{ "Event": { "published": true, "date": "2026-02-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-02-17", "timestamp": 1771372982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4ddec21b-cd65-411e-b682-149bca327d95", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dfba83-0bdd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771318177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771318177, "uuid": "6a6a67b4-4af6-4635-b594-3cd08943729d", "comment": "Malware payload", "value": "2f1ae97570469357351646187675a3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771318177, "uuid": "62387bc4-5e81-4cfc-ba99-fcab9b74006e", "comment": "Malware payload", "value": "00af21794a2dd1fb27e5f8200583ddf35dfa192d0ae0fd9095637a21953cd776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771318177, "uuid": "abbba58a-6b92-424c-a385-9e0190047c90", "comment": "Malware payload", "value": "5789b85012a285d83ff31c6230e0dacb21ebebf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771318177, "uuid": "0ea7d3d9-5196-4c89-b48d-66f5a26395e3", "comment": "Malware payload", "value": "092e4956ab7f9a5249f6a6f4c572a7599cfb55475dc0620cf636462f033414625c6140aee60ea6582955c6c051fa86cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771318177, "uuid": "c37d465a-d17d-48f0-bbdd-ceaaef5b4d5c", "value": "T13A06AF203DBA4476C4D21135CED8F679A7AE7EEC273E01F7B1927B19B9332422919427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771318177, "uuid": "2e4cdfc6-1ed3-420b-a428-39b561a578bf", "value": "b2b45ab0f01f110f81f2ca20a5af4e6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771318177, "uuid": "dff07f13-452a-4739-89fd-791ee38c65ca", "value": "98304:mKhoeGohqUNfuvbAjGErB2DN2roNkgFLOAkGkzdnEVomFHKnPeg:mKl4UNQnN2rohFLOyomFHKnP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771318177, "uuid": "1108bb88-be12-4c8b-a70b-24a08b2fa2b2", "value": 3767477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771318177, "uuid": "4e07975e-56c6-426a-b2a7-d3ea4b0d7513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771318177, "uuid": "505dcb39-1a93-4971-8ca6-829b3ceef977", "value": "BO-MK83 software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39831767-0bf8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771329616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329616, "uuid": "622eb324-08ad-4a01-afb0-fb50eee877e3", "comment": "Malware payload", "value": "81b813df5feb4e0205d18d49bc8bdc8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329616, "uuid": "0a326940-4ad8-4899-83bd-3a0b82cd0473", "comment": "Malware payload", "value": "00f558f101fcc4d6c6827216fc38d38892e2f4b0170f0b71ff52930757c0884e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329616, "uuid": "de1cb853-8cbf-434a-a8e9-406fef5fa893", "comment": "Malware payload", "value": "db06d0bd612415a02dd1b52d7a1f46310b167e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329616, "uuid": "98a6ca6d-36df-4f9f-8671-af019750922b", "comment": "Malware payload", "value": "5ca84b4fcf9bf05a418936cf4acdde228d6f933986d18b67e37dcc446a1addc6da8420ccc270e9651252edbb76ed3700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329616, "uuid": "5ddaa3fd-969c-4757-86e5-465595e0acec", "value": "T153437D9EE5949578D6EDA271C8A58B1FC2F2318A7475034F52BC89D02E53B73531E383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329616, "uuid": "4120564c-728f-43cd-8514-a07e16c3dd6b", "value": "ee1d1b08f354510d31e1bf9d6cf89930", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329616, "uuid": "e7203621-15da-496e-aaca-eef04f7c4ed7", "value": "1536:g1QIw1VFCbuR0TbdKDQOANExVlATYPAZ:g1QtVFCbuRQbEQOaExETcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329616, "uuid": "d7df2172-1cb2-4ca0-9fec-f386917229cc", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329616, "uuid": "7bcf07f9-4ff0-487a-a148-d9780e839308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329616, "uuid": "b2ae2b85-db65-4ed9-ae73-6fc3159c6483", "value": "00f558f101fcc4d6c6827216fc38d38892e2f4b0170f0b71ff52930757c0884e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8325487a-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342195, "uuid": "e62f5f7d-c677-449b-97ef-54de37ad6132", "comment": "Malware payload (Grandoreiro)", "value": "b1ccf185c58f4d5eaf084e26d647a12a", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342195, "uuid": "05077030-ac5f-4902-9004-c27c72d28882", "comment": "Malware payload (Grandoreiro)", "value": "014ad8ebb8a51855ca0a0dc53f291c640889659711ed642455b32256c16ae22b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342195, "uuid": "5720b850-5d81-4a41-9658-8323df9731a9", "comment": "Malware payload (Grandoreiro)", "value": "944cf007acbf4a544736d0b1e1f12cc2188524b5", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342195, "uuid": "1a0d1999-0c3d-4a5b-bc4e-3bbb9d6205fa", "comment": "Malware payload (Grandoreiro)", "value": "284478a305ae9e17929dc9be76ca1b6386a8ae332f649b185362df5ffe7ab96d7bb71756f4746cd110616ea56e125e1f", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342195, "uuid": "355ff15c-28ae-409c-af5c-5fd64c598d98", "value": "T180763331AE169C9AC6444336B02F2E365F3D2727434CA5D3786CA8837786FC6B93B465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342195, "uuid": "df8d3d02-4f35-4c94-bd97-cbba5173dbcf", "value": "49152:G9Dmy3LKmqEIqQw2MceNFNIrZz29tUN+lyv6lBualeWlI5LyuMkfLHMbJZBcba7+:S3zUxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342195, "uuid": "4ff1f7a4-4fcb-4ba1-85c3-d1ddd58e3619", "value": 7323648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342195, "uuid": "3259779e-cfd9-4a3c-8e20-e1c3342a6b3f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342195, "uuid": "d0b12c36-8f0e-45af-ab96-52c9ba145f4f", "value": "60912Ntf_IMZQNGS99HT104037lkfpx.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ffca31-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356511, "uuid": "6d31f295-d987-4c9f-b0ac-0f0e314204c9", "comment": "Malware payload (Mirai)", "value": "ad4c322ab2465820f866438d62c0543b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356511, "uuid": "4fbb03a5-35d7-4ad7-873b-bccb0ffb6574", "comment": "Malware payload (Mirai)", "value": "017adac4165af4bfebbec8fa8bac277b9571da71954df22457fe1fbab4985148", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356511, "uuid": "31f2fd1b-d89a-4ef5-923c-6b767afeb311", "comment": "Malware payload (Mirai)", "value": "67f09e0171953dc227fbd0781fd446cae6be0926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356511, "uuid": "4f553d75-f1c0-4252-8f4a-da777cfb84e8", "comment": "Malware payload (Mirai)", "value": "f3bd694e3a62457c3a85c3e0c76944f210acefc7a2022df719e81748d457dfd8c5f5c7cd3931075f5d359d6d4296357a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356511, "uuid": "b965cd8d-1fb0-4c56-8476-ec568507f052", "value": "T15A839DBBE42A5E20D14589B034F49E711F63A6C082932FBB6AE587786087C9CF505FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356511, "uuid": "fe16e64a-4af8-4b6d-b0f0-294dd4303c94", "value": "1536:naYoNhC++/CHaoR+w3WOlwu4oKpmLm7lFY0UCKUnT6puUP:nKQn/C6An3WO+u4PpzrY0USnWoUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356511, "uuid": "ef5e7b2d-3b63-40e5-ae00-fe0be83d03fe", "value": 84516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356511, "uuid": "7d885e49-7c04-47ed-952f-b42e34b06406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356511, "uuid": "6841bba4-853e-4cd1-af91-dc7a442a0244", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18eb19b6-0c0d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771338581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338581, "uuid": "b80efe63-443d-401c-9aae-966aefb4c327", "comment": "Malware payload (Mirai)", "value": "226fac4404cd85de30fb76806a58f58e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338581, "uuid": "10ec1184-1dba-4324-af44-56da5eeb0357", "comment": "Malware payload (Mirai)", "value": "0237eda18f42ae545730b732e81327f3ef499b369fae7188b3f3965526ad799f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338581, "uuid": "d40ede85-1797-487c-be49-49405c61887a", "comment": "Malware payload (Mirai)", "value": "68e719f0bbd023f06b6e52d44f4b63bf8d7ee591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338581, "uuid": "2e2cc738-6a46-416a-916c-cdad0a6b9ba5", "comment": "Malware payload (Mirai)", "value": "7325f40c4371c9ab3a0ddc9984c827d7f174765f09ac945349a11cd17080c30583b27ff7bbca085c742aee4798112c62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338581, "uuid": "3212da3d-939a-4cea-b286-9c8915d9dd71", "value": "T187C2D1FDDAAE2D87DB7D5CB3A18D2A605E11D0E47BC9C70C93508C487E15BAF648D098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338581, "uuid": "533cea16-a418-43a6-b94e-8f8a68144556", "value": "768:mfRMYLEZgkb744DvVWtOQLobC5rc0IBPggYrW/:8RvYZg6740WF8Cw/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771338581, "uuid": "900b02d3-0397-402d-ae09-1fedfdf602ef", "value": 27552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771338581, "uuid": "7c77efe3-1440-4188-a0ca-e6a4f97e2eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338581, "uuid": "c17410ca-1680-4782-be33-a07c5c121a39", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bcd3e6-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349345, "uuid": "f3e2f727-d383-404a-a7c7-32313c3e49a8", "comment": "Malware payload (Gafgyt)", "value": "6a13173b67753881561a965e878df532", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349345, "uuid": "ed1da4bb-56a7-4540-ade5-a9b7b169d79e", "comment": "Malware payload (Gafgyt)", "value": "0260e5bed704a0ae0007c4bd1c0d3927f3295e40e63678e419b8ba95308e2679", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349345, "uuid": "66e60883-7152-4c10-9e35-bb8e39a0bd4d", "comment": "Malware payload (Gafgyt)", "value": "2cec875d61852c3f0f771e298472babdba105683", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349345, "uuid": "e5fb2524-5e3b-48a0-b751-addd549f6b0a", "comment": "Malware payload (Gafgyt)", "value": "dcb6ffc6d40aaa310b3fd6e8177b5df11677d6e66f5065d73051ec8cc9600cb954383981967bb370242816885f03f717", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349345, "uuid": "f63fb291-84bd-4b3d-986c-19aa21ac7b0b", "value": "T1961100FA7420B5B13478897D309B08D187C705FEF475635FEC692C65258981E39E8D92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349345, "uuid": "83137932-c309-48ff-9694-4cbdbe551abf", "value": "12:9US37SWSMXS9NSRwI2SEeScCSt5S9LCS962S927SP2S9K2SErgShUs94SYK:y69/GcwBOMe1V2bB2bgkp94SYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349345, "uuid": "7755e630-702b-46b1-949e-8c5572f58ea6", "value": 1106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349345, "uuid": "2302735f-693a-424e-b305-3796cfb69bbc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349345, "uuid": "2285fcde-a4f4-4711-a6d5-7bf5683b5739", "value": "armageddon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d2cce6-0be9-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1771323490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771323490, "uuid": "f9d9db26-9ee7-4264-93c0-262ac81fd26c", "comment": "Malware payload (LummaStealer)", "value": "d66d60af1a554c5bc3db402df5819ee1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771323490, "uuid": "6f1504d5-9f27-498d-97ca-a77a074e5618", "comment": "Malware payload (LummaStealer)", "value": "0340bec4784203989cd41ba0910ebe60bf12c64feaad88f693395bc457af61d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771323490, "uuid": "3f525020-9761-44ef-9ccf-2c8a2538acc3", "comment": "Malware payload (LummaStealer)", "value": "ec58da3bbcf876595302819cdbbfb61453ec17ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771323490, "uuid": "8d8cac9e-c806-47c6-b8ff-00e10fa78fc3", "comment": "Malware payload (LummaStealer)", "value": "f0468d6eb7f20c0030697f57c84e8dfefbe37e1d6a3271f38fe30713781c456d06cf5c403953125c311d2099be28a8b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771323490, "uuid": "dd6e4474-5efc-480f-a3ed-8292e29a8cd1", "value": "T1A6D49D0DE7A364B1EA0B4979218FA37FAE3453214738CEC3CBD4EE8475239E66535606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771323490, "uuid": "a28a0e2d-fcc9-4ed7-8e74-c1327216bdc4", "value": "35db7f4cbd35dcde15ade987b4775371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771323490, "uuid": "d81ac8d7-ca56-436e-8b33-67facd6d20d8", "value": "12288:l78/u5ONsH3qu64WCHGt9Rk78/u5ONsH3qu64WCHGt9:Ku5ONsJ6uHAvu5ONsJ6uHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771323490, "uuid": "fb6a67e1-916a-4dec-b7d3-cd08a9eed21b", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771323490, "uuid": "f60fab20-5cbf-41df-9cc9-d7ce977745ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771323490, "uuid": "fab2141a-b717-4297-bdbe-d50436bbc4f9", "value": "0340bec4784203989cd41ba0910ebe60bf12c64feaad88f693395bc457af61d5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b44e057-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342102, "uuid": "2bfa9156-21d5-48fe-b099-cae3e55367d5", "comment": "Malware payload (Grandoreiro)", "value": "70673608dd5b5fd28b217e6b2294478f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342102, "uuid": "3b9bddd7-2296-4682-a7fe-bc642c0fe385", "comment": "Malware payload (Grandoreiro)", "value": "0391d0ac7a495c53dd5378a15707dcf51591abc5a87ad8a8948f55cbd10c58e7", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342102, "uuid": "3f6d3f41-543c-43b6-b777-4907607ffe85", "comment": "Malware payload (Grandoreiro)", "value": "e01c07e77d769b79a13e6193378af2d32955404e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342102, "uuid": "5b1c4e7e-e57a-4813-8b25-6f833592a076", "comment": "Malware payload (Grandoreiro)", "value": "b2021e713fd1e7e425ad4e67db98e07a3da46a771e2ce9769794ff78d24f5d6b5e4351f943cd8d48a60718bf360353dc", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342102, "uuid": "a2f1f36c-d1d2-40b8-9893-4d4cb110ca0e", "value": "T175862332AF51186AC6904379707F3F352E7C7B239288E5D3B89D90833746AE6463F865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342102, "uuid": "07039377-1092-4b18-8122-9ce1d582096d", "value": "49152:komVly9o/YuvCgJF6KeCfjF+e+0ILjZdOV06FmtHB1tMCS/C5DRt18cWzXKsNkV0:qPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342102, "uuid": "546c1cda-6a31-49f7-9f77-cc1176daae61", "value": 7856128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342102, "uuid": "ee81133a-7ed6-422c-8302-600afbb6edb7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342102, "uuid": "93fd6c23-3115-4a3f-bb74-7de89d2a2478", "value": "316059Snc_34T86AAGGY43319cllz.