-4daf-adfa-7e257f4e8405", "comment": "Malware payload (Mirai)", "value": "6e85e6673da67d81c6bb8b156761fb8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793432, "uuid": "b5d902bb-fac9-4e0f-abda-8e8056204ec2", "comment": "Malware payload (Mirai)", "value": "e9272a5448f10a323a0bb2f46aa41b0205bfa5dcb5c38cb5ec276737335df421", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793432, "uuid": "c25c8efa-ae05-4aaf-a26f-e479e712b676", "comment": "Malware payload (Mirai)", "value": "07a378c086976979d4baed555f793e576f9c654e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793432, "uuid": "e9cc6e10-5a73-46f2-af06-8d8fb0f28504", "comment": "Malware payload (Mirai)", "value": "267ef0210ee68e2fa56b5858ab5b4fb2d23b7370f83adda8b4df895c95f3c2d8a4291606b8fc96643694b8cd2602cd53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793432, "uuid": "e82072ed-09eb-4fd5-ac15-c83cf3349e98", "value": "T11A34F90AAB610EFBDC6BDD3711E91B0625CC641722A53F367274C918F94A64F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793432, "uuid": "8715ab8d-1d9c-41c8-aa03-9474bc3827f2", "value": "3072:czaPIQD3fxIJp+1opQM/M9MOdUqfRdelRdQt9Dlq:oaPFSrHQKQ1fRkELw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793432, "uuid": "c2487d9a-496a-4080-ace9-ad5edcf4e3c5", "value": 245512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793432, "uuid": "870fc260-76a5-4751-962d-ed8b90186933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793432, "uuid": "6104ec7f-3cbf-42fa-9adc-f8bc5d9c034c", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767f35f5-7ce9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783747758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747758, "uuid": "72a6076a-80a3-4936-a2d2-d767a65b74f3", "comment": "Malware payload (Mirai)", "value": "124e073a8ac7a5e5e408392602fe0072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747758, "uuid": "e048772c-f9bd-4f9c-88c8-00da49735319", "comment": "Malware payload (Mirai)", "value": "ea4820cb526fb38338854fb399d1973416f00cb43761c93bd3c3984073699483", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747758, "uuid": "a63a6f76-39dd-4996-8be7-177f004fc7c9", "comment": "Malware payload (Mirai)", "value": "44781844c696f2a2d7efbda8c0f5ec6d0a38b9d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783747758, "uuid": "1d7c839c-9e32-42ee-8304-96452af65bf2", "comment": "Malware payload (Mirai)", "value": "e05b24730251a26ad04dd1803ed42c2e760874ae1de98d3aa7daea5ac9ead37d57fbea7466c23c9647bf2063d206c197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747758, "uuid": "94a902aa-7bcf-41ac-87ff-5971f9020cc6", "value": "T17263C75A6E328FEDF268C33047F74B21A75867D623E19A85E29CD1001F7024E585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747758, "uuid": "0a987da7-1ca3-4bab-b7de-6dec8bbdaddd", "value": "768:NVbxDf/9YCYJ8bZD+9VuELqZ6bnToKn7jhwsyEy0eX0BUMOnGQFLeXfRRIw3y:NVbpf+38bZD+5LqEnPeX00G2LeXfRRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783747758, "uuid": "d9c03caf-a59e-4609-ab1b-24e168f0d121", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783747758, "uuid": "306688b9-103a-4a32-bdf2-622c9d78ec6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783747758, "uuid": "8a29adf7-955f-4d0f-bdac-4fc41e19d4e6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bb2daf-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766968, "uuid": "24b79e83-ede3-48f1-b1a4-aff4d319fb9c", "comment": "Malware payload (Mirai)", "value": "7d8725e600878bf843a2bf6e84f5389e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766968, "uuid": "db887e53-806d-441c-be97-0cefc0315445", "comment": "Malware payload (Mirai)", "value": "ea4a6955a386b528801b5cd1d8fc4f25ec7c668a1823f07fbb0a23e263695827", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766968, "uuid": "82e295e3-af7b-4919-b4e4-357c59bc320a", "comment": "Malware payload (Mirai)", "value": "6fd2be630af84b9da3807fe435a2fd33b7a84c7d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766968, "uuid": "0129e76c-d4da-4bff-9966-c207b1f2737f", "comment": "Malware payload (Mirai)", "value": "04859ce90b397bbe07889fcb7c6a35f337a53f9153d06ffcda2f1d1d7fafd9aec19660d1e8c88c8f7ed5a05e127fccee", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766968, "uuid": "6fe7a50f-b397-445c-86fb-248ab589e038", "value": "T1DBF3B30E6E218F3DF779873487F74A21975973C326E1C685D1ACE9111E2028E681FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766968, "uuid": "b8c55222-6b1e-4137-b5e8-d24c723162ad", "value": "3072:AzrcggbyeP2Gi34lRTJdYcNVq/0bFCDEPSPPCuSsUgH4U+UxvLPx3bkCnbHJQ0:AfcggbyePjHUzjPxIeHJQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766968, "uuid": "7ab3567e-a92d-4867-8aa9-a0039fc388ba", "value": 161312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766968, "uuid": "bc60462c-8d4e-463b-b712-73e9c5e1334a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766968, "uuid": "a14eca26-1672-4c65-b5bd-6c214a9e8aba", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6545fa0b-7d20-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783771351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783771351, "uuid": "a869692b-21dc-426c-9eb1-2cb208f9651d", "comment": "Malware payload (Mirai)", "value": "9c583f72bc00f268c8429f093ee982b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783771351, "uuid": "29baabe8-7fe3-4ccd-a6e5-668dc3aff579", "comment": "Malware payload (Mirai)", "value": "eb0489075eb4601a2f3c3f0109daa05bb41dbbf70acba4589fa1e8baa2066e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783771351, "uuid": "eedacd25-94c9-4b1e-ad52-0d1d9292a9ca", "comment": "Malware payload (Mirai)", "value": "2b3d04865619789ba285b014df42ae3827bcd7ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783771351, "uuid": "948b262c-bf5a-4c42-bb44-44f982a7b55c", "comment": "Malware payload (Mirai)", "value": "477f406e048ff13c0ec765731c32bb78f51dd8c45f5efe4269f44d086ca58cbdd3d87e38427c10492365a1c647b27002", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783771351, "uuid": "eda5f57e-9b1f-473a-96e2-964886e395e3", "value": "T17E542856BE419F02D5D526FAFBAE8289331B7BB8D3EE3112DD105F60338A48F0E66151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783771351, "uuid": "88530dfa-3eaa-436a-be91-6b33ebce5e99", "value": "6144:aZMzTWsldXfQUHZ6DrcA8Pp06NOZvAHq3nXMpabyCpouXFCh1i2kvi5REJ1GqxAE:PlZZ6DvQXW4Hq3nXoa+CbXFCh1zv5REt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783771351, "uuid": "44600076-681d-4c20-ad90-b6dd9732ed3a", "value": 282660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783771351, "uuid": "babbeca0-e4c8-4a13-827f-1b4948babb23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783771351, "uuid": "b193d847-e52f-4111-9375-3615bae14ffb", "value": "kworkerd-blkcg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48627199-7d54-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783793637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793637, "uuid": "50ffb2b6-7fa1-4ed2-a81f-82d66de775db", "comment": "Malware