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e1036f-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348379, "uuid": "b918fe47-5c20-4b17-a125-c879ca30a935", "comment": "Malware payload", "value": "fb069c04329d34c178e9b286ef844732", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348379, "uuid": "b4c9c595-76b0-4b71-8fe8-5736969bc40f", "comment": "Malware payload", "value": "03bf8b6610e81d015f5e0e6023281b232b8d32e8510cef333f9f9eb8af1b4bde", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348379, "uuid": "b6c585d4-3ca0-4e9a-9549-d91c6950deff", "comment": "Malware payload", "value": "2c260624e6ed3233a43a3b65e6171878087f1fbb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348379, "uuid": "1a6a0c0a-0a6c-4b16-ad4a-3ec4d404c4a2", "comment": "Malware payload", "value": "b3d4c5630fb20dbdafb56feae37f45139fdd465696396c94914e745bc33adc569a759aaff3d6ec6a0ea7bbfff75e462c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348379, "uuid": "34ddb3b6-5a1f-4365-8d47-a6d7cd5979bd", "value": "T14421F4EE589588F2010DCE6AFA71D75850CC8BEFB85B2F42D9D8ACF19E91D05B034B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348379, "uuid": "0947f4c3-1b9b-4373-9ebd-6e5a80b73c71", "value": "24:TAl2atCr2Qdgyufm1B4ZNO47ONnfWkMznYFf410+3EC404KtSdSd:TA8atcfdgzfmf4ZE47an+FznYFf410+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348379, "uuid": "4659a1f5-19aa-44ea-b624-76b553198a5a", "value": 1433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348379, "uuid": "33b76a00-be8e-413e-a699-f83a5ccc8801", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348379, "uuid": "7457f8d0-f581-4902-a53c-e18cad3f269f", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825e62a9-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341765, "uuid": "1b91d2fa-183e-445f-997f-661f85f5e65d", "comment": "Malware payload (Grandoreiro)", "value": "adf611236e28a0674e70adb572d35017", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341765, "uuid": "53b1e33e-cbb3-4d21-a009-c550ed70cb5f", "comment": "Malware payload (Grandoreiro)", "value": "03dd45ebd10a33614226339d812a268d7ecff56accd4c8ff91c260c0cb62cc0b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341765, "uuid": "953124a6-171f-4e44-87fa-1dbc77319211", "comment": "Malware payload (Grandoreiro)", "value": "8f2659d32b13fe5d2254f30bead1fce6620de110", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341765, "uuid": "ab683e98-1b8f-47f1-bda5-5466282d1643", "comment": "Malware payload (Grandoreiro)", "value": "d2edeac4a4175dffb49dfe6b0b2a312e2f98f2b1a42324e7fdb065366a14f4b57f0ad6ae83cfc3e0a99e7d14fe945f94", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341765, "uuid": "7d809297-5a53-40e6-8e1c-c6800fc8571f", "value": "T1F8763332AE664C73CA904735F02F7B265E3D660341CCC6EBA9EC95973742ED2952F029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341765, "uuid": "15aa793a-3f87-4171-ae41-469407748d66", "value": "49152://YMRtBdy5Oy5qEOAw7W7ubOCI5R54j1tcr0zHP2Vs8QUdT812T0Ss/bbhWpEdEI:OI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341765, "uuid": "c5b9aed0-3e5d-4cdd-9c35-04b59978281d", "value": 7372800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341765, "uuid": "4a139565-8762-499e-9696-00390e40190b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341765, "uuid": "27bfef24-0d8e-405a-bb9a-35f1f5f24c12", "value": "Jrnl14387ALHLQV-FX1X29355.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957a24b1-0bf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1771329341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329341, "uuid": "b9ff97a3-76cf-410f-81a3-a72c618e91ee", "comment": "Malware payload (Meterpreter)", "value": "5e5921c80f47a3ae5900e6f639d2ef75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329341, "uuid": "4f1d235c-c053-4983-b4e3-1016e2ed6557", "comment": "Malware payload (Meterpreter)", "value": "03e500c72fe2ec8b068843d8ca54679674735e1af88a2be563342aed2bb56379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329341, "uuid": "cd003524-cba1-4a89-ae73-ffeda134da3a", "comment": "Malware payload (Meterpreter)", "value": "a2fbf113c9aabbcc704fa471b8eb5a0abc4e1aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329341, "uuid": "449df139-5aa0-4141-bd0c-10ce1e8812c0", "comment": "Malware payload (Meterpreter)", "value": "662cf8f1055f1f9e216e4546747d4af81de9adf6831f78bb59bdb5ad14f6d08040b35e8867b4969407a890f608624c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329341, "uuid": "c5b9e924-b91f-489d-8d5b-6fd1a47d926c", "value": "T18AE13DA3A2365CF7F6391BBC42838BC661FC727403E30B4D0A68184A4192918BCE4F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329341, "uuid": "f43c51af-bc59-4714-83dc-386e639f882f", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329341, "uuid": "06b29027-9a0b-487f-b2df-2cca90996245", "value": "24:eFGSG9wSpUI1My58XZh9h9ClfAh6WhIAJJJ4up+:iG+IxiyeXZh9hMlu6WxJJJ4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329341, "uuid": "6d6df370-b9d8-473b-9442-9cf69351ab35", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329341, "uuid": "62e606ec-43b7-4a99-9428-3c6426376403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329341, "uuid": "d7cf7da1-fbbb-4195-9873-75c6f2cf2346", "value": "svc32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3d4bfe-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343093, "uuid": "77ab3804-1e02-4d1f-abea-593422c896b6", "comment": "Malware payload (Grandoreiro)", "value": "8dbde1d5bc87ea3a00c547929eec65ea", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343093, "uuid": "c2cdbeeb-4e11-400a-b82d-8d4eeb1b08a2", "comment": "Malware payload (Grandoreiro)", "value": "045edd03ceb904295a3ad8d6216ea6f3e941a3d9b57aab6c50c8a7b86bc4346b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343093, "uuid": "c822318b-533b-41c6-aa67-8e1e08e99927", "comment": "Malware payload (Grandoreiro)", "value": "92f6a508547557df430ca03cdd8590c3beae3e9b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343093, "uuid": "187a5dc6-ce5e-4ce2-adb9-7a3811b59783", "comment": "Malware payload (Grandoreiro)", "value": "fc4a9ee32795998d605335250b47562986bbaedf04e39c79d0478f19f26e95e225f7b4090d8a9fbfa9950be83fad8024", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343093, "uuid": "379dfc52-815e-4a08-8f48-2b88d479dc2a", "value": "T14A762331FA015CAACA50877170AF2A3A3E7D6603958DD6D770ED90C33B4BBD2963E491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343093, "uuid": "fb41b15d-6e96-4260-bb3a-7900f428f056", "value": "49152:X+axglkJgtj57tDp3C35wteuXQTSzke87ecUmmO9pnIKlFkXf3va646TjsFbn1qB:vuim3Yqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343093, "uuid": "2aa5667c-e162-453e-bb8a-f4478554938a", "value": 7452672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343093, "uuid": "8713887c-db86-4ed6-b910-a5a25c2c739a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343093, "uuid": "ab5b6c63-d32d-4c15-9faf-b92e181cc484", "value": "Aut3FQ6OUKERHM-533807Y1D75Jzhkoge_Em.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807885e7-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341761, "uuid": "ee852af9-a7c3-4cf4-bc8c-42b01279a0e5", "comment": "Malware payload (Grandoreiro)", "value": "813865e6944a1817f49295b49b4d5517", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341761, "uuid": "ae618d06-da74-4f11-ab31-0e74c32a924f", "comment": "Malware payload (Grandoreiro)", "value": "0487cbf23174f73dbbe794d791641d35641626b779b8a21baf8ed45095c3a274", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341761, "uuid": "ca0932ec-1249-4bc1-914c-149939cd7ffb", "comment": "Malware payload (Grandoreiro)", "value": "91c41230975429d368a5f5d7772766970aa3e5ad", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341761, "uuid": "e1074651-8063-4690-82d4-27eee1d61428", "comment": "Malware payload (Grandoreiro)", "value": "bff426cc8440ad48022a428169f2aa4e8799ff12e69e02111181f7faf0e12605b5a60829e033bb5b4614054a13da7e09", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341761, "uuid": "b85c1af3-aa5f-4edd-9b80-3184dd3fa4f7", "value": "T123863331EE556C6AC9904334706F3E299F7C5A634648AAC769FCD0863346FC2C63F869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341761, "uuid": "ef6bbc2c-f71b-46a7-9d3c-5adeaa90627f", "value": "49152:J7ERDvymojEQtbTY7RCL1aYAWQsNe2xyEQk41vhGCw6pgDenprJnkzSZgnW+JcUJ:fc0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341761, "uuid": "8df7fcd4-e529-49c1-ac68-004ff49f168a", "value": 8212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341761, "uuid": "72d38735-bcf5-46a4-9cc9-799e825e748e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341761, "uuid": "10ed7db0-2092-4495-9214-9790679c833e", "value": "IKQJZNX2P7847727_Hst.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c2205f-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771343037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343037, "uuid": "77e65129-36f8-409c-a107-930966627884", "comment": "Malware payload", "value": "71902937d5c9ff05c1d230ed7c3000f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343037, "uuid": "88b6e507-1ded-4c01-b41e-e223c27f51ba", "comment": "Malware payload", "value": "049da55dc6b17125617b5f041fb52de901f570660566bafa4013050f7f2af24a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343037, "uuid": "fe077a84-c5dc-4762-8b67-bfe2a5d7aaff", "comment": "Malware payload", "value": "8f21fa6b52c5e85c67791347da422211dd67d245", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343037, "uuid": "16c9c2ea-2eab-427b-9990-04e68e875f1e", "comment": "Malware payload", "value": "f73f8c21415644049836b3378e70b735447aaff5fbfc027c56dbc2499909b2944ad80589d7d434dec2c685c4b9076b01", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343037, "uuid": "7b1e7a2c-eb46-444b-8539-0c6ea02a2388", "value": "T1218417B0DA2001778F87BB8CBCA50260C66DD325856709A0F6D9CB0D950EDECF77966B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343037, "uuid": "1199292c-04d5-4644-889a-dfe9e94a7842", "value": "12288:aeblm1GTFF2ipVtVjIZivoDd1w77oq3giElPfd7TiDffIF:3blm1GTFF2kGZivoDd1w77oq3giElP1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343037, "uuid": "3505f5ce-ce0c-4fde-b70a-ee178a2ec685", "value": 396852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343037, "uuid": "bb198c05-44a5-4fe3-8036-bdc880f72faf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343037, "uuid": "5f60812c-0e91-4038-b033-b3e19583b4f0", "value": "Detalle de la operaci\u00f3n realizada..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901ebd27-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311293, "uuid": "46e542e1-a5c2-4041-b455-a9a3fbacd342", "comment": "Malware payload", "value": "616bcf7543a75f0e18745d0cb961a0c7", "object_relation": "md5", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311293, "uuid": "1f75dafd-4913-4add-96f3-c676b0a8e8b2", "comment": "Malware payload", "value": "04ac61a54692f1bb9f4c7a2f59aeb2d21023780aa9fe0caa8b8704a98f2a06d1", "object_relation": "sha256", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311293, "uuid": "7b0b6d00-78d2-44f8-b700-a9f9d8e245b6", "comment": "Malware payload", "value": "48cb3a256a8139cf365486bb6af09c6764e3f6b9", "object_relation": "sha1", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311293, "uuid": "16c11c33-21c5-4cff-8f54-c2c9d7825376", "comment": "Malware payload", "value": "4d163bc25625aacff8bcee60fc43fd2fd44fad05f569858253fbe0566ea3639ac4adae434d78697045e3fb126a168da6", "object_relation": "sha3-384", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311293, "uuid": "2ad9a5be-21e7-4cae-a9b7-54e4457792b5", "value": "T1B2A022322000033CAB0CB028C220A8C0823220B283233BF0ACA033CB3CA0BF8C280E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311293, "uuid": "4d6eaa68-bef6-45c6-8633-35b45dc12440", "value": "3:VSJJFISFXtviv3cb3AcKyOGr:s8SFXtv4cbQcKzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311293, "uuid": "2a5c6f5b-7ff4-4bf1-a438-0ff89d090c5b", "value": 70, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311293, "uuid": "14ac2b2f-739b-49c7-b1a0-de8ec4746320", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311293, "uuid": "b25c54cb-d567-4f18-ad40-6e8701e1aadc", "value": "04ac61a54692f1bb9f4c7a2f59aeb2d21023780aa9fe0caa8b8704a98f2a06d1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc443794-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356572, "uuid": "6407addf-248c-4993-9a8f-a1b5d6803065", "comment": "Malware payload (Mirai)", "value": "4b8ce6697e6f361d76e545ecb472f448", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356572, "uuid": "901901d5-e36d-419c-8dad-9b2310220f1d", "comment": "Malware payload (Mirai)", "value": "04cf9f1064bf1f989677880346d16f7bf029c7411ec83fd34ce283b26f4c8be1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356572, "uuid": "1092d5b6-ae22-496e-9f5c-9a0fc5e1966f", "comment": "Malware payload (Mirai)", "value": "49e1422bb03d4f0003c240dd96eb4521447672de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356572, "uuid": "ea0db76f-9dcb-431e-859d-bba907df669c", "comment": "Malware payload (Mirai)", "value": "43cdf137d6f8bf126e164d5b4d07017c92ab6a36a3393dc3caa390ec48c8def87bc117bfccbac6319d972faab8d9798a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356572, "uuid": "b69d5244-41df-4152-8756-4eed2be047ff", "value": "T126933A02B3180A57D1A34DF03A3F27E0C7BEA5D121F4FA85692E9B8595B5E331486FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356572, "uuid": "0d619c96-6fd9-411f-a5f0-d332d2a9e1fb", "value": "1536:LSDiKor5OoEGx9nT1frKCM0lyzHI2elgZ2/nHvmUQLzKb3qjS+B1aOL+o6m3Zl88:y6OoLThMVzU3mT+85a1o1mlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356572, "uuid": "6008747a-56d3-43fd-b442-6b61b533fe42", "value": 96040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356572, "uuid": "0e8839c3-5736-4254-85f1-10a23bc2e684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356572, "uuid": "c0ecea6c-04e9-45fd-84ef-0e1355778d34", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8921c1-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352330, "uuid": "76679db2-1c26-479b-841b-73fba1042ec6", "comment": "Malware payload (Mirai)", "value": "09b9cf101f84b7a91a253264ac418707", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352330, "uuid": "56c4fa32-01c5-4c97-ac1a-07b7a219aa63", "comment": "Malware payload (Mirai)", "value": "04d67de45346062439225daeb849e182f8b382a4f1db9bcb9b68492081bd8cc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352330, "uuid": "70b49c92-9720-4948-ae56-30c909b91d22", "comment": "Malware payload (Mirai)", "value": "ec52a27b91e9ad86e7c49f2128a89deefd9e1f4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352330, "uuid": "4e22eb4c-e659-42db-a7ca-b005fbe2d262", "comment": "Malware payload (Mirai)", "value": "86a69e77c5fdee2bb1776dfbc5ef6e432302c5188dd16154a440ae66c5fcd48c7843998f0997de9b043fc517edb27479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352330, "uuid": "59413bd0-2b60-40c5-a1a3-f5f8f1f074c2", "value": "T134436A0272280A47E1621FF4293F27E083EEE99121F4F588660FDA468275F77158AFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352330, "uuid": "f2252aa2-5a53-4242-8917-f4cc1f6a7e76", "value": "768:UapBtbSHgJiWrrrP2ijRYBaRTVEMorVnWkCxDqfMyGCGEg3s3f/3xpttZAIsYsB1:U/AgWZjRYIarFW3TyGTJ3s3fXFDsvx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352330, "uuid": "e72bf213-ea3c-407c-af86-c8f68f6e1e8a", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352330, "uuid": "703b2176-c0b5-402d-82c1-ecc1d80b0066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352330, "uuid": "925d4acb-231a-4705-aa2b-79f622d1033c", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1153b7-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356515, "uuid": "9bc948e0-8cef-4c65-bd83-3f8a12bf6674", "comment": "Malware payload (Mirai)", "value": "ed9662157e0056fbbfef2ba681e7469f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356515, "uuid": "c0c9af8f-eeb3-47b2-99a6-55dc9e8acf39", "comment": "Malware payload (Mirai)", "value": "04f0307e50db75764ca5fb991ec380d27d20bb0c8f27ad1ebf8ddbc8b4cd85ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356515, "uuid": "e872121d-156b-4034-8187-ec85b14a54db", "comment": "Malware payload (Mirai)", "value": "071858ab7ffc9549993fd9af9c6ccb71ac4e34f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356515, "uuid": "85845342-9a6f-4bac-bb4e-0177e01c5be1", "comment": "Malware payload (Mirai)", "value": "88b9459b20822a6458de2f337cfb0f6f4fd851837db55e3f9e9132dbbb7632da22d90e2434258bb3c9f038b5f1f8178d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356515, "uuid": "1817e843-a28d-461e-9efc-f83be79927d8", "value": "T195B2F2B195EC862DED5012BBA35E1DDF5C61D810602CFE08B78F9C2E2D630596D5C9C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356515, "uuid": "e4298dc7-0f91-4c0d-9b18-7f10e96582dc", "value": "384:MkWC62LmPBhVHnggfspLJ3CHysEt0kW6e+e29oMW+81qX83AbbdMsK9v1RH:X762LwBWLJSHysEt0kW6pL9oM5QqM3Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356515, "uuid": "fc8c5e8c-1b9d-4739-984e-015c98acba7b", "value": 24176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356515, "uuid": "0abeab85-17a6-46ac-bbc1-b5b30f23be87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356515, "uuid": "bf705b59-acc7-47f2-a53e-291edd427f94", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ba30dd-0c24-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348671, "uuid": "3f1123fb-7e7f-461c-a272-990ed206436d", "comment": "Malware payload", "value": "0341639438d50110296ae46593a59d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348671, "uuid": "a8b48f2c-f216-4660-a2a6-9dd88cf83b10", "comment": "Malware payload", "value": "05782538bf36eef64fed05ff8160f96412b52c42ca31d6f4959e528851d05ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348671, "uuid": "7a4dd050-bb57-4993-989b-ee8efba7b272", "comment": "Malware payload", "value": "888afc55cc813ab9de0d08b6b8e7d748f1bd5230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348671, "uuid": "ddc59e97-6830-4c06-bb86-4d6d14d24205", "comment": "Malware payload", "value": "6cc5b66cc26bb2ce9e52d8b7963edbe770ea490f43c31c4277555a99c7d7c13adf810f4198b3cee814c8e78a52391f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348671, "uuid": "2a1b917b-97d4-4621-a6da-49c4d7c8b4f8", "value": "T17C23C59CA3D94131D4BF56B21E77124893B4AA938467D79F7CC400CA2B26B95CB42EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348671, "uuid": "0ce35e16-9f26-4478-ba94-cf5665c2b4a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348671, "uuid": "55682d60-b7b7-439a-804f-c1d553305a35", "value": "1536:DdgppCUPinnwTw6ELeXyJZP1F+6qRMcaZsUmYPV/b29Oj31OMR:DippCC6nwTw6ELeXyJpT+6qRMcaZAybl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348671, "uuid": "69864f6f-9446-4164-bc32-6bee4f64a236", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348671, "uuid": "50b06971-cef8-4634-b16d-91345fff733b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348671, "uuid": "46093fbc-0f5c-436b-9ff8-61af69b22093", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb89a86b-0bee-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771325620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325620, "uuid": "dcd39388-e7c4-4f58-aba4-1c1cb56e9167", "comment": "Malware payload", "value": "b811860d735d336eafb704d59da54501", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xhtml", "colour": "#674889", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325620, "uuid": "d4aea7f8-1b94-44e9-87de-d7cc15e6a1ed", "comment": "Malware payload", "value": "05cb4f6f02445f800e16c675ec2dd947ab8ceb445cf3f8bf429126bc5c890942", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xhtml", "colour": "#674889", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325620, "uuid": "b8a0c5db-c998-4fdd-8c80-c7f22d6be14f", "comment": "Malware payload", "value": "1eebb6b4b48c42decf06695c1936f8db8f495ca5", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xhtml", "colour": "#674889", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325620, "uuid": "4df59e24-ca3b-4839-99e1-69dde9a18faf", "comment": "Malware payload", "value": "e88ab43d51577c1be69404333796a76bb9cb7fe746b69c75a3181fac6b098f815680de05f2d43ec90fea356ec133b141", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xhtml", "colour": "#674889", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325620, "uuid": "c7d5fe92-6a36-47d4-bbd7-6a5b41164bf1", "value": "T13224B61BF5371AB425006A88AD2324E79EDCD4828BB032B066EDE7FEC07E47950D9577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325620, "uuid": "af0dfb24-3584-4d1f-a62d-ef1ffb0850ac", "value": "3072:FePAH1mT4wuVbURuKBRBQGkZrUfAU2gXRLlHfNlTwiVeVqDRkSeuZzc6Pz85ArGD:F0AH1mNurNjBUfAilpkixRkpuxc6RA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771325620, "uuid": "80b65b57-4179-4c65-9eb0-3f76d7de404a", "value": 217162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771325620, "uuid": "6ee1a85c-b37b-43b1-9559-fb4374057b89", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325620, "uuid": "28a30539-a862-45e5-9f7f-d6172882ddd3", "value": "2_19_7_1105_17.02.2026.xhtml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d34b3f8-0c08-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771336495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336495, "uuid": "dae0aa02-fb03-4df3-8859-fc6b8bd827dc", "comment": "Malware payload (Mirai)", "value": "2a8ba1d9b74cd1c94ab78ffb34c8bca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336495, "uuid": "8fdd556a-1ccf-4985-af37-973d5c95e226", "comment": "Malware payload (Mirai)", "value": "0649c80bd060ab0188f57984206a6a57bcdf053a2df1dec1cb05feb423c3cabd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336495, "uuid": "0f0cc8fe-df16-43a6-932e-599807e465f8", "comment": "Malware payload (Mirai)", "value": "2e5f7127f5b7014e50e207f6bf790605c91c41d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336495, "uuid": "52cde760-772f-4f89-a5b1-103144d6f9a9", "comment": "Malware payload (Mirai)", "value": "cc93998cbd293a668c6d2cf18068a95225b73b09cf710508986847e55c70411b2fd361cd4c3edad45338e5c688c44f56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336495, "uuid": "4bb9ecdd-7971-4311-ba4f-8475f03ad52e", "value": "T1E9C2F2704E27B56EEC96F9313A55E712E5EBF40C7568B64230A0904735DFC280C6F997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336495, "uuid": "da122439-e9bb-41cb-87ec-1a655514ba4d", "value": "768:EiJluey4da6kBPPMSLMcfVixW4/wUhssAM:PJ8ey3zNbrisb2xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771336495, "uuid": "effb83dd-3909-4143-be40-82211136def0", "value": 25804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771336495, "uuid": "917cc213-948b-485a-a4d3-e35ee2e7e105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336495, "uuid": "2bbb86d6-597b-4990-a343-0451d6a0bee9", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d052cb8-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312416, "uuid": "26b6f35c-c5ef-4ca5-b2c8-84f3d94dc195", "comment": "Malware payload", "value": "604bd003c53cc933af07e4882f81908d", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312416, "uuid": "809635b1-a957-447f-9787-15379c53e39a", "comment": "Malware payload", "value": "066018746a325479fe4e4df055947a30199253db14a68c9c1ab2448059277e28", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312416, "uuid": "580d2d0d-b927-41eb-8d3f-ffddd0083549", "comment": "Malware payload", "value": "dda890d9aa2087d23944b1203827dfa3b63085ac", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312416, "uuid": "63143efd-49a2-4ceb-a60f-fa75057c55cc", "comment": "Malware payload", "value": "f397e4d1c734e7a1d690d848910140f35a50183624a9222881f4dcb548f6184eb9b8d223cc86630429aba110fe7e0589", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312416, "uuid": "482c7bd6-fead-41ca-9a9d-e180f74c253d", "value": "T12EB6339D93E00DEAE827653F59669062D3F1B0250761C99F0B90D31E6F5B2FE2C393A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312416, "uuid": "c1680f28-79ce-432a-a690-504b445700b3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312416, "uuid": "1b377432-f1a5-4c19-9984-b6d469ad14f3", "value": "196608:EpxUY4KtbW897GXPHMe81SF2RPUewD8gcCMPWhLtKZ2IHsMRRabRgFaDU:EPpf1wPsZg2KeiUzChK4IHsMRRabYaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312416, "uuid": "b51221d8-aa28-4e3e-ab23-40eaa5a4e9c6", "value": 10431550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312416, "uuid": "d268838f-b210-4680-86c9-c8dcffdb6e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312416, "uuid": "3fe77b9e-727b-49d9-bf45-6d432d0dfcbf", "value": "066018746a325479fe4e4df055947a30199253db14a68c9c1ab2448059277e28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8ed714-0c43-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771361805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361805, "uuid": "e55a7f97-1517-4c65-8214-f0d0940d9b43", "comment": "Malware payload", "value": "cd248a0dbda0f26d15ee938c9366fe36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361805, "uuid": "51ffa991-95b5-4f3a-9be5-21a829b74c0e", "comment": "Malware payload", "value": "06f14e69bf8d4c119d46e43b9a1bdceee70800d4211ea1e0b0276471834f2a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361805, "uuid": "a021495d-065c-4d38-9178-c587a044e46b", "comment": "Malware payload", "value": "0b3d4650cffea70276242c2dc96f0fd4be1d7ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361805, "uuid": "e3c6ef0c-8210-4001-8ed4-5e231a20a660", "comment": "Malware payload", "value": "2bf7dbf44795c08d2d55d9e4badcb93c84c87989eecfc3e7a6191b892636043ff393a05e9c964c0551ebeb155cf84fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361805, "uuid": "b81ed1c2-fd00-4eb4-a9d4-231844cd9ca7", "value": "T1ED87331AF39599FBDE33D0FCC0854447EA9678E54381422717F085EA4E606E98A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361805, "uuid": "a2936cea-11a8-4b6d-90cc-4da2b7644dd3", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361805, "uuid": "c3a3e54e-3f82-4d51-b5fc-a916297062ed", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1b2:/uRf+nAu2FuQd73XyFeDMnKT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771361805, "uuid": "55ffac7f-26da-4ccf-b965-88337adde607", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771361805, "uuid": "2dc0f634-44ae-46b0-8d77-0ab273204ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361805, "uuid": "57ae7617-b06e-40f8-a81a-f886eb04e788", "value": "invite.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a602b7e8-0c10-11f1-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1771340106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340106, "uuid": "2d49206c-221e-47f4-8c3b-9a54984be70f", "comment": "Malware payload (Socks5Systemz)", "value": "1260c089ac4c3b8206f8acdce24fae29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340106, "uuid": "f5871405-030b-4120-9fd3-567dd637b95d", "comment": "Malware payload (Socks5Systemz)", "value": "07101f6fa71eae46fbcb3f747cab5de7572a3c6984eae9da947f332a0f809196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340106, "uuid": "a1b67024-a50b-4f2d-b89a-3557e7a3d820", "comment": "Malware payload (Socks5Systemz)", "value": "3465807dee07565661629d77e3aa124da28cffb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340106, "uuid": "535d8e8c-bf5d-4102-b9d4-42ec053c5be0", "comment": "Malware payload (Socks5Systemz)", "value": "0cdf848343ba028bd15161d5a1188665bcd8a53b54f70e155e2d5973a5055d96fe8adb2d001320697b1801c0e34a2c70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340106, "uuid": "e2898931-ae39-4695-a53e-56a191847114", "value": "T1E33633D4C75888B0D6B3C4741DA5531088F3BF762065986AE0AE53AB6FE3178062F79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340106, "uuid": "c01b47a8-1d74-4780-a3bf-c0bb4132ed88", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340106, "uuid": "a8c0ef6f-7284-4201-8307-72ca511b6a8f", "value": "98304:mwcqIC/JZkmZIXcEVoArA7u/PfBibvB8mn3e7dgnu40waTs3ppb:jeUkmacEOArA7OfB6vmm3JnZ0wvpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771340106, "uuid": "81861f39-add5-4ccc-9b8c-147469342fdd", "value": 4974399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771340106, "uuid": "ad9e0d5d-eb2b-4bb3-940a-454dc94e9b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340106, "uuid": "8e1bcabc-e124-46f9-8f02-79ea6e031a4f", "value": "1260c089ac4c3b8206f8acdce24fae29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f86527-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286795, "uuid": "f75a27ad-c46e-4aab-9a2e-b587d1fd5a3b", "comment": "Malware payload (Mirai)", "value": "643ea5dcb4ca4230386e1469b49cf670", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286795, "uuid": "441bb9c2-0e59-4ac6-8526-0c395826161f", "comment": "Malware payload (Mirai)", "value": "07d009db915ae2f3e7483241f32478e75b5fe9ac1a836cfb6a6db96baa80329a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286795, "uuid": "a1d23693-a9a6-4c51-9684-ca41ebca1ee5", "comment": "Malware payload (Mirai)", "value": "9aa817ea9e531a242a9d65b7f95f1657cb259b61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286795, "uuid": "89a38d8d-ef62-4e19-a2e4-fccd49bde80f", "comment": "Malware payload (Mirai)", "value": "3ceadfe8bb38d33acc548a2796e4f071b0471d57a6f2a4aa050ed1a19ece942c3b62c31fc21d2c8b70a654ac7b762bcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286795, "uuid": "4e4cdd2b-0169-4964-94a2-795baa2facfb", "value": "T1B2438D36E96E1E74C08641B074748FB56F23B4C883572EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286795, "uuid": "af2bd3ed-69b9-4d5a-b9f8-1ad87c0fb1ec", "value": "1536:9aa0brW/Od9hlCRjK5WKQXACspfDCMx2+Wg:9v0brWGd9Xl5pQqpfDQ+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286795, "uuid": "136290a3-481f-43d3-95ca-c713d1edde07", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286795, "uuid": "70a24d54-76bb-45f0-9e95-7d07e9db0a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286795, "uuid": "68bd8c9d-4a47-4d02-8f69-bb3b7f5bce95", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ad4d45-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341690, "uuid": "736db474-c94c-41e0-8142-9900abacfc9a", "comment": "Malware payload (Grandoreiro)", "value": "410d7e07dfa265622d79f999ee8942b7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341690, "uuid": "9d118855-515d-42b2-b123-674b25f097f0", "comment": "Malware payload (Grandoreiro)", "value": "07d2777b72593f8d32592d48e854353643fe3eafa641284474a74cc7aedfa5d2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341690, "uuid": "8278f827-eba4-4d96-9856-b01d79b6eb1c", "comment": "Malware payload (Grandoreiro)", "value": "178f6aec12cf1fe967fc99be63050f81d2411d70", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341690, "uuid": "671aee8b-1632-4c39-9e4b-e38ce9c05f87", "comment": "Malware payload (Grandoreiro)", "value": "be9b383bd0af49c07c28e089c97b9be5bcfa4edb68c5774c2a550db6bbc8bd76be69655fbf3794b9b0aefc39ca0ccf5e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341690, "uuid": "e3a2f6e4-4321-4ba0-90f5-947fdd71daf9", "value": "T17E9633306E651EAAC9E44339B03F6F2A1F7C4953438CB6D3B6AC60C6278AFC2553B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341690, "uuid": "8fdc7ef9-af37-466d-8e52-9155d221dfd8", "value": "49152:JvSMau2j5j+SXzhRUPMIHJzo5jp0q+MfDHaWwgcEedN9WWGR+EVvpGAprzyDiPMy:HK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341690, "uuid": "b531e76a-adc4-4d6a-985b-f64dfe0419df", "value": 9183232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341690, "uuid": "9364ce5d-90c6-4772-be77-7b89d8783da8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341690, "uuid": "6b2572f4-e080-4dc0-a83f-b6dc5258017b", "value": "0Mrc-Antl744773KIIIHQT489.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b690aa-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771349365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349365, "uuid": "0c022edc-44b5-44fc-9bea-8983bdbf8ed8", "comment": "Malware payload", "value": "903de33c57a2089ff3e34f83af34053c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349365, "uuid": "f626293f-5c34-4f0c-99b9-efe0a1383f45", "comment": "Malware payload", "value": "08366e6b511e8f7888271c8e48fb26e5862c227d55eaaa9190f11c890e744731", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349365, "uuid": "605682e7-a87e-443e-877e-da22bc9ee6cc", "comment": "Malware payload", "value": "622787e34c9711134946d30da9335f4994dbaaee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349365, "uuid": "f49cdf9c-3ae7-45ad-be37-c5bb202eb423", "comment": "Malware payload", "value": "5edcd041e6f34b64ca71f4f369ea86c4bc79b69873a69847dc99a44b59c01fd8530caeb6e55a46f9c91d79b965442c41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349365, "uuid": "446892b3-5853-417e-afba-23d5c969b9c6", "value": "T16283D686BB43DFB3E84324F542F75B354A32FC3A5C26DA85E324BCE58A115C0B616368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349365, "uuid": "a51752c4-fcf6-45cc-808f-35c4f9511cd6", "value": "1536:s7Du+OjgNxAAMSeGEkf3BhaB/V4SEbF9mO:0DOjgXOSpEk/BulECO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349365, "uuid": "aec539db-3cee-4eca-890c-5a627db55f9e", "value": 84068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349365, "uuid": "6a3ff007-08c0-402e-90d6-1b96b752ba48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349365, "uuid": "782264f6-f41e-408a-a869-1e561271d6f1", "value": "israel.