payload", "value": "29096f2d4484dad3057b212bd525202a", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793637, "uuid": "a49f24ff-9344-40a7-ad80-a39eee56990f", "comment": "Malware payload", "value": "ec36fe8cf355a8a4d95392f8f6410c9d524704e7d7ce51d7f64bd950135c492e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793637, "uuid": "7fcd0032-69f6-4522-914c-bd592ba96511", "comment": "Malware payload", "value": "cc80eef46eebc570a35568e99afa45c08441c1c5", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793637, "uuid": "fa567383-8541-477b-8aee-f091225e5b7c", "comment": "Malware payload", "value": "a9532950990e44b27e3338cac0beb303e5a10afc99e48a7c4e5e5f635099d6096ca97c1c53c444b89a301a3533b8dab0", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793637, "uuid": "7287f8dc-3ed1-4275-991f-61646a9c9dbf", "value": "T1F6043B799682B9E9F596263F7B59BB19EE0EFE0103A9E49F06D4416F00934385F33B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793637, "uuid": "b9bae71a-5b51-4b5e-81b5-c80e31ebcbd2", "value": "59667224ee0313970348dd1811a42053", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793637, "uuid": "53cc4e1f-4fc5-4ce2-ac6f-d5bf36a4905e", "value": "3072:bCMzGYvgQTujce0DPWYNQ/NeSrkcupM+xMb4xsgMhwLebAoAK:eQyz0Du9dwcupM+xMMxspwLcAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793637, "uuid": "e5e407ba-153e-4cdd-b387-ad8d994238cf", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793637, "uuid": "0c930fce-fbdd-455c-97da-a8ed1bd8268f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793637, "uuid": "a9764f4c-b8aa-44e2-b58c-797cef5e8077", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e2295c-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749854, "uuid": "2048b3ee-6392-4e86-939c-63d57efaa313", "comment": "Malware payload (Mirai)", "value": "65eb7ed43e4297dcd4de79e4bbba4c18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749854, "uuid": "3d9df0ed-0de5-4f55-b554-5dfc5c226fa9", "comment": "Malware payload (Mirai)", "value": "ec4dabbfc92bd9028d95dbe4cfb0d09b25311b7d0a4bc4616603e097550ea7ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749854, "uuid": "b4873f31-efe1-40e1-94cf-b14a7700f9ca", "comment": "Malware payload (Mirai)", "value": "d3818e490afb0adb9f648d58f61f9c7f9a7bf99e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749854, "uuid": "5f2e3017-a139-4542-9674-855318c938b4", "comment": "Malware payload (Mirai)", "value": "139b4c136c512f4f6dc569bc155916ba36b5a8ef38915e551759455e9ecb9403ef0e5dc9eeb9d850c5a4be68612aad72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749854, "uuid": "2dd1979c-526d-46d7-b85c-145242d97e2c", "value": "T15AC32BC0F98B81F6C40788309166F73FDB7198A95123DA9DEF999F72DA73582912234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749854, "uuid": "a766ea1a-833f-4e1b-a806-fb363212e3af", "value": "3072:6xjlzYNVoZXRgn4c30tItERjnDKdW5oBsWrhK8HZ:CYNVoZhkD3OItYzDgfw8HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749854, "uuid": "67cfad2a-340f-4fb9-8f37-ef0cb9297aca", "value": 120084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749854, "uuid": "49ff1f13-8f63-46ec-b9bd-f26072a28853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749854, "uuid": "16a4545e-a442-4655-a21b-27471aa38e28", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe17f3c-7cbc-11f1-ac3b-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1783728607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783728607, "uuid": "a82665b4-2ec1-495c-913c-8d0bfbd11a57", "comment": "Malware payload (QuasarRAT)", "value": "270193694f668c8717d9d0dfebd04312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783728607, "uuid": "05efb620-5bba-4e1e-9db5-7ec8232f23d9", "comment": "Malware payload (QuasarRAT)", "value": "ed1565803c87371b03b576b6fcfb47ba3aeebdcfa07010f1c27ed9c91a70b074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783728607, "uuid": "844c169f-f0d4-433e-be1d-e278959686c2", "comment": "Malware payload (QuasarRAT)", "value": "b2ac5549f03df90f9f916fc7e7d3b746a7cb6041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783728607, "uuid": "4fd5da66-abd9-4697-b687-517cbd608017", "comment": "Malware payload (QuasarRAT)", "value": "804439777aa0516dd59c4f92713369c508637031259b7e02ec71d5442ce39a0b3d243a52e4fa0e983e9ffb7eafafab13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783728607, "uuid": "da7eac18-0be4-44a5-8735-3330a21ad2d8", "value": "T103751114A91878D9C86946FBA0DA3B1D5862ED4434D05CCABECF31B51E78BE2EED3C14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783728607, "uuid": "7d266546-3f9b-468c-8c36-02693042d5b9", "value": "d9cf11d5ad37e7ba4c5b3ed284f1150d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783728607, "uuid": "6f041d48-6202-42fe-b7c2-7defc192e2a2", "value": "24576:+qIWqz2eyCi4bXzBA3ULXDt6ZZr6+q/6+NV7bAnaULZ/X4EYM+6:+osyKNAQIZghrNRcNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783728607, "uuid": "2b244bd8-9490-4f00-92b5-f5a5dca5968a", "value": 1657584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783728607, "uuid": "e86a7f9f-1d4d-41bb-967e-ed32f90748ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783728607, "uuid": "afce3366-727e-4bae-9086-0c93ff70f7da", "value": "ed1565803c87371b03b576b6fcfb47ba3aeebdcfa0701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f80c6f-7d59-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783795934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795934, "uuid": "81650d2b-fdae-4e60-9e48-eabd777eba26", "comment": "Malware payload", "value": "d2d3a1ec2597e6910bb52ddbd707e549", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795934, "uuid": "89ad60b7-1b50-4997-996f-29bf465c7080", "comment": "Malware payload", "value": "edd51919f84f00e29342b8a5698a7288845efbf2e57ea712cf4dc902456134f3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795934, "uuid": "61c832de-eb28-489e-92cd-9feeeffd4e49", "comment": "Malware payload", "value": "3617049a013b859b7b621a611f83e61362507c1f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783795934, "uuid": "461ea270-47c7-416b-953a-59dc5f0d8f55", "comment": "Malware payload", "value": "b5914159688e43f3c8b068fd5e2e6e0734aef213c47efce57f0c45c74ac1777ba3162bc22346f4ce8405d3c5f16b19e9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795934, "uuid": "69503add-820e-4774-b412-7319bcce365a", "value": "T1A0E6335869E001FAE973403DEFF09B89E179B4631B71C9AF5BA08767AC132914C39637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795934, "uuid": "5ebe13bc-b5ad-4af3-8b89-2c68efa6bbbf", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795934, "uuid": "12c4f7e9-0165-4d99-944b-ea233e0618f9", "value": "393216:hzpRTwsiIJMp75wPHGFQRezFdlhXMCHWUjXXcuI3/PGTAI:hzXT7JMx5gIzTXMb8XsH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783795934, "uuid": "9b058cc7-bed8-436f-a3a0-06ec2cab086e", "value": 14299032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783795934, "uuid": "da4d5803-99cd-40f9-aba0-26356cd58783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783795934, "uuid": "6269276d-dbac-4c54-bd79-ab021f81b49d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba7c192-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783753323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753323, "uuid": "89e31e50-12c4-4925-b621-40c26be6d39d", "comment": "Malware