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0575258a-0bd2-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313208, "uuid": "0e57c3bd-6cbd-4467-87fd-3be0190c1d9a", "comment": "Malware payload (ChromElevator)", "value": "3b3663dd226401efc2e8d36726e2c5e2", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313208, "uuid": "1b82bfe8-36e0-4a92-ad16-0661c70d0d1c", "comment": "Malware payload (ChromElevator)", "value": "0863bd3878d0a0e6b809eccacffe83fa5b2ccccbef7830f956accd306a81298e", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313208, "uuid": "12e4c34d-af10-4d77-bf15-91410b56eabf", "comment": "Malware payload (ChromElevator)", "value": "aae9122b84831d04afb2e6564958e474de828318", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313208, "uuid": "9fbaf7b7-cbef-46e1-8979-15055477c474", "comment": "Malware payload (ChromElevator)", "value": "1518e8189c73c5da68de56e1df73d1f44ba6f577492626c8c5fa9aecdd80170b524f9f990dadd06eccef8fe95402e18b", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313208, "uuid": "911e79ca-f7cb-4d90-b2b4-d52cb4446e2e", "value": "T1CD96D75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313208, "uuid": "604ebad0-fa3b-4cf8-b891-73e75420b902", "value": "49152:vtQ2dmDfVeWhLoebXydapHtVnyTnPqY7kbEr3HNWGtXSn+nj4iSTOgZ5/5jEyqz4:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313208, "uuid": "4ab64fc2-3f04-4bf0-9f03-c0740fac5cd4", "value": 8904238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313208, "uuid": "9c15ba14-79a4-4a82-ab40-72b0fe35c3e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313208, "uuid": "945776b4-256e-49b7-9051-245942e98bb8", "value": "nouveau_curriculum_vitae (20).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6a6e80-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343261, "uuid": "220bf28f-54d0-450c-a707-acd972c9cc91", "comment": "Malware payload (Grandoreiro)", "value": "e24d476817be221327ec5caa9b9fe31d", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343261, "uuid": "bff2bab5-4bf8-4ebf-8b4f-6356f5ade375", "comment": "Malware payload (Grandoreiro)", "value": "08998592f1edaca8045fee69f9e36b7f348ef36cefbbf9c9032e9ea881c2d0f2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343261, "uuid": "908bcf65-1ead-4963-88e9-84ff63e87476", "comment": "Malware payload (Grandoreiro)", "value": "cf0bb64d595d3dfb3439bfde3d4d63f587a0433d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343261, "uuid": "542b874e-e6a6-4074-a887-3aa3448da3fd", "comment": "Malware payload (Grandoreiro)", "value": "282537f5526ded4cd8391f3693f941554e70b8d678f083c8c0100b9ba0070eeb54aedf763836bea3932efffadcc4b45b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343261, "uuid": "e330b671-c2ea-4a88-a646-784a4ecf1edf", "value": "T1CB46233AFA816C62C9304371743E3E352E7E761749CA96D138CCD22B7749AE60A7DC52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343261, "uuid": "fb0f4c8f-4e04-4d53-bac3-60a89b7c429a", "value": "49152:xuUX5//40EFDSuv8aebIm6ZHW+54iP0FK1b2JAeNrgiThFeLj4tPr0pkJFcAI/BF:jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343261, "uuid": "5c4dbe29-54ff-4960-9a61-439e1d1267cd", "value": 5552128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343261, "uuid": "14b82ea3-2ec1-4345-9d52-02b4036d83c4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343261, "uuid": "86e06d0a-6306-4c1c-b7bb-72b536e27629", "value": "HNPNCn-Y88HN7804644_Autr.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a0cc7c-0ba0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771291811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291811, "uuid": "eb657e29-9287-46d1-aa08-5259bf154807", "comment": "Malware payload (Mirai)", "value": "ed1ef9543490233c6da46eecf451dcdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291811, "uuid": "ca8b6a84-45f7-4a22-b620-bb3f2f38070b", "comment": "Malware payload (Mirai)", "value": "08b2b3e74a0a2b11ddf2bd51ebb460f4e91dca14ad6c53f1ca3ceb71509c855c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291811, "uuid": "77d97d4a-c649-4a4e-b2fb-0e627b65d95e", "comment": "Malware payload (Mirai)", "value": "3b58e8dc29d07c908a4427c5bdadef47308e32fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291811, "uuid": "a3f03e4c-9f35-4823-ba9b-4196450ad031", "comment": "Malware payload (Mirai)", "value": "38b63b139ec2265898f7e4ac5cd0888baf53f858f734746459abaa549125e7331a70089440f8d3bc1c08db3038170522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291811, "uuid": "e46115aa-a36d-4ff3-a4c8-bf09e17a1c0c", "value": "T15DB31A46B9919F12C4D621BAFF9F418933136FB8E3EA3102C9206F94378699B0F77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291811, "uuid": "1f344c6f-aa88-4984-bd31-b037973a50a1", "value": "3072:/PXeO7glDkyMIOBaU16OMdpuzhbxB1jgInzsla:3eO1yMZBaU16OMdpMhdrsla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771291811, "uuid": "7a8f379d-79d8-4dfd-9723-4da99ebb0103", "value": 109344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771291811, "uuid": "daa7dab8-b3a8-4b5b-9a6b-8a8e70e676fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291811, "uuid": "24e1a8c0-e84e-437d-ade3-e6ca974df062", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e906fe1-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1771312579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312579, "uuid": "10921ccb-68f4-4d47-938d-39c916ccea55", "comment": "Malware payload (GuLoader)", "value": "e280859dd4a2d84744e9533c4589eefe", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312579, "uuid": "a6353499-6ba0-4c1a-8b79-83aec56a1ec2", "comment": "Malware payload (GuLoader)", "value": "091647849e67337dc0ae30c6e6eea22b5660906db387ac0bfdc2700cb9c8402a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312579, "uuid": "6132d803-0cf4-41d2-aed9-c6daa81d038c", "comment": "Malware payload (GuLoader)", "value": "c68cd8102c102103f5b6f211b6b00fca6a0e02e9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312579, "uuid": "0d054918-269b-4029-b317-fd90bbd77c04", "comment": "Malware payload (GuLoader)", "value": "c953634b743efc7e183dec1ae2e4de594905d8008eea1541bb9a83b471876e86d135b9e209ce78237547bffc6c7b891a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312579, "uuid": "e8b12dff-3753-48e9-97da-a26fecc04b5c", "value": "T1843423BC8C46B4378D600F1E68383B9524AD1CD478F3B41B57477A9ABE7AB599634330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312579, "uuid": "99444020-ca31-498e-9439-e481a4204fe3", "value": "6144:6TbJsdXlkRgQGFvZ6DprPDyZ6X7WKnqGoKpVh4jq2JjYKwUd9gaNZ4:AlsdXlkRgQ8IDpr4eqbKpn2f1dW2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312579, "uuid": "5aedd2be-ce6f-430c-b561-ec72a0216de7", "value": 246479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312579, "uuid": "40574bc6-8c14-4cfa-927a-301884c7fbd3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312579, "uuid": "580e1cb2-cbfd-4b53-b058-9e8acf5708ca", "value": "PaymentAdviseSwift0285.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbc6bc0-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352627, "uuid": "6e08269b-b52a-4da6-991e-fbec94ca9f66", "comment": "Malware payload", "value": "998a87f5cf5e5b7d9fae5eba1917f85b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352627, "uuid": "104ed23b-29b6-4187-a6ec-57b9399f452d", "comment": "Malware payload", "value": "093a1407b129efdb0e06c1123fbead214465ac24da3ff29b7a20890a3d7be0a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352627, "uuid": "ef70ce22-e7ab-4320-837c-b9f2d154e790", "comment": "Malware payload", "value": "dae1ea1c437d4bd5634675c6dd376c7bdb860ae2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352627, "uuid": "80b6fd8f-e83c-4c43-a611-9af87a47e1b9", "comment": "Malware payload", "value": "6aaa5a6c9dfdc8a025d187fd8befc10c04e8be3f70d4542a7b350f1f5b38cc8253ebf7ce4fd5684528e4f2db58c207fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352627, "uuid": "fa962f27-7038-48c3-ab0f-3bcf9ad94dc9", "value": "T19FB4CF53F7A0ADA6C4A74B75447BD2304347D2821383F342F6AE86442C6B66DFE6E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352627, "uuid": "f927c0cd-ec30-493b-ac21-dbf67dcd5d8c", "value": "12288:CpZhs2rpVh8MieAvNUI4yECBgeBYQpdEupwOAfv9:CTJ9Vjq8yTV9Afv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352627, "uuid": "72ac3c3e-ae49-4b14-9188-3aa6e3b1f255", "value": 518788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352627, "uuid": "7c1b4cac-ce0e-4c8b-aa46-0afbb4eaf781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352627, "uuid": "1bee7875-5b50-429f-97f3-99a8972d4bf4", "value": "hydra.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797d6287-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342179, "uuid": "bebbb472-3404-4103-a9d5-b4aef684cf78", "comment": "Malware payload (Grandoreiro)", "value": "b1edc55c6151cf7749f02d44efaa7ce4", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342179, "uuid": "d63f0ede-c414-47d0-92e8-b0cc7eaefe7a", "comment": "Malware payload (Grandoreiro)", "value": "097035a4a7ef90150c9803a7fa4321fd648474565f9213d314d0ccd99bc723aa", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342179, "uuid": "17899ccd-3fe0-482b-9b8d-6439662b2ee3", "comment": "Malware payload (Grandoreiro)", "value": "85a54659b35d68b7f0f98f60f4a36ee9cf387896", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342179, "uuid": "5ed1b3e0-221d-4df4-b97e-c39b0a737065", "comment": "Malware payload (Grandoreiro)", "value": "94354d0d6945670585e38d49808a8d0f21498d151985f15df81b0a4483375e04c08d3c8734c2fcf94b5a40e44e12d135", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342179, "uuid": "1da5c575-f80d-4ea4-8229-fa866c0f19f3", "value": "T15F562331BA501D63C5508371B83E2A363FBE661346CDD3C36DAD82577746AE2C63E8A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342179, "uuid": "6d7eaa2e-0ad9-41ff-af3c-c74c3153bb0a", "value": "49152:jKiJoxM+rVq8aFofVEFSYvPBnwg2iTm3hTE8KirbyVSmVgsLgKQ/VqlIg5sPgL4z:f+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342179, "uuid": "f4868454-e023-4e56-b584-f3731d54fe6f", "value": 6051840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342179, "uuid": "f1044e03-01e9-4133-9718-b51eb1f7bb52", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342179, "uuid": "c5c1ec07-35e8-4ad9-8463-30e8a9692536", "value": "589804So_Escr7QZ9K7IVOEE-9332HKBL.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d69eee0-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771312900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312900, "uuid": "36ab8aff-3f5f-453b-b2ec-01fe0b25207a", "comment": "Malware payload (QuasarRAT)", "value": "465270a344939f01ad336dd3c55ce21f", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312900, "uuid": "01aa393e-5e31-4155-8190-7587020662bd", "comment": "Malware payload (QuasarRAT)", "value": "09da583b39c72696ae98d24d518c838e4a59ba564074107df6528d9234c76253", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312900, "uuid": "1783f762-df6b-4466-8344-7b0f55a34ced", "comment": "Malware payload (QuasarRAT)", "value": "6f3f76bf059e5b3a0563ea9f52a1f3f6224b481b", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312900, "uuid": "660c3dc9-f560-4891-969e-4d05b7f3e7ea", "comment": "Malware payload (QuasarRAT)", "value": "91c1c7e5f8aa76b357796c0275057417ae31bb0bc7517466f83622f16d3d4e73245deb30cd2a416b366685a03d2c30bb", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312900, "uuid": "52087177-2a7e-4dd3-9ce3-f03cb9573c56", "value": "T118751232C27BBE7E0A6C2F6A94573ED02D7C6B93415CC1B7B5957AB7B262090CD0D920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312900, "uuid": "e9055e17-8ff8-411a-b037-93daa3a151b9", "value": "24576:2d+ynXZEk2G57SiDrp4OTuVme797qMwHaFxsfQ0bHc+MUU7HTpNQz/b6eD0fLQgR:4+ynXZ5Xzw3mGzgdDqLjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312900, "uuid": "cf805920-01d6-4a5e-b914-7840f4e75084", "value": 1608869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312900, "uuid": "b5c351d2-69d9-4d37-97c0-1c22f0a56545", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312900, "uuid": "69f0f0c0-9724-40c0-8876-d2c2d03c976e", "value": "465270a344939f01ad336dd3c55ce21f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76220e3-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353879, "uuid": "a45588db-6e83-4bcf-b1c8-c649f3e493e7", "comment": "Malware payload", "value": "12869290dd7bba6e880e6ffe1789b167", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353879, "uuid": "eebc7316-ad22-4fe7-bd2f-637c33c881aa", "comment": "Malware payload", "value": "0aa559bd4afa582973775b9bc79ce318e4d194770bb0baeb1c2db03f7bd138f3", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353879, "uuid": "ef5e8f8c-9591-46d8-bafc-9fe31ac68834", "comment": "Malware payload", "value": "ee58dd178af20c1abcfc4ce87f8366c7803ef27c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353879, "uuid": "746f4039-45de-43e4-bee6-59cccf7607e8", "comment": "Malware payload", "value": "bd5ce63a0384978abb3a58cb327e612c3a4ae445f7292dc429b8045732b419df55cdcdc1e71ec46a770ae5310fdbbebf", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353879, "uuid": "6641ddfc-9552-4293-8b93-c0b040f9a419", "value": "T16E36233299605D5ACAD06375F02F79221F6CB60327CED0D379BC82863687EE2953B1D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353879, "uuid": "2fe0d6a1-2873-4a56-8478-72856ae358c5", "value": "49152:wOQ223CBR9fI+FNEF7V98yZHnyCXpI4tFlBuf/UHTeUhKj+oCS+7mS:cxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353879, "uuid": "80f1ca8f-eda7-4174-9695-4eaf30b52223", "value": 5304320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353879, "uuid": "27ec832e-a686-4fad-8052-6dcb501fa80a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353879, "uuid": "fe2b8ae4-1e2a-46f1-bfa7-811c8027cb84", "value": "RsptFXAZS0770DDJ4.