payload (XWorm)", "value": "be6f8e7b4834064ee01ff72cd739c899", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753323, "uuid": "de1dc4cb-895f-4ed9-88c5-bb89dbc078cf", "comment": "Malware payload (XWorm)", "value": "ee51d1a275065d0aee9723013aba36d1272ef5441ad7cdfb63b0468914e0c746", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753323, "uuid": "9c597699-3d77-4b29-b6ab-d12f2b364515", "comment": "Malware payload (XWorm)", "value": "0cbf49e1873f83a08f09e910698a69d63df5f226", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753323, "uuid": "1cad0374-c92d-4fee-aaf9-649ed0cb862d", "comment": "Malware payload (XWorm)", "value": "62a95190a8c651b98801f8a9dfaa8038d3147487a559e0827fbe8e19c7d76eeb91d7f7c8c5d9b88c4de579823fd77104", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753323, "uuid": "b15053cf-d89b-4936-8e5e-1df27ed8a0f3", "value": "T116B579B3494C72BCC813A1C9F1786571E9FEE1467DEAC959612CEC8B1A6264304E8FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753323, "uuid": "9ec95a2c-d16e-4b4b-ad28-821bfa0139e5", "value": "768:AAL6DwZSp1P246hTcrS8JBN1kVyK8ELsdGT:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753323, "uuid": "875160ca-5d86-45cf-8c0c-7fc8d034a314", "value": 2325518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753323, "uuid": "33e87372-e64f-456b-a079-6820452a4344", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753323, "uuid": "b686ce01-fb7d-43b7-8888-7a2f35376c30", "value": "BBVA_PAGO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31650b2f-7d16-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783766969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766969, "uuid": "b6bce041-a714-4f87-9033-9b7b51ae0551", "comment": "Malware payload (Mirai)", "value": "6f809907dd8a9bf3181723bd90fcdd16", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766969, "uuid": "58f04ee0-52d1-48cb-bf1f-dcaae542a0f9", "comment": "Malware payload (Mirai)", "value": "eee154d3e0792357793c3cb77fe12eabe8f6a9dafee5098aca241fdc9c0aa266", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766969, "uuid": "3d7f294c-d4d5-4c29-b915-97dcb7bc1f49", "comment": "Malware payload (Mirai)", "value": "d83af7d8c4ae58e6fd67b67b9a18336b28b74cc5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783766969, "uuid": "2b3982c6-fc58-4544-af82-710ff86b89a9", "comment": "Malware payload (Mirai)", "value": "01bdc3848fc0cd73e76bc8a43d5e24a34e9d6e8c2fb1de77a2e73fd99f9c45a8dc9ebbd08572536f67e8638a5b2ff9b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766969, "uuid": "d9d5658d-a837-4db0-912d-3932d62a3343", "value": "T1D1F3E70AAF601EF7E8AFCC3705E94B0624CC651722A83BB57574D928B64B54F4AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766969, "uuid": "58bc6a76-a407-49cf-806a-f71319d8dd8f", "value": "3072:CtX8OtU08cSvSa9w1saHQT45uT922HnboEz:sXtUqSKa9w1saHfgTJoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783766969, "uuid": "3d466b4e-9f75-48cf-a31d-4d0e1f3c0690", "value": 164480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783766969, "uuid": "e6812846-c515-4388-b1b4-10014ca10df9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783766969, "uuid": "8dc08438-f0a8-424a-9ea1-b61c015ec4a0", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17041fb-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783753547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753547, "uuid": "216bfe46-cdfb-467d-8d99-2cedf57a5f53", "comment": "Malware payload (AgentTesla)", "value": "f36d565183b03f0414fe583e6af530e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753547, "uuid": "5ee23497-f7cf-460c-bab0-6c18826665b7", "comment": "Malware payload (AgentTesla)", "value": "efc1cb535085a1c44e423c0fd3fbd736d5b55514013093ad25313b42f0b3d296", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753547, "uuid": "76e40ed4-554d-4236-a1f9-b522aca59ff6", "comment": "Malware payload (AgentTesla)", "value": "bc9fb434fbb46c872e4c7faee6507f46a761cd7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753547, "uuid": "66ea0133-78cb-43b9-a3d7-78508e88ddbe", "comment": "Malware payload (AgentTesla)", "value": "e4e242a8b9083f11dd6229338c51237e78b144c2be91a02bf6dc6177b1895a4545d9989cfac5c1ca8faab5f682e64d1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753547, "uuid": "766ed48f-1111-4cc6-be6d-94cf05bf1454", "value": "T1A1C5127CF3508F8CBF3451628606E05FEB54864655C20A1BA390CEE9A5F84887E67F7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753547, "uuid": "466add9c-7cd8-4f0d-b387-5934a0092395", "value": "768:IbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbN:mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753547, "uuid": "8a8b72e4-2181-4ba7-9c65-b0ca83d0d064", "value": 2637886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753547, "uuid": "807c8f36-1885-4b43-9647-c60b57ea53bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753547, "uuid": "76da5176-2ac5-46ff-9256-cf8f502c135c", "value": "PATRICIA JANETTE PUERTO LEAL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2203d981-7cee-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749763, "uuid": "f841bd6b-2d81-41aa-9056-1c4ebfaee654", "comment": "Malware payload (Mirai)", "value": "9625e7425b5739782ce87255fb4c14a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749763, "uuid": "49326ca6-ec75-4569-b21d-f018273e1a7b", "comment": "Malware payload (Mirai)", "value": "f1bed76655cc8cce9ee9ac2857fed6b6cf1eb6a6d5446ae8144b6529d07ddf77", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749763, "uuid": "85d0b77e-db17-4b39-82a9-acf60473ae94", "comment": "Malware payload (Mirai)", "value": "acbb45fb4e7c9d5438a75b65688bad60ee21e3d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749763, "uuid": "57c06000-c9dc-400b-9714-7f446b8ca1ee", "comment": "Malware payload (Mirai)", "value": "f750b32fcdc21e920d89078f07427cb27b8e9d2c1e1aa926dc40d2b08387a64097bd016bddb8ad0ba9a1849a90287746", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749763, "uuid": "7683611d-e480-45cd-8430-fc87ac6f74d1", "value": "T1625191C7510517312EB2DDA6BBBB886D30D0D1AB64C7FFA6A4D8BCA4428DD0C7C4265B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749763, "uuid": "e2fddce6-f320-4577-a69f-bdfcb2ccc7e9", "value": "48:iJv5J+YEJ993J6PJILJcLJiTKiTGFlJXZJkvLJZ7JJmTrJITJlhTJrjVJcwF:iHA9EeacxazPwLVAClDTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749763, "uuid": "724a1504-4dea-4a49-82eb-fb19c8dff255", "value": 2729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749763, "uuid": "a3e331f4-5b92-4568-90b6-cd403ebb563a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749763, "uuid": "4ae23a01-1a73-4e42-a6af-9574c7974c0f", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd4befb-7d4e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783791012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783791012, "uuid": "843844df-a076-4fbf-97f2-02494811e178", "comment": "Malware