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b043a75-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309003, "uuid": "057aae79-c39a-459b-ab3b-b537a6a1a68a", "comment": "Malware payload (Mirai)", "value": "f124cfde8335928b9e92f89177c1453f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309003, "uuid": "b86c85c6-10d6-4da6-a28b-803335a84a7f", "comment": "Malware payload (Mirai)", "value": "0bf9646f78d4874184ff685581648a2984021bbd85ef9718cf5424ae3c255120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309003, "uuid": "fb4a8f32-fa0e-4012-9cef-a0a201b3c0b9", "comment": "Malware payload (Mirai)", "value": "316a4cfb2a2f84c56a72bba049f4c2d8430a23a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309003, "uuid": "1b6977fb-595c-4d25-8b0d-1feb6b87d35c", "comment": "Malware payload (Mirai)", "value": "28a91ab1f0999e4bb915d22ab6a49f813faedf9c33be447cfd804456a50f50554291f838d5ca4d5e33dee87a2fa9a7c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309003, "uuid": "75143cf1-88de-4df8-99c5-e4f885bdc4a4", "value": "T17DD2E0219AB96D61CF803475DA180897F21505BDF2F22A770A6885AD3FA351337FE8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309003, "uuid": "aa0994a0-2a0a-42c7-98dd-ab2a36e80bfc", "value": "768:9QHcNMk+FPgVr1fPkvSon88U/VIIK8dU5nD7WG9q3UELElK:9QcjhPq5CpKOWELJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309003, "uuid": "945b1b1d-8cd6-4b78-bc48-28ced66587e2", "value": 29900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309003, "uuid": "262be1b0-62e3-4f23-b795-e79453519e45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309003, "uuid": "8815bfbb-e8f7-4f97-9cfa-8530b965b4bc", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f210b9-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1771343541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343541, "uuid": "c43a255a-fdb7-4e3a-a0c7-3bf7d64ca63c", "comment": "Malware payload (BlankGrabber)", "value": "c03826eab7acdd6f88872d6c836fac32", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343541, "uuid": "7d187e70-bc07-4a97-840e-a08a9e9f5eb6", "comment": "Malware payload (BlankGrabber)", "value": "0bfa763cca3c72443921f234862ce38ea7dc76f3e9185a626d666ad3d9b68bea", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343541, "uuid": "ac746e47-7aca-46ab-955e-175da961e74e", "comment": "Malware payload (BlankGrabber)", "value": "8517e515efefb82d6559a838d1dd5aabdd725447", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343541, "uuid": "dbd2505e-e1a0-4139-a3b0-c1606cc485bb", "comment": "Malware payload (BlankGrabber)", "value": "98cddc6ea37876d70358365f55826588c9be5221f88bea79cbcedf01b8881af1fd4a99fd9dbc4ef1e4382c43f8047827", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343541, "uuid": "e1796111-fad2-4373-b648-6bf24417954a", "value": "T18AE623027F3600FAF9A4CBBE64439B309E0368DAB05546AD1FB1D45938731ABDE72752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343541, "uuid": "2ddddf70-d741-4f38-b610-dd01db721a2a", "value": "738195c2e14aef404eb798160501aabb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343541, "uuid": "12f55f08-0bba-4f43-be0a-4c0c13235d50", "value": "393216:Zo5r+qXyxTCjncNnL1XlIycBncAIOeSZSKeK6N:Zowq6T08Ln7jAI1ieK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343541, "uuid": "902b6462-d756-4ca0-9bd8-21c5dc39f0b0", "value": 14607360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343541, "uuid": "f5c45da4-cd16-49e6-919a-cc238841536d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343541, "uuid": "c94b727e-c48a-414e-a9e1-3b383cb9e0b0", "value": "0bfa763cca3c72443921f234862ce38ea7dc76f3e9185a626d666ad3d9b68bea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9273b6a5-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341792, "uuid": "76ca000a-95f3-47d7-90b7-a4bc97fb0b5a", "comment": "Malware payload (Grandoreiro)", "value": "3cbc26e87eab9b48c2a16fe46825fbd6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341792, "uuid": "76bb267b-cdb2-4ee1-940a-61cceccbf92f", "comment": "Malware payload (Grandoreiro)", "value": "0ca4839ff238590f213110fa863fa4a16f6485fb3b035b9c51e1355f3bec1cef", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341792, "uuid": "0d5ed011-9558-48e5-b134-2123618ae6a5", "comment": "Malware payload (Grandoreiro)", "value": "3dfdc4885a54f5e5936dedf464e8de13edbaa9b9", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341792, "uuid": "de1a742d-e005-4477-a576-8647a91ae724", "comment": "Malware payload (Grandoreiro)", "value": "c30f4191d64af3ea3008dc267c3c8690a48c9f6c96db8d1e9b88b2107499ee2dc864a0336e1eb54e1a10b7ef07058648", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341792, "uuid": "883853da-2df2-4a82-8427-4c1aa3005e8a", "value": "T13B2623327A54085ACA9447B5B12F7A326F7EB61342CC94E278DDD283374BEC6D27E094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341792, "uuid": "4bfdeaa7-5bcb-4301-9b7b-bca5dcf05b3f", "value": "49152:2gDo3/GOKfF37eBrPUwP/YpQj2zGVHcRqDBHoETv7nL4FiYp8JV:3eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341792, "uuid": "a31f8a96-e7f7-40c8-a1a2-5b3200fc9c8b", "value": 4632576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341792, "uuid": "cf443e61-95d8-4213-bf99-604b3ffdaf1a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341792, "uuid": "afc03fe2-d6ce-494f-a1dc-92373923b4eb", "value": "Liq-Uid5282163PA3QBQIJRZ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec5d2cf-0c38-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771357194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771357194, "uuid": "e6d0ed09-96d5-4241-a8e7-cb7f0402899d", "comment": "Malware payload (Mirai)", "value": "52ee3dc6ee6a2d931739ddcf7f6e7de6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771357194, "uuid": "0149b424-c525-4f59-a434-65441ea11df9", "comment": "Malware payload (Mirai)", "value": "0ce6493de469904419813da8d187ea8c128ff0ce08c3fbe6306afaf9ca740ae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771357194, "uuid": "ee80e751-a887-4d60-a800-9e2de1718b8e", "comment": "Malware payload (Mirai)", "value": "c6fc32d37ccf39f5ee139ce7f8aef90a2010dcc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771357194, "uuid": "641bcc30-70ab-4521-9518-89ba196e042f", "comment": "Malware payload (Mirai)", "value": "fb1ba1c84c9a4be0850048e510111d22c8f1c2c0c60d428cd1a5a2678ce0d0d93e34eb5a93974074af6665feb800011c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771357194, "uuid": "ff5f7451-2455-4635-a168-b6711316590d", "value": "T15A834A51BD918A12C6D112BBFF6E428D372613E8E2DB7207CD295F54378B92B0E7B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771357194, "uuid": "db49cc8d-eef2-4ea3-bdfe-deabeffe7191", "value": "1536:zbjF6HQZ8oSIq9Yz1j3c8QLCvnhoBZBwgpnwPC515Mwnv0pnOh6TkOaq166yuvtG:zbjF6HG8z9i1JGBfsC5sSv0pnVmstMyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771357194, "uuid": "e4c48ad9-437f-40d9-8280-cac350752497", "value": 87824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771357194, "uuid": "e48d873c-beef-4bf3-b8a5-d6e4d767d11e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771357194, "uuid": "f1804f45-e255-4a79-bde8-a701a282f89e", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb5af14-0c2c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352249, "uuid": "13f1d3d2-1c96-491b-bb39-f70f28d71536", "comment": "Malware payload", "value": "81abbf1b6948c97654a6258294b51300", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352249, "uuid": "6540a77d-d702-47ba-86bb-9d01f1e5bdc9", "comment": "Malware payload", "value": "0d468b15e0a4763a51298e08c83818cfbf3055f24b7809a78da6a9556f9831ac", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352249, "uuid": "81a94a14-2062-48ce-ad36-3df4919832e9", "comment": "Malware payload", "value": "ca4cf88b62698071d6254e3a222499f87ebe6e37", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352249, "uuid": "5756127e-97d8-405f-a676-400ce75ae143", "comment": "Malware payload", "value": "103280c747f7feae8033431e3ac8269c03b0471aede7f2642d054a69c5443f0cd0df80d3949f2f9eb1a0f3e23f78181c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352249, "uuid": "2d916758-873e-440e-a4e4-31ca0c504ad6", "value": "T17651EB1126F90715F3B78F76587AB220AE37BE15EE07875D00909E0C1422B28E839F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352249, "uuid": "f613c548-665a-4585-8636-57e598e5dd35", "value": "24:8RdN/5joeKTBsWhCblWL+/CWbBnewvbwRSHkDctxddqVqCNC1XuHYLtcbjKmHD:8rp5jiJhINBe6bwmd04CNC1XuH0avKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352249, "uuid": "513ba34f-4846-4210-bea1-1c4c55c0066f", "value": 2840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352249, "uuid": "db671295-092b-4686-b84d-e9e4a164a9a3", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352249, "uuid": "cffbd3e9-176b-43fc-8593-c182de74156c", "value": "Concept_document_of_SHADOWBORN.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ce0f94-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300836, "uuid": "b2e62085-c6b0-4d58-9dc8-38dcfb274416", "comment": "Malware payload (Mirai)", "value": "680d3bf9a39b98eae023ec4e6fad31c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300836, "uuid": "444ffea1-781c-496a-a96c-9219009101ec", "comment": "Malware payload (Mirai)", "value": "0dd6c3f680d0c993c6c1ed0c28b76160f733cbc942e5efb71baf0907b85d358e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300836, "uuid": "e47e1f93-45c0-4c45-9da1-805ad898c118", "comment": "Malware payload (Mirai)", "value": "cb9c903d7899f2cb3275f943c08dfb0c43c1dba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300836, "uuid": "87c39377-895b-4e3d-9ffe-f5fb9ccc2055", "comment": "Malware payload (Mirai)", "value": "487a3f6c3232512b5e1229994d5a004b838b4e523f7b08a427b56805671da8f29d5481833c154e82674b56b01cc61bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300836, "uuid": "3ec6964a-6649-4754-b76c-2361d261a700", "value": "T14363B749BFA10EB7ECAFCC330AAA174525CD651B25B97B35B930D818F25E64F05E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300836, "uuid": "b2b58272-33e1-4a33-9d4c-e9ca1b669576", "value": "1536:GYN17h+ILeugreOZVa6vElK/T9/Sli46ZkHkB5x/:GYN17h+ketVa6ciZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300836, "uuid": "aeec1d71-b27d-42c2-8a24-507b86f90483", "value": 72084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300836, "uuid": "43d0f14b-c1a0-4016-a0af-dd27213c01eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300836, "uuid": "816e56e0-432b-4b81-ba49-c3753878be10", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb50f257-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352624, "uuid": "54faa09e-acf4-4c2f-a784-d0b52ab2ecbe", "comment": "Malware payload", "value": "2ecf2d4a353e0487904e3c8b3f14bfcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352624, "uuid": "21226716-53ea-433d-bef5-167f4172b76e", "comment": "Malware payload", "value": "0ed40d59d0248497a4ded2d4654c77f2e566dc3a9307e2bcb49c70765aeadd03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352624, "uuid": "bfda5a5e-cc24-44f3-a29d-61fa12b1e894", "comment": "Malware payload", "value": "db18ff5d4a0e691cc1d296ddadb07a93b0269ed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352624, "uuid": "6023cee5-4ec3-4cb2-848a-44fe594c0bd9", "comment": "Malware payload", "value": "dd8b6121f20abf282908841add39c4bd3e066df1664881b7c475e20a00074f47062184b9ad37c8d16b9d0cc18d379b3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352624, "uuid": "effdba77-8927-4933-b0ad-97627d32ab88", "value": "T184D58D17BCA404E9C0AA973289A696967B65FC090B3023D73F50B67C3F72BD09E79714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352624, "uuid": "2fb91bb8-23e0-4b82-b448-e892827661bb", "value": "24576:OuZYK5iz1eflzbNKDkM9fILiNuo5Wp8gQoAvVb86hr79eyY2zirGt5PGtQfi83VY:OIYKgzklfXMV/g418Sr79/L3Gef9Wg1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352624, "uuid": "29676f89-8596-40d1-b184-9d816448b47b", "value": 2903431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352624, "uuid": "4c7a298c-3fc0-4360-b9f1-85fd41e3772f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352624, "uuid": "61b6142c-e779-42fa-94e7-bec7dc121eea", "value": "c2_server", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec38cbb8-0c05-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771335500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335500, "uuid": "1968055b-cebd-49b0-aed1-0274c47b5c32", "comment": "Malware payload", "value": "3222012f033e3e20b5d1ebc7cb869ad8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335500, "uuid": "be93465a-e78e-481f-9c60-8094a852c45b", "comment": "Malware payload", "value": "0ed5d860252188e9a0d03424029339e214c69bfbc256b705ea212f3bf0a2c9bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335500, "uuid": "2eba8f71-df30-483b-8e0f-15d370b660be", "comment": "Malware payload", "value": "d6ca961be9ed210c35d04e8e4be6a018611d76e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335500, "uuid": "4bf87675-df4f-4354-8eca-ac5d0faa9da4", "comment": "Malware payload", "value": "6b8da78f48daa01467d01954fbd36ea7a31b1d6c1d50e5969be5104883ab98c2b1d58472555d01a95e0d6b10bef407d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335500, "uuid": "210ac02a-30d9-42e5-be3b-379a6538b89d", "value": "T10256D58523C4A47237232BADA739EAB1ED0A4453A6C5D708709DFB54B19CD47A3387F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335500, "uuid": "a4152e20-1bb4-4362-9ec9-c6b3f45dfcc5", "value": "98304:zSMjssRb2UFXvDOJ30XCmJO0yOLPdOQBGDsFHLRPTG+SeMq3h/vQbV3pCP3RxO:e0RCUG0StAPbFHdPTGs3dvQRZCPBxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771335500, "uuid": "d7c9f27c-9cc6-4135-8713-d8ae0a027b7f", "value": 6339534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771335500, "uuid": "cc88b7fd-419b-4375-998a-ba99c73b6473", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335500, "uuid": "4a2dc060-5c64-4664-8ad2-206e0cef551d", "value": "DOCS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053ee22a-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771300753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300753, "uuid": "4c6d5def-3b58-4c8d-873d-3023dbaee06c", "comment": "Malware payload (Formbook)", "value": "b5967ef284d529c15df880c7f83def02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300753, "uuid": "02791180-127e-4f0c-8f3d-e03fc9585efe", "comment": "Malware payload (Formbook)", "value": "0f3ed4b01057be3c2e400ab67a130ed469ddc777476017492cd5d68fac579abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300753, "uuid": "42fdc94a-6df1-47e1-8649-a9bbe03218dd", "comment": "Malware payload (Formbook)", "value": "e9275471b7f0da3ce4443b5f3f249f8289b3aa34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300753, "uuid": "19c9a033-6b8a-443a-aa04-9cf3b5b16bcf", "comment": "Malware payload (Formbook)", "value": "39305f9ace107602978d8a53e8d226cc87bac2578fa9378f117426c37be7c0f18dd4e36ed277f66c5f905eb5394eb42f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300753, "uuid": "9e7c1cfb-a57a-4ac0-9677-26445c83f3a1", "value": "T16B2502482755EE03C8AA0BF00AB1F3B00BF55D99A511C3579FFABDEBB526B952D011C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300753, "uuid": "51e55233-6ef5-4bbe-aabb-df70c82f6231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300753, "uuid": "33be4cc1-bb7b-412a-9553-c1966eb09759", "value": "24576:+qu2VksCZ87PBaJGsH+GraUzMRnk+DwXK01B2m:+eVGm0JcCjBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300753, "uuid": "90df448d-eda4-4841-8c61-3b705948d83a", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300753, "uuid": "0ae0109a-9da6-4c98-a2d5-9f33d67bb5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300753, "uuid": "83e39901-65e3-41d8-8906-c172776c2e43", "value": "HSBC Payment Advise.html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59855802-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341696, "uuid": "8b8f9463-254a-47e2-9d3d-e6d6d6ebbc29", "comment": "Malware payload (Grandoreiro)", "value": "2a0b5312dd807ac2821345cd5835b23c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341696, "uuid": "8126455c-2567-42cd-9478-a4d7dca24b75", "comment": "Malware payload (Grandoreiro)", "value": "0ff9448e41d74a7c3bd27b5eebe866b3e0f6944f4782a9ea7f9bea893b0bc0a8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341696, "uuid": "8914bd48-2217-4d9d-b380-b239a8e01c9e", "comment": "Malware payload (Grandoreiro)", "value": "50ce054849a98d013afc19d9f618a172b2b01f37", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341696, "uuid": "0039fd45-87fc-4895-842a-e76cdc7d581e", "comment": "Malware payload (Grandoreiro)", "value": "b1b0fd06f9de97e291f619aa489d64b7154f916a06d4656dd25da32b475036a3ed798a16b2d6a68fdc0273ac39a28ac0", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341696, "uuid": "de9c1ec8-668d-49fd-8cb1-1adf5d87f07a", "value": "T175562332AF944CBAC6904374702E3F387D7E7A039A8D469679CC95863B4FED6815F089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341696, "uuid": "67a22e9f-cab5-446a-936f-6219e3a90dd6", "value": "49152:uLFlQxKbp4Y8Sm334XKUT+oBA9KPa5SsNRLEwEwI6OwkU/CEDpvomi73/jmZfz/Z:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341696, "uuid": "9bffada4-12b0-4407-840f-d2ca1ce05888", "value": 6414336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341696, "uuid": "6376bf40-0941-4a7c-8090-0f0ad84212fb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341696, "uuid": "926bf8e6-30b0-4d45-af1c-c414ba865261", "value": "0Ofc006016BSBXYKC7AT2-872261.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4422c53-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311461, "uuid": "ca4eb1c4-b8c8-4bb5-b6d7-1e84f04cbaa6", "comment": "Malware payload", "value": "d6b770910e2a09a5ba1847e16955888f", "object_relation": "md5", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311461, "uuid": "a2090490-7401-4b68-933d-28ecf19fc5ff", "comment": "Malware payload", "value": "1011ba9b0a530ba47ce40d13be2380e0da42507df6ee07f5f566b9d5d3e35acb", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311461, "uuid": "ee762f31-4128-4c7a-9510-ff5cc67e57b5", "comment": "Malware payload", "value": "ede30c03c6ccaa1f7c86e318f8f51b3c1d4b11c3", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311461, "uuid": "e1881ea8-8be2-402b-94e1-df0f939029c4", "comment": "Malware payload", "value": "a2493a212e58c65dd17ea555c80dbd3c3b2b2abb99f140c1493e24ceef2b95b0a8fc952147e5a79c05b5c07de0b5589d", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311461, "uuid": "8e617d5f-55c9-46bb-b70f-671a03f6323d", "value": "T162A0022110801729AA09A0788777D9C04224674282537AF16A8067CA6D507F8D990F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311461, "uuid": "4a3fa1f5-62cc-4878-a962-2b6e90c78d0f", "value": "3:VSJJFIGFBriv3cb3ExyOGv:s8GFBr4cbUxzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311461, "uuid": "37a18ca7-8574-4c43-b4be-91eef3de339e", "value": 60, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311461, "uuid": "3c8d9ca8-03b6-4644-b006-bb75247acfb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311461, "uuid": "dc716054-f8a7-4373-a3cd-a71f29d76034", "value": "1011ba9b0a530ba47ce40d13be2380e0da42507df6ee07f5f566b9d5d3e35acb.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0b682a-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300849, "uuid": "dc79eabd-840b-42b4-a958-c280e22c822b", "comment": "Malware payload (Mirai)", "value": "78cc5d4f06c16b4934c6fa8e86151282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300849, "uuid": "491027f8-d57f-4894-9118-1315758d1cb7", "comment": "Malware payload (Mirai)", "value": "105083f918f4646b137ba5b4b3bd8d1d45aadd92e6ae86c0ba92d9824efe1f0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300849, "uuid": "a5eff746-4f51-4537-880c-37ed53f97908", "comment": "Malware payload (Mirai)", "value": "6555539daf9d4fc78a1ad8ffa5a20432d0736c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300849, "uuid": "f6d1980b-5394-4be0-87f4-b4e34310b2b2", "comment": "Malware payload (Mirai)", "value": "3ae831805dc42923e76ed50164a5d0f226cea2f9ce1412bb9c6edcfb026f35b641af5dc84dd19079bce4c61f565d3d06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300849, "uuid": "77dbbfeb-7484-41be-8014-acf7a452e742", "value": "T1D9333903B98481EDC05AD03453BFB27AD873707E123D728BA7E8FE276C05D501EA9899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300849, "uuid": "7f265309-154d-4f1f-a519-7af641bb5372", "value": "768:mjajtjFz1GIOBfRjRXyBojFTx/jcEZw3XevKSVG0aFNBcFEALQ/wE:xjtjFWRjRX2oZTRcqrySVG0BFEALQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300849, "uuid": "1f3095c8-ac08-4b58-8b51-0ecb95a5c246", "value": 54688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300849, "uuid": "abef4111-2ddb-4a6e-a987-8d16f77284e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300849, "uuid": "b1ad4913-b926-41dd-a5e9-51a12a8d387c", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba32d8f-0bf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1771329352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329352, "uuid": "f1708820-52b9-4ee9-92d7-cf85dade0a61", "comment": "Malware payload (Meterpreter)", "value": "fc136777cfb8496b465a7039ae67a45d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329352, "uuid": "83dc612b-d84b-4889-9598-756242f1c9aa", "comment": "Malware payload (Meterpreter)", "value": "10b7dd4d46726d15784d19bfa843585b81ea2441c358568d13b4a8a081c6b7a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329352, "uuid": "536d921e-a436-44d6-b6ae-5ceedcda398f", "comment": "Malware payload (Meterpreter)", "value": "efaa4d2e955a65952350831936adb0b24cc0f146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329352, "uuid": "e55b88de-6076-4484-b5a2-bc531736a186", "comment": "Malware payload (Meterpreter)", "value": "2c0b7264c4712bac57a5ec6162f0c0783ecbfbddea37b1eadff4704050e299b75ba1e38e61fff3b37db987aa240c1cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329352, "uuid": "234e686f-2e99-48db-9d1b-fffad15b4b3f", "value": "T102F13FD2731168B7FA381BBF8283DAAB62FD7A3072A7075A065400192681D6A7531B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329352, "uuid": "1c85e5d4-419d-4931-ba55-d1153ce48560", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329352, "uuid": "393a8ce3-7ba3-4a20-a528-4344d70b14b7", "value": "24:eFGSGthVmpFKknehtht6dp5raKq9K9q5eNDJSqUmZEWdXCI2vp:iGthcvnehthEdTE9HSDoqUjWZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329352, "uuid": "a1775ca4-ccd8-4cba-a18d-1743674eef8e", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329352, "uuid": "883cfae9-73c0-4885-bb0b-1bdd0e275427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329352, "uuid": "118e35e8-b237-458d-baf1-d34620a9120e", "value": "shell4444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce046e5-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312711, "uuid": "f1e0ae58-3aa6-4702-9230-8f9c1f166b25", "comment": "Malware payload", "value": "a3dabd8c5d00b2ebd914140762071ba0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312711, "uuid": "c432f06f-db31-4759-86ff-7daaaa415eed", "comment": "Malware payload", "value": "110448e79cbe49ba5d42fa6d3883f93e307628802b88e3bb6d542e9b6fa98a98", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312711, "uuid": "8554e6a6-b1d4-47ac-80c5-72942e3544fd", "comment": "Malware payload", "value": "bf8276f95ec7aebed2da31c33485b6593dddcd0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312711, "uuid": "1468f1e4-1b9f-421e-9c05-0532aa4bf601", "comment": "Malware payload", "value": "225f9af3980f68ef113dd292d2a357d3f54d05e5da99c7fa6c6771122f367bf534afc9349ed334bfaa6e8c8d9c56c84b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312711, "uuid": "198544c9-e366-4dc7-8005-2c767b926378", "value": "T17245FEBF882D69E817462506663A3377ED0800C37F8BED26BD17D2F7F0467AD856A124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312711, "uuid": "d77eb04b-2d84-4aec-ac7b-a19f7e58af56", "value": "192:ZJEv4JvAkFhfODILOhXyXpsOgJGUCQCWQOJ2/KD9D2Z7f1pcoZsgGnQQB+A5LTbS:ZJE0os4ILOLOGqOJQKZyxEnNLvm/TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312711, "uuid": "b726377f-261e-40f9-8e47-89689f0750cf", "value": 1189979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312711, "uuid": "36fca19f-e9c2-430e-9b66-9c7800c04044", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312711, "uuid": "f9a9c5b9-5663-429c-8e40-154ff5a0d188", "value": "a3dabd8c5d00b2ebd914140762071ba0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31dac87-0be1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771320023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320023, "uuid": "9f37c16e-0cfa-4348-bff5-8ced50e371e1", "comment": "Malware payload", "value": "56fc994d21e5fe0d39576d7b550c17f7", "object_relation": "md5", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320023, "uuid": "ec477688-c68c-43dd-ab51-8c6c18720a6c", "comment": "Malware payload", "value": "113c133afaf9312ab4aea413456e9107de2b9fb1694dc31f8747bafdba2980ce", "object_relation": "sha256", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320023, "uuid": "d5177aef-b94c-49ed-bae1-5f7eb43ece46", "comment": "Malware payload", "value": "8013b10c460e23c0235dcbfcd4d91514da110154", "object_relation": "sha1", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320023, "uuid": "dab5425f-3035-47d8-aec1-625c50f54920", "comment": "Malware payload", "value": "72fb927e0fb48859228364fb951ec0df1233b158d7a854c6a067ed842f1d4453c02d15fb9464b8e9481532d0ee0fe18a", "object_relation": "sha3-384", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320023, "uuid": "b9815868-dfae-4ec5-a989-b6a9d83b80ad", "value": "T1ACA60122F6C280B1D88A067455BB773E7E3957230714CDC3EBD8EC65ED621D2963A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320023, "uuid": "913216ca-7a1a-4aa5-af5b-9bb7c746f44e", "value": "6673493b5c94ba48ae41b9a1275e1276", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320023, "uuid": "02ebce4b-bcb0-44c8-a22c-eb62524eb71e", "value": "196608:kxzbVGbFi0r7ZZJZo7KFyp0vofzXkfPGujBslD5ybdP:aAbFJnPJZE50GUn9jBslDMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320023, "uuid": "62f371e7-e512-42b4-9d5f-9f9e844ffef5", "value": 10346496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320023, "uuid": "4a85af51-2405-4f1a-877d-cc5cddfdc503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320023, "uuid": "d7728b47-befc-4c1f-b9dc-4f0faee53dbf", "value": "HanNEL Beta1.3.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b12578d-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341779, "uuid": "b6c25521-33ee-4c79-b343-8dfe64014c06", "comment": "Malware payload (Grandoreiro)", "value": "ea6c43140b49cff634d8d0f28ee29fb2", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341779, "uuid": "c4beaaf8-8762-475b-bb57-74d9828ce1e9", "comment": "Malware payload (Grandoreiro)", "value": "11f14057cc19618a1e30a12459a3a7fb84ca732736dfefb9da2d1edc4d9cea8b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341779, "uuid": "22c54aeb-37b0-409b-a9eb-c3684b9ff426", "comment": "Malware payload (Grandoreiro)", "value": "a12d7502d8b699595534582baf3f647995e16c7c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341779, "uuid": "b4bb4091-8350-4ff1-93b5-0067afbeb257", "comment": "Malware payload (Grandoreiro)", "value": "eb449d4068f4e80f7a84836ccaa9ff13b338b60f310993a2c2ed46c51a861f0a3521721229216483fa8d3d9df1a56d90", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341779, "uuid": "cea548d8-308c-4985-aef1-2eb7344ff7ca", "value": "T144362331EE806C57C6408279743E2A326F6DB2038BC9D5D368ED528B3785DC6593FAE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341779, "uuid": "1c4421a0-098d-4f33-97c8-b926bd4f9a94", "value": "49152:1yTrv/m+mL/NnNkJ0LXud6LhxGbZ0f+W3XM4i4Op54/5b8kj1c76MimvDo71eUb:CI1eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341779, "uuid": "0cede847-75db-457c-a593-5dc36e3d05ce", "value": 5167104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341779, "uuid": "a0513c6a-6b1a-48cc-b7ac-a35903f45002", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341779, "uuid": "7116d3ff-16c4-4481-bf36-30fec1e3e85c", "value": "K6517SXVNHY36505_Grs-31889.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b62d740-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353833, "uuid": "b9f72ddc-2901-477a-abec-787ac18668e8", "comment": "Malware payload", "value": "28317692c6b637dd9baa53e3d96746da", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353833, "uuid": "c8e12323-2d07-479c-b849-96d2141a91f8", "comment": "Malware payload", "value": "122483c15e4414490ddb12798297f9ca78710e3b9329a9a3653313aa8aac03b8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353833, "uuid": "02a5038d-6564-4c9f-a94f-6077eeeefd55", "comment": "Malware payload", "value": "37795eaf3b5f904cf010c8e2ec74d30881d5a118", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353833, "uuid": "976c681a-104a-4c74-9841-047dfd3e8254", "comment": "Malware payload", "value": "52f9de27ae38f7e1e212784b1f2f30217fe02ad6cbdce03ded71e778ee90a0fd7cf2c1a70db2055b624a78a298e04083", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353833, "uuid": "11f46ab0-a72e-4d15-a3f4-2885bf9bd1c3", "value": "T1A8963331BF591DABCA508371702B2E392E3C3A03948CE6C535ADD5C3674AFD55A3B4A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353833, "uuid": "3cbae90d-b211-4a47-9881-d2b4c30de4f9", "value": "49152:z0Fv1f56QyKPix/6zxexxwgwDAcBS0VdpwbkXOGHfdn8HOs8CFUyz1tZTNs/PIet:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353833, "uuid": "40c2be80-b88e-4ac2-abd4-d86787199566", "value": 9066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353833, "uuid": "c76571aa-53b6-406d-a62a-bc1727534bc4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353833, "uuid": "91e414f8-c8cb-4be7-86fe-ad95b94ab950", "value": "ROULYRDict-31784340Mptfgdd.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b4b92b-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312799, "uuid": "6033f8b8-64d2-4c19-b73a-b497f5f69aba", "comment": "Malware payload", "value": "487f50601f6106842001e7f7b6369a2a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312799, "uuid": "25f1f81e-8a44-4eb0-b6e7-b12671fdc270", "comment": "Malware payload", "value": "12fdceb6d837be10e3cd18faeaed560e027a42cb9f0e5a9fb35cc64a236be8d4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312799, "uuid": "52e77e41-cd31-4e4d-9b62-eb0c556c1728", "comment": "Malware payload", "value": "b540282d1abcddf883c4d4869eb7ded26f0c3773", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312799, "uuid": "523f741c-f94b-4c01-a863-4e3c4a23513f", "comment": "Malware payload", "value": "d0ddebd6f2a5154ce82251d7ceb3a2e0bd009b060640f00a5fc2b32eecbd9c0b82b635c42031c45929d5457168ba2c05", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312799, "uuid": "85efe5b5-2557-4d95-8811-c31c5ea40eb8", "value": "T1D64545FE3F8A2623B5B75F50500440D9E94FC4812D4927C8FDCAE660654F2EE1662EBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312799, "uuid": "23000741-f69d-4c0c-8749-6b853ad9c3da", "value": "192:faxFsKtFsKoFJdu6l23CPNm5ZHfkPKTF8LTomWnxX2oCPNEo7H7cEHtFPKoFCMnG:DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312799, "uuid": "9a98f1a9-d766-4245-bb54-2cdb4769ae39", "value": 1182514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312799, "uuid": "5b3c76ed-8489-4255-9563-56de8121340a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312799, "uuid": "cf6c4c45-531f-4d2e-927c-2237db15a544", "value": "487f50601f6106842001e7f7b6369a2a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e16be09-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309008, "uuid": "930ddc64-449e-42eb-866e-4a3c1285e84a", "comment": "Malware payload (Mirai)", "value": "e6cb450c67ecc042457ccec4e5bf6134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309008, "uuid": "51b02b52-d502-4732-a69c-62463d07c6bd", "comment": "Malware payload (Mirai)", "value": "131e58a2ee815ef3ee065a62727cfd1d369d6b221ee72a88f173921570ccdc23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309008, "uuid": "2d23c197-cbe2-48d4-93a0-c9f2c3c401ff", "comment": "Malware payload (Mirai)", "value": "24129cebbba9c9f6f7affd0220bff8c655d45349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309008, "uuid": "433e090c-59a1-4ca5-a0c7-a16c954fc398", "comment": "Malware payload (Mirai)", "value": "446203c1a24d1736316fb12dcd4880b91ed3aa3b58ca0faecea5f854ef18b7a835ca1984dd2c159e24deecdfa2e71ec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309008, "uuid": "13168d3a-ee01-4127-a8c9-eb6b194bc4b0", "value": "T1AAB2E070D3A54E91FA7F7DF63E2155C637B54B6B326B8B99B0815EA09012371A200FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309008, "uuid": "d3675c91-b88e-43c9-a8b5-fffc525984ae", "value": "384:FG7Z8Y9y37VAuf8m8gkBjzwjE6scDyzNG1qUPHeVNe7ggM4uVcqgw05sxJfF:kOY837VZf+FwjE6rDyzw19HFA4uVcqgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309008, "uuid": "b604563c-60ba-4189-8911-1e47d178552f", "value": 24408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309008, "uuid": "9c1613e4-39ba-452a-9058-83f1c291dc6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309008, "uuid": "9810bc00-a414-4505-98ee-f4af626da6d5", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942f6823-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343083, "uuid": "94191dd3-b4fa-4420-9abd-49bb8a06a51b", "comment": "Malware payload (Grandoreiro)", "value": "e68c5ee20072dade48f27a31caead9e2", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343083, "uuid": "2dc0f75b-62b6-4823-bb7a-cccf1d22973f", "comment": "Malware payload (Grandoreiro)", "value": "134be112fcd867aa2df84a18a5a150f1162862a5340726f09d6e825532cd9960", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343083, "uuid": "72b90324-9a67-4d1d-adc1-34f1beb3fdcc", "comment": "Malware payload (Grandoreiro)", "value": "832322dcbd99cd90c8a3173608d5156b0139f74b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343083, "uuid": "b1b16614-89de-4fda-bbda-6450c1bf1981", "comment": "Malware payload (Grandoreiro)", "value": "e22f0ae4408ff32d1db98bd8def91306d173e4ce35a5592ca41feb5e941f151ad5d282e98755c1f69effc2dca9d976cb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343083, "uuid": "0c3a9da4-20ea-4c6f-8e6e-db00785256b9", "value": "T1F67633326E761C6BC7D08739702F6E124E7CA953874CE5CBB06CD1923386AF0657B4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343083, "uuid": "7014086d-280a-45d1-8c8e-b84a8fd8367b", "value": "49152:jTl99sQivF9zJFN5GOcTZzosbT1o2oYprFDGXActeMw1oOoKzH41PEG//m9N6eVH:D0g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343083, "uuid": "82d1bd20-9678-46a7-ba4a-a6231b0e953d", "value": 7460864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343083, "uuid": "48e9c4cc-d2e2-491d-88ee-808d3b809da6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343083, "uuid": "40987d40-6330-4e45-ba82-fca93a87f156", "value": "AnexPZRZXG7512_5CQ410213RDPUNV.