payload", "value": "d9b964d132447cfb46b24f16578e34fb", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783791012, "uuid": "bd2359b7-0d4c-4948-89a2-4d90bbd5f648", "comment": "Malware payload", "value": "f1e053dc9a7df16e55cf465d1ef2afe6024a80f71a186c2832843b18385b1e1a", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783791012, "uuid": "223ac869-9f8b-446a-9abf-dd193a01ef9b", "comment": "Malware payload", "value": "f3683ec0c132f0b7e85947d309fe6b66a6e7cd70", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783791012, "uuid": "c3e9600b-7bc1-4d82-8c36-2991c57618b2", "comment": "Malware payload", "value": "02511ac3b8f4393cf14e7b5f3b94160bfef1374ea6e968caee378493dd5381a09bc9824acef15972ef27d703a3d5b49b", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783791012, "uuid": "4cc893aa-178d-4b5b-ac35-f96d7da65041", "value": "T17151DAC7A49D8132E31AC0EA4F97F0402663202B5F53DB3CB9BE68518F55532A6D3A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783791012, "uuid": "6163b77f-6359-49a1-9d79-f0834291037c", "value": "48:EL9Tht1xX/5KIM/EO+xX/TI8feaJoHcSNLfUNp3G5/Ws/7sWobDgFwj9yquf/9Pb:EL9TNxP5KIaoxPTI8P+8SRsn2NV/gWYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783791012, "uuid": "edff1b50-88bd-4d09-9dbe-0a38f4ca43b9", "value": 2791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783791012, "uuid": "45310427-ad28-459b-a319-65a640434fd9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783791012, "uuid": "ac8fecd0-c1f5-447d-9a2c-08949cfe7a34", "value": "f1e053dc9a7df16e55cf465d1ef2afe6024a80f71a186c2832843b18385b1e1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c971c085-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "068202cb-c2f1-4f43-8598-2fe73e0f4ffb", "comment": "Malware payload (Mirai)", "value": "8635e8ec6ee913547e679437dd17cba9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "081dae3b-6e0f-4c07-8eef-2c5ce1b3134b", "comment": "Malware payload (Mirai)", "value": "f44a7ca111bd34fcba6013f4d1a3f91663695c5596c0d3154b8272e00434795c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "5b3cc792-a4fe-4b30-bc86-8f881ef6cf0d", "comment": "Malware payload (Mirai)", "value": "c6bf28edd2b3c8318d14a681a765c2347e623a6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "1b25c6f4-5a31-4183-84dd-020589c97349", "comment": "Malware payload (Mirai)", "value": "82fd648560b67337bbf6fae75b89e3798c9a3fe0f46f6d061f53ee109d236b9911f6e6623719509843675c1ef215e090", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "c837b662-9d51-4e0d-8645-142a32ff9324", "value": "T1DFD3C50D6E315F7CF7AC823407B78E345794379622F1D684E26CE9255EB428E242EF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "c9ce0467-ead4-4e3a-bae6-4a24285f51e2", "value": "3072:szxUWO5TiOB15156SStoU616RfCqTKTITeK4G2bBfHyRnJ:sK5mOzheoMfCqTKTIOG4BHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765506, "uuid": "e6a28e78-dc2f-406b-9492-e6cd5460af92", "value": 134052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765506, "uuid": "d3833017-56d4-4386-ab04-4e4f74bfb0f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "62fe2492-3d7f-4085-a9c9-91242d0c0048", "value": "Ares.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa393e3-7cf0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783750717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750717, "uuid": "39c05d7f-beb4-4b33-b44d-83ec2f719cf8", "comment": "Malware payload (Mirai)", "value": "9242324830d0a5c2e40d66f11b378d43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750717, "uuid": "fdb3bbe2-6519-4b7b-83a1-9e7f4d21a700", "comment": "Malware payload (Mirai)", "value": "f5e0ff27a05a101bb36993bc2d1a5efc755a51f8482151396381b5c5049f9770", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750717, "uuid": "1109ab1d-2690-4601-938f-b7de69ac6417", "comment": "Malware payload (Mirai)", "value": "32be84693a569b5383ec5d5c20d332587251a9e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783750717, "uuid": "929f574a-d426-4c42-a06c-107bf3e15a94", "comment": "Malware payload (Mirai)", "value": "4fb1dbbdf1dbe0792e415d04a3508f426a522eea4f23a0ab2691c2af576a14a20a54a9153099b06c82a9cb3a794ae33c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750717, "uuid": "13b550dc-4142-4a1b-8908-c2272ffd9a1a", "value": "T188942307E1018D59E854DCF709FB001A380D7BAF3996915EB8ADBE7D33459295AF2B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750717, "uuid": "65ed0513-c866-4413-ac68-c0885c23d262", "value": "6144:tP1lMq69/l/chyP8P4tRzBlSNNrSULfxnipCO8D8rm2KsqnlwsjV7387YVOLPKL0:/ichFizBlAvfYCzD8rXNqhVg7oP4l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783750717, "uuid": "639ba72b-8077-47c5-88d2-ce0376cc9ca4", "value": 426356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783750717, "uuid": "4b8d789e-1a08-4893-a248-502ed1b6814b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783750717, "uuid": "106abf4e-9147-4421-aec7-61579077f4d9", "value": "kworkerd-rcu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd2f860-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748122, "uuid": "3d71d335-665f-4862-a92c-3b603785b23c", "comment": "Malware payload (Mirai)", "value": "1ecf9e712034f86755e2852c4fc5c33f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748122, "uuid": "c3929856-1e33-4540-a730-3f97d586e602", "comment": "Malware payload (Mirai)", "value": "f64518bd3b3a5bb045e654b17bb9ea81adfa48bbb31341e90b98ed6c25a21928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748122, "uuid": "8a740c2f-afed-4cba-9e61-0617836595d1", "comment": "Malware payload (Mirai)", "value": "7577add6d9712b450802bd9d2df16f67c0278062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748122, "uuid": "3fdf7118-f73d-4e98-8282-485596d4a0e4", "comment": "Malware payload (Mirai)", "value": "9607bd89e1417c2d29ef7b10e0169a6dffca3baea0116d015d8ad6939d13a9ba832eb0f366db598e9ce0c0f07c2e16b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748122, "uuid": "ff9c12bb-6755-4612-a5ef-e90863b9f53c", "value": "T1A8B31959B8929A23C6C616BBFA0F42CD772763A8E3DF3117CD155B20378B52B0E6B150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748122, "uuid": "dd202f3d-6d11-4992-a420-68c61e378e44", "value": "1536:5i3JDCERHZw438CE636zol3pbQl5Ef9FjsQc5nqZP2Aj/ygwrkqmrRliWQSp4v2r:43RC8HZ0mhWY9FjFc5OOtrkqmyH2nbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748122, "uuid": "835b95b7-a19a-4c5a-b456-46edc60cac3b", "value": 108780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748122, "uuid": "4c174b0c-8f5d-443b-85de-4eea79f5eb18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748122, "uuid": "8b57eebf-7b13-4678-9c4a-3fa379cd1d39", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c399b1e1-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753471, "uuid": "2860f9e9-b66c-4517-b6b9-adae2222a0a0", "comment": "Malware payload (Formbook)", "value": "29d9c65994d96ea299fa0b5a31f7d5c1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753471, "uuid": "2977fec6-b9ab-4d6d-9c74-ef0049c0a58e", "comment": "Malware payload (Formbook)", "value": "f6a4fc3c174fcc9ba60d33c19f21716f56cd282af10e671893dc2f54cf415968", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753471, "uuid": "f842e0a6-df7d-49ff-8678-0177ea48661d", "comment": "Malware payload (Formbook)", "value": "f64a4c7a254c454e06b615ca9ae6405394724523", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753471, "uuid": "04e35f25-3b1e-4c03-85c3-a87a9e02b7cf", "comment": "Malware payload (Formbook)", "value": "33e4b5af844f00c9bc4b68125cd2233bf4ebc43177f80fcdb4d465873c940d046ba24fcd48f40282265326a5dfcf3d28", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753471, "uuid": "9e3eebba-1a40-457e-bd3e-50deb4ffce44", "value": "T15EC2422DE31A00E4C7091B7E78670564B898970B9063DFB073E763F42309486EDA76F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753471, "uuid": "7d9e9536-e37b-4c62-bb62-35161f038672", "value": "384:iXMQCndL9aQIdCHmWcuLUaWBb1plk7O5xB0D/lM3UO70O:BdLV6uLjWBb9k71tM3D0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753471, "uuid": "0d55a1ae-6dfb-4e94-a3bc-8f6161bfd80a", "value": 26095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753471, "uuid": "df671860-6471-4ae9-a7d5-027049331476", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753471, "uuid": "43d3da08-f792-4ea2-b83d-f88e37d2ba3d", "value": "Luksu112.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0774b843-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788803, "uuid": "c97be860-ff4e-428e-8302-84247aa7132b", "comment": "Malware payload (Mirai)", "value": "2579d69b5eb6ac89c28c41f28ce6cafb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788803, "uuid": "0a433a70-bb83-40dd-9eb4-00cb4d33d2ae", "comment": "Malware payload (Mirai)", "value": "f6d09d77da7dab13214c756637c5543e5e31976b622a8711f864d2544e9e0cbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788803, "uuid": "a0c639fa-7f05-4c5e-a14c-9ed47e077ec7", "comment": "Malware payload (Mirai)", "value": "5cf2b08ea6927130a09e162fb66a1a17dafdac9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788803, "uuid": "0626c378-7925-452a-a5fe-cd34bfc33db5", "comment": "Malware payload (Mirai)", "value": "fee715e7587ea079affbceee3f16c239237fbdc781e2b3ebe7d397d210544611132abb85bd65e4a3cf74ab765e41e50e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788803, "uuid": "6853a1d9-5777-45f7-8fe4-ec9a15f636b3", "value": "T13C632991BC815613C6D022BBFB5E428E372663A8D3EE72079D256F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788803, "uuid": "be6d3167-da83-4757-a3f3-43932a5c0631", "value": "1536:azC1uwL8SX08O025jg/r8UT7aAouhEBPBiV/hD:azCLk5M/rV+qhaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788803, "uuid": "a29abc20-1da1-43c1-9a75-fb3acab46042", "value": 71900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788803, "uuid": "b973ca0b-ebf7-4c1b-a221-5f400d95ecac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788803, "uuid": "9b960bd7-847d-4fe9-bc5c-9a9ddb8691b8", "value": "XDarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa2be4d-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783341, "uuid": "ef04d002-6bb0-4cfc-8e9d-5ad3f2c3a891", "comment": "Malware payload (Mirai)", "value": "6e3aaeadc0297a469ca7a7fdcb65ac64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783341, "uuid": "76877d34-3a76-4d7d-be9a-6dee9b5f2037", "comment": "Malware payload (Mirai)", "value": "f754f5d37da6161bbd4379b7661e46fcedeb19d52dc62e10500e5d2198de7c57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783341, "uuid": "c19d137e-d7f8-44e8-bfba-5925e5928e0a", "comment": "Malware payload (Mirai)", "value": "05c3d28e1768b871b9ab11ccb917c5b6c6cdde2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783341, "uuid": "1e58af1c-854e-490e-8d81-35b6c969a865", "comment": "Malware payload (Mirai)", "value": "64dd5693c3f681d8c68e18897ef686ce58c6381b82cc38251a3cf61cc2bfeeace43e883a8a6cb93f9a87c5552c7ea09d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783341, "uuid": "1ccdc955-300b-495e-969c-e2628df010b6", "value": "T189044B46EA418B13C4D31B79B69B424633239B68D3EB330699287FF43F8679E4E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783341, "uuid": "891d5c4e-3498-41c9-b356-0b08fbab98eb", "value": "3072:RlNTodQGSE3tarAxU7aXYRPi+3p9jBb7Q9rovvM/9MTcKHnPkgS:bNToM8tarAxU7aoRPjpLb09roHM/9MAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783341, "uuid": "d3bffa07-8496-439e-bc47-7a524c1fa568", "value": 182224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783341, "uuid": "87faa23a-d4f6-4641-b45b-ac5e136335cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783341, "uuid": "8c6dcffa-f515-4be8-a61d-16d677cc2ec8", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ee4875-7d11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765071, "uuid": "056642f2-16da-4361-acfe-af9099c89823", "comment": "Malware payload (Mirai)", "value": "0f6a4b0f9db368236abe38b17de3a5cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765071, "uuid": "959435e8-63af-41d8-89ab-63a98c3b2032", "comment": "Malware payload (Mirai)", "value": "f7d6006db14752afde4b6c4fdd6fcd2f777c0d36e24a258ccc3c82470c27744c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765071, "uuid": "17b401ee-b32a-4c44-adc7-68d0b3220b2b", "comment": "Malware payload (Mirai)", "value": "30ee4488dbbcc447546e90f73cf4474d6b1a9640", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765071, "uuid": "7cb9e46e-9267-4ab9-a94e-78a5ea2cf7a2", "comment": "Malware payload (Mirai)", "value": "5ba35652927f6817892aa0df4f6b99636742f820bc10caeda3c94d2946b82680e0e28166bc778d4faba2e62166c3e522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765071, "uuid": "2c85fc42-282b-4ff9-b58f-5b275c7bd5f1", "value": "T18FB31999F8D29A12C6C516BBFA4F42CD772663A8E3EF3107CD155B20378B52B0E6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765071, "uuid": "0a2f75e5-74cd-4919-8570-dbcfc0c09bb4", "value": "1536:jMDrTnikBX5dzNKNTbqSQu2UFAyDQH5nuQC3nXKytwkFkO/jpzmvbLyrINp9nbZN:w7nisSqh5yDi5XCUkFkObWb0Ilnbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765071, "uuid": "739bd8e7-dfee-41bf-a2b7-4263a1ba1478", "value": 107892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765071, "uuid": "67bda275-f82a-452c-9d40-260111b1667a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765071, "uuid": "067b98b4-b7ed-4c94-9308-387bd3f73cc9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3fb628-7d3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783783286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783286, "uuid": "4249a244-d071-4430-bd4c-cfc102970d89", "comment": "Malware payload (Mirai)", "value": "5fc3422f9f027aa764380348f7d04d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783286, "uuid": "f5e03e66-c7bd-47a8-b0d9-500e6c6c8c07", "comment": "Malware payload (Mirai)", "value": "f8532a970353a36275e219fae69e8696f5a704e76b5925ba624a8be188720f45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783286, "uuid": "76a0e2b9-3c62-4796-bc00-13ba44b43ce2", "comment": "Malware payload (Mirai)", "value": "ba390a9a91eed3d834c56b54cc9450ae7276abdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783783286, "uuid": "c3d6df08-af31-4b08-8706-e012500b0efa", "comment": "Malware payload (Mirai)", "value": "8275693a7acb9050f529a68b237b1936e69fcdddaf8c855d615d7b929f34c16df889515d0668e0a2b2eb5f4e66c84c1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783286, "uuid": "9e28bfdc-e22d-432f-a90d-de1174dc8511", "value": "T19403E107A8EB1B08E86DC2792A7D2F870C719A49768F20D9BFC665375844B5C7432B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783286, "uuid": "99a4e230-2f5e-4578-b150-702c1fd161d8", "value": "768:cMRfsw6hTmJeL6AwxTqv1pt5HcDzbYHsA6p/tEFiMAnbcuyD7UHQRj1:cqfy2eOAXpbHcDzbYMAGtEi/nouy8Hyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783783286, "uuid": "f9df4c40-8749-498d-972a-78084e9bcbf1", "value": 40876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783783286, "uuid": "a3159780-52c9-465b-91e4-552843c48a9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783783286, "uuid": "8072b424-1bf6-490d-aeb0-a9a7b6955277", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530238a4-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783748128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748128, "uuid": "fedc284f-ac75-4be7-be86-708fdc7741f5", "comment": "Malware payload (Mirai)", "value": "e2a0ad7b2a1b341f72b8728905d50f8b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748128, "uuid": "5a83ce1e-ff6f-4052-93dc-1c02d7cd80db", "comment": "Malware payload (Mirai)", "value": "f8a2d018127d94ab2de0ed028463db33663d4c2a68239428367ed435b2f4fc96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748128, "uuid": "397599c6-b4fe-4894-a66f-aba9c78d2009", "comment": "Malware payload (Mirai)", "value": "1baaf1cffc765fa90830cb80fb113e5d45a7054a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748128, "uuid": "ac8bd372-d5a3-4461-b89f-4ca95e01c2fc", "comment": "Malware payload (Mirai)", "value": "da5563a6dda2c3f65a2af739ab2aecd12096907d405a41a6f068a9fd68f9a1682e2baf69f573a49761358e3c5283bf83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748128, "uuid": "85570aeb-7585-4969-bdf3-e545ccf7035e", "value": "T12BE01CED79951B7B8E44CD43E863886E615BAAC055802BCFB9CDA5A65494A81F030E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748128, "uuid": "8c79ff7d-bf4a-487b-a0ee-71439ce1705d", "value": "12:ShJSYh3a/L0+h3aQeLz+h3aq0LKV0+h38b+h3+J:Shdxcfx6LqxoKJx8Sx+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748128, "uuid": "308254d2-0033-4ae6-bfde-d25bd5692e09", "value": 437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748128, "uuid": "0e545022-748d-475a-b6bb-85718818d34d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748128, "uuid": "7f3ca669-8250-40b5-b4bd-63adc1238022", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c10df20-7d49-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783788811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788811, "uuid": "ac5eca6f-48e8-43e7-b432-2c3c0d873bcb", "comment": "Malware payload (Mirai)", "value": "527c35079a47ed5cb118888ab32dfad1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788811, "uuid": "674a7917-ef14-4804-970c-0d1dd6df5f93", "comment": "Malware payload (Mirai)", "value": "f97d41ff38f168ec24969ee0cae1817a8f507bfdc03dec82740b84bfc900ab28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788811, "uuid": "62a2f94b-5539-4004-ad34-d4dbabefeb81", "comment": "Malware payload (Mirai)", "value": "8c4bf5e20f1325c802968258e3d764b9975cb51d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783788811, "uuid": "c58d02e5-c908-4d22-8fa7-cb4995d0f8d6", "comment": "Malware payload (Mirai)", "value": "d1e97aa638950e7fb82a147d76920d46360b79485a4e7f90b41bcbe7f5bdcab8ecddb11ba1cee48f471e32d78900bce7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788811, "uuid": "e9f2aca9-c6de-405f-a464-f2e275fc684e", "value": "T13A832A97F401DDBDF80ED77B4463490AB631A3A106830F3A675BBA67ED321945826FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788811, "uuid": "34dec7b5-8aba-4dba-b7ed-06f3d172940e", "value": "1536:4jKI91vPhM54FwSAakqE8Pc/CbmjhFaipTO1f7/aNisFp+/qXvm8:4eI9FPvOSbkqrUGiZOxmFp+/2m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783788811, "uuid": "5ee57726-ea64-42de-bfaa-0d650c2cdf13", "value": 81860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783788811, "uuid": "59b9f2dd-7ff1-46e0-b279-35d19622ff7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783788811, "uuid": "4aad4739-5e3a-4546-8f0d-4d1b53c2e127", "value": "XDm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7382df5f-7cf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783753336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753336, "uuid": "6cbf811e-0b81-46a3-92eb-bf5d8f2ba685", "comment": "Malware payload (Formbook)", "value": "b9883d690186cf0326468f357ebb3909", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753336, "uuid": "7667905f-8cff-4087-a3d3-bf6f6912a561", "comment": "Malware payload (Formbook)", "value": "fa5b53f43f080cf1ccfe9cc7431f5a4190657cf81368cd001acf9e99882b7f0b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753336, "uuid": "9c1599e5-2dcc-4799-ac7d-4c1fa1e679a1", "comment": "Malware payload (Formbook)", "value": "d1552ea3aa4905f2bdf17bd9d1dd2b7517d8f6b4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783753336, "uuid": "ef47bf25-cae1-4a4b-9e4c-0903b96b1383", "comment": "Malware payload (Formbook)", "value": "fc287c960d1db398443d464dafd14cf76adf72acf812e176acc9fe9165d61668cdbf83da0f5b88ea2c4449601816086b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753336, "uuid": "cf230eff-b548-4c3f-925e-1d4f2d242a91", "value": "T115453354BA6494624EE8A31DF10F2F1B4BE05F5CC486F1F053429CAF21EEB215A6FC99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753336, "uuid": "845b0f9e-a77a-449d-a3c4-bdb27298b8e3", "value": "24576:DboQCEmI1vutgm7r6QwV9nlIqrKJMD6QCICz2Y/6mq35BM7ej/O1ga2:YjI5is996Eo6Z5BMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783753336, "uuid": "859fc1ce-67b3-4bca-8fe9-2521954c72c4", "value": 1277519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783753336, "uuid": "7b5d26c0-55fc-44f9-999b-7bce3921efc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783753336, "uuid": "595ea366-f9d5-4307-aed6-f544823fda2d", "value": "Initial Purchase Inquiry.