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03186fa-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771312743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312743, "uuid": "5631b3df-fbdd-4e7b-9107-04a0fae0d844", "comment": "Malware payload (RemcosRAT)", "value": "d645aaadc0a79013ddd0f792e430d402", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312743, "uuid": "a48f10d8-1b38-4f08-a7df-26d495ad76ad", "comment": "Malware payload (RemcosRAT)", "value": "13ea932a7f860bdb654fcd61e7768b9dbe289799746ea015d3c54a5ff26f32a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312743, "uuid": "8b5613ac-7b37-4ea9-be02-99d80d990fd4", "comment": "Malware payload (RemcosRAT)", "value": "45e12381bb4e70e3c4372897bcd389a250166c5d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312743, "uuid": "e1870fd2-e2bd-4742-b92f-ecd69a778335", "comment": "Malware payload (RemcosRAT)", "value": "479f09d0a406ccd8a71c85bd5f55b879668837e795412acd94296a4aacd61ba3c5f61c0d848747c2c6fe539616595b1d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312743, "uuid": "534158fd-2d37-4b95-a522-70622497e5d8", "value": "T1BA3512F6295F589AB278219B64F97504AF014D0A73E3D90FB80390C3EF8D99A45E6337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312743, "uuid": "63726618-b04e-4f7a-8219-a87b9104c5d1", "value": "96:M66666666666666666666666666666666666666666666666666666666666666s:s6r8tBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312743, "uuid": "91061694-41ea-4f53-9ad2-e03e34876ba6", "value": 1147791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312743, "uuid": "513a9a64-8ee5-4462-801c-5913075ea24a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312743, "uuid": "7cd5193d-1300-4503-98fd-5af7352fcbed", "value": "d645aaadc0a79013ddd0f792e430d402.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8403669-0c05-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771335493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335493, "uuid": "d9d93091-8c8a-48b0-8e4a-8f21e35672ab", "comment": "Malware payload (Mirai)", "value": "971a610a0ead9763564c964e3e5b5299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335493, "uuid": "d1e13fd4-b3be-4766-b208-860bb1e18606", "comment": "Malware payload (Mirai)", "value": "14a883c0acc0705153dbd4bec7eb4b9adc026ff4bb41c4ea8f5116267d28a601", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335493, "uuid": "61a4a0ed-adb3-4888-b715-f03cbd360f4f", "comment": "Malware payload (Mirai)", "value": "30f321da22719ff5bc73bbd4b6b98ae90385c0cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335493, "uuid": "42d2f0fc-e92b-4323-ad90-de674dc808f8", "comment": "Malware payload (Mirai)", "value": "edc60265afef2d7b3b0b1af3329140a81da4d53c70ad8dd8b119da5c32a4f551250c4433647f383be1cb4a08a4598005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335493, "uuid": "fe061bd8-fd99-440c-bf61-20cbaacae106", "value": "T17CB31946B9919F12C4D721FAFE9F458933036BF8D7EA7102C8206F54378A99B0EB7512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335493, "uuid": "51959d26-7df2-438a-8066-336b00b962f2", "value": "3072:qpc35T+B4RtO5aCwYZbdWr7m7sBrRbHyEDCa:335xRE5aCwYZbdWfmqTJCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771335493, "uuid": "8864b7e9-501f-4ed1-afd8-8d9d0a0ed56c", "value": 110696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771335493, "uuid": "7de35d63-cbe1-460c-bbb4-218fb24349dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335493, "uuid": "fd034cb7-f1db-4c9b-b709-1b444adf094e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17cf2bb-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343186, "uuid": "0d56e4a0-6fdd-4ad1-9400-75ab179694c5", "comment": "Malware payload (Grandoreiro)", "value": "1098b486f24dc714426e275ffa526a08", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343186, "uuid": "0d6bb584-e260-4a34-b904-8ffddb134095", "comment": "Malware payload (Grandoreiro)", "value": "1553ba025c261e4b8af28dd79f74fe49184730066606c6cf239f5063966e6270", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343186, "uuid": "1e774619-792d-4adc-bfe2-45b282087ddf", "comment": "Malware payload (Grandoreiro)", "value": "0d5facbe6a1f73ebf9378cb1a58f4ac34fe7991d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343186, "uuid": "db17e88e-7442-415b-b673-c89039be939c", "comment": "Malware payload (Grandoreiro)", "value": "9104f5a96b23a0f05e34aac65d6f2428523b70352c0c872b91ada697f833a8d401d8fcc94828e12c5f46362a66e9fc73", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343186, "uuid": "a06da602-6713-4ba4-978a-bf795647d36e", "value": "T19E562334BB41087BC8500372701B6D2A6F7E374B4548A6D67C9CD1A7E35BFD1A63B868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343186, "uuid": "3aa677ec-9fa1-4d14-a550-648459157b45", "value": "49152:eiLvMwdMN3BTtR8fcpF4blG3i60FEHbHNgwuJ4UX55i10Ijn2BiV9uim3YQiP7:0uim3YQij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343186, "uuid": "6f9b3797-aaaf-4d18-81e0-ce45f0907cfd", "value": 5994496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343186, "uuid": "ad7a244f-f479-44da-bb02-68b8ec68260f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343186, "uuid": "23f60f5b-f39d-46b1-9e01-fa64ad1ae711", "value": "Ced-2428ESFMJS7R2NP_Vrfc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2628b16f-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343328, "uuid": "96e1819f-0e5b-430a-a031-27db103d0605", "comment": "Malware payload (Grandoreiro)", "value": "fcd796a2c3849a0b32266d67074711dd", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343328, "uuid": "be15877d-4b76-4bac-94ab-8faea6077820", "comment": "Malware payload (Grandoreiro)", "value": "15b9ead1ce6d6be29d84c24516e5086b36569739d22220c00b0fda950ece1c2c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343328, "uuid": "5689bb3b-f5f3-4bce-8283-cde0278627d3", "comment": "Malware payload (Grandoreiro)", "value": "5b9cfe03fd5e6aada886db292b8a2221650cf233", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343328, "uuid": "d9aefe25-7d75-430d-9f74-fcb24a4c5520", "comment": "Malware payload (Grandoreiro)", "value": "c18b5e100419cac94cda6adc02e62ddd5e4d9b88d878c37fcbbd8f48710a6e6d0ff0b3f8be2713d300acdb7811bf9fba", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343328, "uuid": "76b7d3f3-fdf8-432f-aa9b-4e5d1bf30c4f", "value": "T1F9563332AF695D6AC6508378B02FAD343E3D2703818DE6D1688DD1C73387ED6963E5A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343328, "uuid": "967840ac-dd25-4f9a-a555-5722f41fa7e5", "value": "49152:x42eg0s++3cSlyUz4esr2BotTKYOwocjk8tdg0MlD16UWu633OLLXY4XOGn+ZB03:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343328, "uuid": "a850fbf1-aaab-4339-bbbc-a5dfa2ce62bd", "value": 6027264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343328, "uuid": "ab68df18-3307-44af-a30a-ad7a265bf715", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343328, "uuid": "44292e94-75ef-43b1-ae55-5541648a46b4", "value": "O5A5Sntc-88545SIJUFO065.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c388ec8-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312817, "uuid": "e285ba53-0eca-42c3-a40e-b612a7d2e696", "comment": "Malware payload", "value": "060013da80032e58bb49c862db2acaf2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312817, "uuid": "8106f392-ca77-4b44-ba5a-0aceefd7b277", "comment": "Malware payload", "value": "165ee7f331edb59e0da1fa4968950b4c56f595ffdb60e8be5a1adfd8405a045d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312817, "uuid": "4d6c8c01-e10f-42a6-a84d-4cd4f058e4ab", "comment": "Malware payload", "value": "a2c554362a0649b66af22506717d95568150a470", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312817, "uuid": "93d1a26f-3415-41b5-8a80-5c16f369fcd7", "comment": "Malware payload", "value": "f8b29332d1d8ad1282d2c53c0b0f8c9169cd2ee6c5e45ddc1625f5c2961e10921b9f54d695a5cb6456dfa67c6ca5a9b4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312817, "uuid": "7f017fef-912c-4671-9539-7239001c48ea", "value": "T170363370BE981D5F07A08729B19B6A21AEFD4A43CB0DD7D689CCB1873645EC00D3F8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312817, "uuid": "2d2d5aaa-f264-4291-8998-9aa2e23ad813", "value": "49152:pBJGDmVo/gw32NGmMwvwwYvoxRylFnA/Oq6+yXfwwkDqECSkdWGha6tzqOzv5WYc:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312817, "uuid": "7ee8f3f7-351b-4df5-b916-a4255247e985", "value": 4987225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312817, "uuid": "68e9e2dc-7d68-4e45-94a6-d2ec6d55d30d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312817, "uuid": "65f09cf2-a06b-4c05-bd91-da264cef2032", "value": "EHOOCertif-411234U74LOMGKUinkonb_Nota61769.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3622ea97-0c0d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771338630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338630, "uuid": "4fd3e7f4-77e1-4930-9494-5a7900a0f788", "comment": "Malware payload (Mirai)", "value": "9e1cdde1196ac624ee89110c33f7677e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338630, "uuid": "5c4dd8ec-06a7-42cb-ba7f-4b63ebeabe1e", "comment": "Malware payload (Mirai)", "value": "169383cb6cb200f06a5a07fd06337e51050c75c62aed010872f61edd25d55fd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338630, "uuid": "b4135f7b-4705-42e5-94b9-1731d9e11a25", "comment": "Malware payload (Mirai)", "value": "b8d83975ddd809a2adfb3cc0acbfcbf33c356142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338630, "uuid": "f9380042-beff-471d-97c3-f83db034d0e1", "comment": "Malware payload (Mirai)", "value": "9949f004d66017d708d055a174bd6f1da3e06ae5190cb56b980939f3f6b07cab7169bf2f3bf7d8ba8f77ca4fc0d8a33d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338630, "uuid": "7eb6eee5-fb5b-472e-87fa-2cfe7237bc26", "value": "T1ED63B749BFA10EB7ECAFCC330AAA174525CD651B25B97B35B830D818F25E64F05E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338630, "uuid": "62557a90-e3db-43b4-901c-4c31c0600362", "value": "1536:gN17h+ILePWgreOZVa6vElK/T9/Sli46ZkHkB5x/:gN17h+kePlVa6ciZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771338630, "uuid": "d230c5e0-94e5-4993-b6e5-b4dfc3acdbfc", "value": 72084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771338630, "uuid": "28c5461c-ae03-40af-b839-161e36457e5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338630, "uuid": "3cc33bd4-a6ff-4748-8c10-d9b65cc61a5d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d7d69c-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343061, "uuid": "f8a53041-f046-4aa6-9bc7-309898a965e7", "comment": "Malware payload (Grandoreiro)", "value": "d856dcf6f02cc67b6322978c2763e14e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343061, "uuid": "d2dfef90-43da-48fa-9c0b-36384ce50085", "comment": "Malware payload (Grandoreiro)", "value": "16c68d3bde8a730d0a93a1bf39284f9b4720ab620ccf34c9ff78babba15607a9", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343061, "uuid": "092fa708-7efd-42fe-bf77-0fd6f3e9362e", "comment": "Malware payload (Grandoreiro)", "value": "ae777fb3bbce20719c6c142ba851fbbc064f0e3d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343061, "uuid": "26934a16-a6d0-4c04-b19b-c20c1d54ddc1", "comment": "Malware payload (Grandoreiro)", "value": "273ac43e98d8bb4e486882c19aca64491eb5338a591a111d8bf68cfa6dd034491241292d86c3a9d70f1fcc1b1db819da", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343061, "uuid": "67d862d1-6117-4200-a644-64ce5d7668a3", "value": "T1F2563332BE4058A5C5618371B12F2E267F3DAA13674C96D3B99F80473B4BAC1D93F41A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343061, "uuid": "77c6bf46-27f7-4d70-8bc2-507f8e844b9f", "value": "49152:RwL9V1IcAXz/qCNDsQvcjn4UdjqnvfMQw/5oyt7iZEl7eXMHVDfuk0O6JoOQxpUN:u0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343061, "uuid": "9967379a-d575-414d-ba42-6c0b7bcb7834", "value": 5918720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343061, "uuid": "127d8ca3-d2f9-46b4-9511-c80ab5dd2d38", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343061, "uuid": "c50e5384-e916-4b7a-982f-49759b359d9e", "value": "9NJT12474Im_NEDGEB-231117V12P.