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9b4fa2-7d54-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783793801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793801, "uuid": "7a251c1b-f64e-4a37-90a5-3b1786da69f7", "comment": "Malware payload (Mirai)", "value": "064597c7820ee422c49cc317ca5d9933", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793801, "uuid": "752c51ed-2826-489f-91c3-4075f86c5727", "comment": "Malware payload (Mirai)", "value": "fa7909526294f9a963b87b828c32b336a4ef87c2e7ca8bc81a83da68a6d8cc7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793801, "uuid": "3e976cf1-972a-4afb-b3dd-e84d8d3f8093", "comment": "Malware payload (Mirai)", "value": "32f599a01f2fa4230ef3f5fc09d802eef9a7740e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783793801, "uuid": "d9bbf804-2c00-4675-9704-2bf10ea06229", "comment": "Malware payload (Mirai)", "value": "7cb9cf531dc7e3c461912fb45731c9e2cf33b5659e111b95674a521a4e0c4404a2d70550899c37b66c3f69ca5493094f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793801, "uuid": "3b8b18a9-f699-4f49-9a25-27953e0dc17b", "value": "T19F13F11588E1DB54D571B17122F3265A24782E6E30E84F78B7E4BA3171ABF0D4B8CF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793801, "uuid": "56015536-4f9c-4b0f-8ab4-73e686472c30", "value": "768:kzGlucmDx6amz/qIqjuVfiQxJjR7aWLanLsMvPdV6gu2he0fHbgMs67FRZnbcuyb:kkQmzvqs7snLsadAiI0f7dFPnouy8Hyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783793801, "uuid": "2f28d892-d3bb-408e-ae19-2f6df42c997e", "value": 41796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783793801, "uuid": "a237c94a-f496-4bda-87ad-998bb07e34d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783793801, "uuid": "19c9d710-f25e-4c31-b2a2-dea8d2279278", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a992d2-7d41-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783785555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785555, "uuid": "98cd7c0d-286e-480a-8d46-2d1c3de1b7fc", "comment": "Malware payload (Mirai)", "value": "8765e4651002957211dada2133601d18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785555, "uuid": "79c1a194-f2a8-4542-bee1-b590256eeb9f", "comment": "Malware payload (Mirai)", "value": "fa7d6283f722161120cb3991e16135f130579f9d6d3c30735dfe3cafb4b1b1ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785555, "uuid": "c7419bf4-e4b7-46c3-aa8c-06f71623b777", "comment": "Malware payload (Mirai)", "value": "12e148e3a7fc96bd7c2097ebe15f769792b83db8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783785555, "uuid": "9b4e50e0-d7fb-462f-92d3-d2f6573181bc", "comment": "Malware payload (Mirai)", "value": "438aba788da84fcaadd570bb0360e74253ab2c1fa82996bc1e4ef62f61cdc891ee3d72960aca69246536b75396ab7eda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785555, "uuid": "ec41ef30-acab-4f29-ae6b-eead9e0c7864", "value": "T1B634A51E6F228F7DF269877447F78D35976C23D623E1D681D2ACC2105E6028E542FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785555, "uuid": "f429876a-e13a-4298-b820-5db372b2182f", "value": "3072:yNk724f5/XrUwH7ZKCBP1r9C5FPCVZsIY7dWo9sGNG2o:yNk71xPrUwbHm6xYIo9/po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783785555, "uuid": "b27d3b2f-2c74-47f6-8b07-a5a8398df481", "value": 241480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783785555, "uuid": "61214d35-e3cb-4fbd-8962-eff7da40a1bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783785555, "uuid": "af910793-06ef-4a2c-87bc-7d7f9c18de9c", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fa66dd-7d38-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783781598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781598, "uuid": "80c4d157-4afb-4109-a068-24cc832eb5c2", "comment": "Malware payload", "value": "b3ad8c87da9eacdfb198168c0cf6acfb", "object_relation": "md5", "Tag": [ { "name": "gravitlauncher", "colour": "#E4CE00", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "killbot", "colour": "#FFEFCA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "XLauncher", "colour": "#42A2EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781598, "uuid": "e28fce00-6aea-4a72-a88a-2dced4c35713", "comment": "Malware payload", "value": "fabb1ae2cdcb10601c0d7e37a9595796de99d2a1339f121cc6b935f81a783057", "object_relation": "sha256", "Tag": [ { "name": "gravitlauncher", "colour": "#E4CE00", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "killbot", "colour": "#FFEFCA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "XLauncher", "colour": "#42A2EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781598, "uuid": "f18da87c-1b37-4189-a614-27c0940e91ad", "comment": "Malware payload", "value": "ece55190cc00496df0831de9ba317b5f6e659ec4", "object_relation": "sha1", "Tag": [ { "name": "gravitlauncher", "colour": "#E4CE00", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "killbot", "colour": "#FFEFCA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "XLauncher", "colour": "#42A2EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783781598, "uuid": "6f4d5177-e9bb-4867-aefa-c91970630055", "comment": "Malware payload", "value": "399163f6896165754c01aa9ef7661c75efe3e7ccc3480f70c9893ec21a340ba92127bccfc2dbd26fc6f126e1c7b5d5bf", "object_relation": "sha3-384", "Tag": [ { "name": "gravitlauncher", "colour": "#E4CE00", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "killbot", "colour": "#FFEFCA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "XLauncher", "colour": "#42A2EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781598, "uuid": "77df0188-fe14-4574-b20a-8de014e6126b", "value": "T14C86D017ADB8CC6CD5A384331092C393D21AE14DAE0DDB9F13B11945CEE496B5B12BEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781598, "uuid": "b7ac89e5-82d6-4943-abb6-c5f65a1a7548", "value": "196608:pvXqJGazRpON386Ip0owfRxuDV6RfhhvizcjcrppkkS:pvaca1YNFk0o0uDwRZOUcrM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783781598, "uuid": "d1ae9e53-940f-426d-abb7-017d410b0708", "value": 8528450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783781598, "uuid": "15fd48d4-6bb9-49e6-9681-290b4c7f81cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783781598, "uuid": "2bc6e5ac-818b-4ea5-aae4-9f7dde70046d", "value": "xLauncher.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9a202b-7cea-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783748060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748060, "uuid": "24118858-8f8e-4242-a5fc-dedd251aa24b", "comment": "Malware payload", "value": "bc408fa782d034e402d9199729076eca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748060, "uuid": "4690b7d1-a750-4175-9c13-3c38bb64c662", "comment": "Malware payload", "value": "fad57a8eda2f6c82664131cc3abec26250bc5e0088769c6dfa72f51f18cfc055", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748060, "uuid": "a98d8737-5184-453a-aa26-6e672e54e3d8", "comment": "Malware payload", "value": "10d05766c1e41869a677bdbd16d92b11a35fec46", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783748060, "uuid": "0e413a10-6d39-4d37-b6bf-87066494b4cf", "comment": "Malware payload", "value": "26efde1896d62565c63c8fccb145ed101695a066bfe671bef816e33da6f796db7dc972f168a4c49d0981c30946a1ba24", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748060, "uuid": "072f065f-038d-4083-afa9-31c57c84577e", "value": "T12AC2F1F1F8ECA435369D853ABB9CA805A9DF7C2F4DAB7D2014175938421CB1DA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748060, "uuid": "a8efdf1e-f1d2-4368-9794-3a43fbb16b21", "value": "384:NV9bud3s1Du7isjsKG6q/A4UAbMdhQuW57:tQsDlUMdUA4z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783748060, "uuid": "7873b6a5-d0ea-4288-8deb-25cd40312daa", "value": 26454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783748060, "uuid": "198d5371-d2d5-49c4-96a8-d7f6ae706da0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783748060, "uuid": "6b6c6b23-fe65-40b3-9db1-f460d82401d4", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a00a9a-7cec-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783749129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749129, "uuid": "4f91529a-a1c7-44d3-9ab5-ea2d0c2076ec", "comment": "Malware