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32431a60-0ba5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771293956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293956, "uuid": "e5de1109-8558-48ad-9973-426a8b946adc", "comment": "Malware payload (Mirai)", "value": "050cac48e4de6ed5e8c2bd98f4785602", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293956, "uuid": "0a5d416b-7cb7-4744-873a-ef22b221fbb7", "comment": "Malware payload (Mirai)", "value": "16da55424a1e4f28a06802aad9ce237c6e94f1ee04564a35a86b6eb0311c790c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293956, "uuid": "c997cb11-9b94-48d8-85a2-94bfa4b4ea4c", "comment": "Malware payload (Mirai)", "value": "0dca19d24a6f6a8371f3cd395bf024f692095d61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293956, "uuid": "9939520c-f000-4c16-83b5-8efdb2e06d85", "comment": "Malware payload (Mirai)", "value": "1c65bc47c9b2c28d86af2224a8e5c8dda6ee592be8d2c7d7582285e454042ca62c29c45b3e414543c408691d43f66108", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293956, "uuid": "5dc0cc4d-6ac0-408e-98b6-d59dbcea32be", "value": "T126639209BF611FF7EC6FDC374AE92B4525DD641A21A83B397930D818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293956, "uuid": "a2612f50-7b45-41cc-bb5e-cf3c16834279", "value": "768:zlDScD5GY2ne8i2Sxt9yYExR15It45PTemle5Re5brvuX5XiANe1j9WE:zlDSC5G9eb249FKw4Zfl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771293956, "uuid": "1c5e5594-1b5c-49ae-95bc-9dbf40622a44", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771293956, "uuid": "ebda8111-841e-4a75-88aa-6eb5f17e5fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293956, "uuid": "b43b2533-c78c-4e26-8c9c-f44bbaa4bb56", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a8de95-0c31-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771354259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354259, "uuid": "c47e260e-bfc2-4adb-b3a1-64dc49cc78d1", "comment": "Malware payload (Mirai)", "value": "fa3b06a247fac0715f2db0d21c0b0e85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354259, "uuid": "bff72eba-935f-48d8-937b-e0f5a548dc68", "comment": "Malware payload (Mirai)", "value": "175799bfd93b0d211bf0be2626b489e64ebff5bdccb68560e7af9c49fe040e78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354259, "uuid": "29fc679e-48d3-456a-991d-4387af0ab5a4", "comment": "Malware payload (Mirai)", "value": "506c28344c5d0f6fdfb548dd6e7a9ade9b81a74a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354259, "uuid": "c6c230b7-20be-42c2-a2b6-3b984765bfe1", "comment": "Malware payload (Mirai)", "value": "d0d9a375cd47e36934a7dbcac23d116a17d6ec38700adb329d819359ae530fa36b481b4dc55f2c31c919b25785118f01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354259, "uuid": "ec7efc30-ee65-443a-a7d6-d67a5f5f115f", "value": "T11FD2E02DA58AF5A5C9F01032E558C4CB7A513F7980AC7C2DB375037836DB44968BC5AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354259, "uuid": "dbeb9abb-7083-4a80-996e-b211a8a623ec", "value": "768:VrZnHpkXjvYIjy4XPSXTXgu2LA99oe7RSbA9q3UELEo:Vlaw2WQuQA99BNStLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771354259, "uuid": "6acc0e29-0527-4a3d-9cd2-7aad18e0d30e", "value": 29892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771354259, "uuid": "e8e49a87-31d0-4070-91d9-e8e167fb70fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354259, "uuid": "1d281185-a013-4012-a562-282a51c56712", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb7313c-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343981, "uuid": "919629dd-10d7-42f4-a3f4-4138b97ddb73", "comment": "Malware payload (Grandoreiro)", "value": "486d4453486561da98e77f58999efc88", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343981, "uuid": "1096367b-71f9-4115-a485-33d31b3e2d99", "comment": "Malware payload (Grandoreiro)", "value": "176ee7f1b966cd0d067eb497f08d0c5baa065ebcaa96e290e38f4992f7460ac4", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343981, "uuid": "c8c2738a-18d2-4325-bf3c-fcc1231f208f", "comment": "Malware payload (Grandoreiro)", "value": "fb6058eb8e64248053d984626b893514f0955486", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343981, "uuid": "05290ff3-f927-4de9-aa5f-c4c5d72b441f", "comment": "Malware payload (Grandoreiro)", "value": "529e4990f5d571cb943f7b91ef303661d1628db0160f5f22bf7d08f923fcfdaf8d41ff82c2cde84a2743cc28dc9d09fe", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343981, "uuid": "a23165dd-76ae-402f-97f7-8fe230279d20", "value": "T1797633319A84182BC6A443BAB13F3E261E7D7B17558C51D27DDC82873B87EC1E62F0A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343981, "uuid": "51f0ced0-6356-45d8-a2c7-8275b627efe1", "value": "49152:UvEvVogaJ1X9dtzJpy+hYOcsyG9645/9M89D4UqXAFes5LLokSwwFFIk7TtNJgFR:Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343981, "uuid": "43c5545c-fd38-4294-92ca-a72fecb8a7a0", "value": 7313408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343981, "uuid": "7d01663a-bc44-46da-81bc-af76598667eb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343981, "uuid": "d489ac10-392f-46af-9ac2-7bf58d714b04", "value": "PedS0C9U75154_PVFNUN7722rcfr.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614ad109-0c33-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355024, "uuid": "be2762a9-08df-4cf5-9e1d-c47851cf9bff", "comment": "Malware payload (Mirai)", "value": "231967211ef06cefc3f253aeeb4896bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355024, "uuid": "30403f9a-a79d-419f-b359-65c547af44ed", "comment": "Malware payload (Mirai)", "value": "17816a9d39ce0bafc3daf58c7f7cfc87b334836e99ebf91b9f34fde0f5a6906e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355024, "uuid": "bc8f5408-4846-4402-97c3-37165b914f8e", "comment": "Malware payload (Mirai)", "value": "ebdbbd45dd2149e4562168c7bf681fc3ef9b0e52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355024, "uuid": "1344906d-59b3-4647-81e6-c16f135a74ec", "comment": "Malware payload (Mirai)", "value": "c39b0cc875e57c7ea62712cbb1ef93c0ca62fc7bf19bb377e492d9895ddde69881296b196e4e58a0d12bcd40fb4a4b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355024, "uuid": "408ead0a-8e5b-4c21-8d44-8b8722985686", "value": "T1BAC31A45F8504B23C6D252BBFB5E42CD3B2A17E8D3EE720399216F21378695B0D37A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355024, "uuid": "9d0aab0d-e06c-4de5-b082-1b63fe64caa7", "value": "1536:oKTFPaOqB4Unn1TtcbC8b0AOP6T4VwThy7ZceQRYdVFP/o64ljMwywcRZi8nKfv3:oKTS1TmG8b0By4Sg6eQR+XPwct6yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355024, "uuid": "6239d525-57d5-4e46-866f-4f76b9b835f0", "value": 128396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355024, "uuid": "389b5db5-c555-4989-aee4-7c5bb0ad1bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355024, "uuid": "4ec34c02-a194-4793-951c-dfa386c4866b", "value": "odin.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed01e827-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348386, "uuid": "c715ab80-81bf-4e32-80d8-fb83cf82ba00", "comment": "Malware payload (Mirai)", "value": "4c29711b1a76e8980e9dce33ffdc652d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348386, "uuid": "4976229f-f837-480e-927a-fbf1185fbf8a", "comment": "Malware payload (Mirai)", "value": "178523497408fa176e1ddcbe51cf8a44f6303ea147bbbdcafb4f0c88dad3b97c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348386, "uuid": "119c29f6-6462-4d80-935f-1cf761feacd6", "comment": "Malware payload (Mirai)", "value": "ec52838bc8d60c819b205fd284b703851fd63ace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348386, "uuid": "a9b8b808-414b-4a45-9bd5-1c634dcb6a0c", "comment": "Malware payload (Mirai)", "value": "cc9c66f006b9de2557dea28fef7fd8fe2b0f122b414abd12d08eadf7b3a1f369e3617402ea4fdd33ec53e6b4d066ffcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348386, "uuid": "e134a313-1267-4fcb-86f2-0560a3b798f6", "value": "T187F47C46EF850FEBC4AFCD30452E834705ED999706C1A63861FC4D8CBA9D6A94FD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348386, "uuid": "55c197fa-498d-45d4-acb9-1aaf9b659ea9", "value": "12288:A1b1gSF8F0DZp5D7M0Gkvz/eV+44KAjrJQMbj4YmlqCb5XjHUW5MNjVRnxJLKQFM:3vW4RTuhj0D5sfk3o6PdPIDX+gKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348386, "uuid": "596f7535-57c0-4df0-be91-213a7fe4c136", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348386, "uuid": "00ba22b9-cc77-49fc-9dd9-f506a09f764a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348386, "uuid": "63321590-5b9f-44a4-b7d1-10631ece62e6", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831eafc9-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286790, "uuid": "fc612cd4-dc3b-4983-9f7e-9b051bef0abc", "comment": "Malware payload (Mirai)", "value": "144e366da74683360054c68718f7bfc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286790, "uuid": "b7bde037-f062-42a0-b025-13188bf9a92a", "comment": "Malware payload (Mirai)", "value": "17cb55ed8de9146032299bfe90c81e26b2a21239ecd62e9f0e303def4b71614d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286790, "uuid": "f790fe9b-977f-4602-8785-12beb51dd83f", "comment": "Malware payload (Mirai)", "value": "713347c1da2ea47d214b9342a394cfd6c1fac02d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286790, "uuid": "43af1b6e-39e9-4a88-96df-2a901cd88a29", "comment": "Malware payload (Mirai)", "value": "8b557ccc7401991a6daa780efacae217e1d32cd1d096db22d19f4ac5c968fdef39bd056ab491b7138538a25187810e07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286790, "uuid": "28cba065-da85-4882-9014-45d76004675d", "value": "T178633BDAF801DD7DF81BD77A4857090ABA30B3D502831B376397B9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286790, "uuid": "8c664e0a-88ff-4802-bbe4-e03549122ed4", "value": "1536:3IgNIzNo6+0jDYfRW8VB3a1oxf6P9dJzGLotJ+ChQwu:3IAIzGqEfRHa1yfy9/zYChxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286790, "uuid": "a8a4e2bb-1638-4552-9d3a-409e0892eecd", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286790, "uuid": "ab37a1b4-ab50-407c-8f64-563365665126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286790, "uuid": "edf9f533-ec92-4e91-a6a2-04170b33c3ff", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3817680e-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1771311575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311575, "uuid": "6dab4a62-6035-4098-ac84-0b07534b3ad9", "comment": "Malware payload (DonutLoader)", "value": "72887ddcc9bc29b8296072d6134f20a8", "object_relation": "md5", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311575, "uuid": "ec0d889c-0ee8-45b6-8d50-902dd15b1095", "comment": "Malware payload (DonutLoader)", "value": "17dabc99eeece44134c31afcbba6d93fedee62f019cf5eadb2b9438b1e491e70", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311575, "uuid": "3664fb83-6775-4146-be41-ae5a1d78b375", "comment": "Malware payload (DonutLoader)", "value": "95d13e2e5719e9730f81da87a28d06fdc59d19cc", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311575, "uuid": "80558e35-2d3f-4928-9ea6-eac421d229bb", "comment": "Malware payload (DonutLoader)", "value": "0777553110a16cc99e8daf3c51f6294186f9c0d491503bc5755caafb15233bdf61f277ff03fd510d90ebd2b0fc5cb6bd", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311575, "uuid": "41570bdd-c240-4b09-a62b-225e595b5015", "value": "T1C4017825B2AC1E0308F63925F6097742D98116333302782171A1D6C63FBCDA7DD1B492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311575, "uuid": "964a0df3-0a99-44d2-83b3-3ff60b6d18ab", "value": "12:OyfBhPhbHEzh0JkLJX8WFiyTnISV7YsWN7Wo0UqymwCGE8WlAvEiR:75fTEuwR8WFiGIDHWoaF8WSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311575, "uuid": "8de6e5a0-0b3f-4041-8e25-670bc76758a2", "value": 672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311575, "uuid": "597aef78-306f-49ff-915b-cab1716f72cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311575, "uuid": "7cfd72c0-ad34-485b-950e-9b054e0a7888", "value": "17dabc99eeece44134c31afcbba6d93fedee62f019cf5eadb2b9438b1e491e70 (2).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900895e3-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342217, "uuid": "3350ef2d-0417-46ee-9a21-7ac083dd3de5", "comment": "Malware payload (Grandoreiro)", "value": "fa9352936b82061f37c7e3149855a230", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342217, "uuid": "7d10215b-ce5a-4630-a402-b1a840e492e2", "comment": "Malware payload (Grandoreiro)", "value": "180637d3b8f1c3aaba86f105f6ed7ad9522aef1613576de0b97b76ed446fe2cd", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342217, "uuid": "05a34dd6-b3eb-4b93-a47c-5424784c216d", "comment": "Malware payload (Grandoreiro)", "value": "07355d4e1615eda131193182416acf5cb9496652", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342217, "uuid": "02e90693-d552-4a51-bbf0-73b4915b0f97", "comment": "Malware payload (Grandoreiro)", "value": "fd4ac831bc6eb1bb619e4e61cc3d542a85e51b1d4f6e11db5614010a2dadc67863555e73e9b35565da5787306a619107", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342217, "uuid": "54c74b6c-9acb-4fb3-bf6a-de58d163161d", "value": "T171662330FA965C66C96143B1755F3E241F7C67078988E9E7B9AC81823746FC18B3F0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342217, "uuid": "7fba656b-0c70-46bd-83a5-473a414f24cb", "value": "49152:rflR5w8eNyJqYI9/Gq0HH7Ggw7XAlK72TZGwhBn4D4VWMb8n8QHWC8Utf/noxEHo:ruim3Y20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342217, "uuid": "01dec348-a8db-4c82-af27-a4bb673e319c", "value": 6967296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342217, "uuid": "6450676f-0050-45e6-98a0-8ddf1d4dbbfe", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342217, "uuid": "7da56734-09f2-4525-ae0d-b5fa2e69a01a", "value": "712251Ptr-VTJFVFT7ZZ05053RDIH.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bcf593-0b9c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290264, "uuid": "da3e97f8-8752-4f7d-b6a0-f5b76ecc12e3", "comment": "Malware payload (Mirai)", "value": "4c2728c604d907498ecc2bec8b0bcaea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290264, "uuid": "699a42a9-58bb-48d4-aa80-26ce99c8beac", "comment": "Malware payload (Mirai)", "value": "186dc7b3afa4f487c4fd7bbab1159eb7257f2e47ff9331399bff063b0948be99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290264, "uuid": "26b12b53-8aad-4317-a45b-9fa5f4d65827", "comment": "Malware payload (Mirai)", "value": "5290e44ba8b70c68e4f221c9eace399ea19ec133", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290264, "uuid": "bda39c30-c45d-435a-a458-c60930864e0c", "comment": "Malware payload (Mirai)", "value": "11aa7dcf53f86881493e92810e199e9faa8721d825ecbe72fb5a110ea99d94629b4c9b8eeb9d3cc997f7c03ec99034ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290264, "uuid": "dba95c3d-da57-451c-8859-540e802f9605", "value": "T1DBB32B16B992DB11D5C221BAFA9E514933136FBCE3ED3202DD206FA427474EB0E7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290264, "uuid": "fb8faff6-3f11-4844-8c6f-8258a386685b", "value": "3072:XbsvZqDiwzipof7t60vaKsxujFbU7O1GPH:ovZquppofx6GaVuBU7dPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290264, "uuid": "8cd38d15-69db-42e5-a63c-596c590d2a32", "value": 111332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290264, "uuid": "fc097295-8ff5-4a68-bdaa-28949b0f97e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290264, "uuid": "fdf4e741-4484-4d01-b250-d00412e85b6b", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecfb778-0b9c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290407, "uuid": "7552c971-0b73-4304-8cfd-1c021c386f38", "comment": "Malware payload (Mirai)", "value": "c5a7fa663840c66cdb3e377c10951d77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290407, "uuid": "eccac815-e28f-41ed-9457-e0cb6b89a27b", "comment": "Malware payload (Mirai)", "value": "192313bf471bc775fb86d932b5cb7a5dd76db692f7654333ee44828129591032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290407, "uuid": "e4fb47db-f0b7-4d98-a2ba-9c8a2f32d336", "comment": "Malware payload (Mirai)", "value": "30b6f308f8ef6e895709dc8d78f494db2529c1fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290407, "uuid": "5a46f72f-08e6-47ee-b035-05a54a76b388", "comment": "Malware payload (Mirai)", "value": "0ac53e5348805958a371c5aec5ac6e6e442577ac72c2143c3fc8a0ee3919611559acbd8c6768d26b67e9c5c0b0cf5e34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290407, "uuid": "9f04d7f7-8b9c-4f85-87ba-1e40488c9efe", "value": "T10E84D08AF7562D83C5EBC5340886C645575AE19723F3834A3A476A7B3C193B78F2C389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290407, "uuid": "555f03ea-b532-44a0-afb7-0e7bfa9f0876", "value": "6144:G5e9gio4ixnOlO152n000uv03PWw/kjXpG1WmDgpjmnN:yeujtZOlUYI/OXpG1bgpjmnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290407, "uuid": "c8a1b67a-b1fc-45f5-95a3-127813b6a3f6", "value": 377940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290407, "uuid": "69f569c6-c61a-49f5-b75d-c9b2bc6ba993", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290407, "uuid": "e5ffb542-55f1-4675-a09f-882550a31777", "value": "mirai.gnueabihf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf686e5-0be2-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320442, "uuid": "578fc1c3-d23