payload (Efimer)", "value": "4043577de29fe65f00daba800ff1fdf8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749129, "uuid": "07be31b7-a0cb-494f-8ca0-71eb72217881", "comment": "Malware payload (Efimer)", "value": "fae5614d9fac644c7e015f1baa78d0a539aadb08d2959381c29ddfcdcfca005c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749129, "uuid": "d43d77ff-93e2-4d97-8ac4-c061ccf3a623", "comment": "Malware payload (Efimer)", "value": "97b91861bceab36336ea69dd90a179cee8e227db", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749129, "uuid": "a554307d-d8de-49f6-aae1-8e3e6baa5157", "comment": "Malware payload (Efimer)", "value": "bb01a5886c31ed8fd85e1ebc3b6521d41b613249e18a9bb65c4009ef1297297f56545da6c05e3ed9a583e9d5d5203603", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749129, "uuid": "446bcd49-1ad7-4945-8097-e48003e9046d", "value": "T10DE6332826E403FDD3B3417C9ED18AE6E4EA34761771CAAF179847A26E931D04D3D683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749129, "uuid": "84784fdf-99eb-4e52-afe6-42479b38565b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749129, "uuid": "f8a788bd-16fe-466a-8b9a-65b888ec3673", "value": "393216:ToD9Bn1h1jxWXy6k7sRCaKOt0XMCHWUjXMcuI3/PGTAI:ToDb1/9h6k8Ca50XMb8XZH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749129, "uuid": "7f04043e-9939-449f-b88d-11144eb32f0b", "value": 14304966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749129, "uuid": "e9a00eae-56cd-48b2-a402-87398b600376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749129, "uuid": "89b66187-c233-4e69-9a4d-de5e6791fcbe", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2091395e-7ced-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783749332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749332, "uuid": "273d7895-f750-405b-9209-43d02461588d", "comment": "Malware payload (Mirai)", "value": "00579de327a9321f614a3c76a6458a0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749332, "uuid": "faa0269c-0222-4a58-b560-58c699e21127", "comment": "Malware payload (Mirai)", "value": "fb195e1095ec81e1413633cab35c567b6d9f9c9e7da54cfbd2f3e1e4e36ff6c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749332, "uuid": "7e5413d9-210c-4200-8fde-ee2114d35acc", "comment": "Malware payload (Mirai)", "value": "f12246be6bf171b6b0660edc77b4bcc94c2094a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783749332, "uuid": "eedd9f86-1b41-413f-a5f1-bd2237ac25ce", "comment": "Malware payload (Mirai)", "value": "ecd7485be81e4ea17ecea534a7255b89f2e513f0efaa945604af810297354e6d36be6b798651c6991b64bd5b324964cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749332, "uuid": "57d7b91a-1e39-42ea-a9ab-0040b81a27c2", "value": "T173833AC4BC81A621C6C2267BEF5F018D335697E8D2EB33479D290BA4778A91B0D77B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749332, "uuid": "e0bfc130-515c-4802-b249-7be56b94291e", "value": "1536:XUk6anMoPe/L67Toh4BXmxJWJDzNxjuW+wYQ0qQICorOGCMzwDXBWvzwVW:XUkfnMoe/L6w+0xEJDzPjuv9qVCDGnwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783749332, "uuid": "6eed00c3-75fb-4101-a311-a459c49953de", "value": 87248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783749332, "uuid": "96826f3f-e6f7-4e75-8548-a813ef665323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783749332, "uuid": "c3fbb96c-91ca-446b-8b0b-f6bb5e93f091", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e40e048-7d0e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783763528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763528, "uuid": "bdb80d40-0be5-49e2-baa1-b2651d02fd01", "comment": "Malware payload", "value": "d99bf843d1db22bdfebf3f3078918105", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763528, "uuid": "7af2630a-d8e1-44ab-bfe7-964de618a7b3", "comment": "Malware payload", "value": "fe7e231c3009a8b18015eeab74022ffd0983dbfd8acdb369ef8fc1f76922e345", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763528, "uuid": "f4ab1efc-7d65-4dbb-8db9-ae66bc28250a", "comment": "Malware payload", "value": "15a285bcadbff4c25a4f0ba13af033a996503ec1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783763528, "uuid": "2e0df56b-c460-4c0e-ac96-f19b50d6c149", "comment": "Malware payload", "value": "fe646b82c8e2db798d7d3aa09ea052039a807a087deab00285cc92b3ace077a8e2cd5551e867c0feaa3ed6387bc0cb5c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763528, "uuid": "ccee7260-77ed-411a-82de-9ba712f77d5f", "value": "T177E6335A95E011EED4B7803CE9F206C6E4A4343A4732CAAF47D4D7B5AF572E0093DB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763528, "uuid": "d5f9697a-3373-40ed-962e-3cc6a2691648", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763528, "uuid": "7e0b4e39-8d12-451b-bd80-fd49557ffaf7", "value": "393216:7xxKmKnQ0u22XVxg+kMkMGXMCHWUjX9cuI3/PGTAI:77KZQdU+kSGXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783763528, "uuid": "ad29715f-4af4-44d4-94dc-64d629fc1a61", "value": 14316676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783763528, "uuid": "c64f3d2a-4346-4b66-83ee-281516c63209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783763528, "uuid": "fb39261c-377c-4410-b08f-b10fe0fa9968", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9293b9b-7d12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783765506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "34d3ff0e-1911-4933-935e-90039f04ed4e", "comment": "Malware payload (Mirai)", "value": "8d50844f8d56ee8ebd986d14abefecbf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "3b666a2c-3da0-4fbe-b90a-587c2e8d2967", "comment": "Malware payload (Mirai)", "value": "feecbe2af6e02d5034b72cded3f9a67642508bfdb981cd8d3c711c611a6fd0a9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "61ee43d2-99cf-4a96-bd2e-38d4000369f8", "comment": "Malware payload (Mirai)", "value": "709879b72f1a44ba8fbf4b927de2bfd1bfb4c2cc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783765506, "uuid": "11960864-2b89-4cd4-a08e-be104fcf324b", "comment": "Malware payload (Mirai)", "value": "d63b8b38dde38b559b09d97886565eb71205944e7a82f6b1d29c54e7eb10320b1e387a596cd02a0208ac7cbdedc70c04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "495804ce-afe0-4216-93c1-ce8244292e20", "value": "T1CAA34BD1AA83E6B9CC0047BA30DB9F3289B7D97F1117DAC2E3E85C77A94541181076AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "03ac70b9-f9e4-433d-8428-002802b6a11a", "value": "1536:Tyv2kdC8F7wUBJxN3keJ8NT/C9Jgz22zfprp1zED04onpJQ35:Tq2vUBJT3keJ8NT/CJx0fZ/o42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783765506, "uuid": "d42c2fd2-997e-4481-b83b-bc2edf571b44", "value": 99376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783765506, "uuid": "393febb4-6a7f-43fc-b579-d14b233a3050", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783765506, "uuid": "4074cbeb-cd68-4dd3-a74d-201f6d6fd2c9", "value": "Ares.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }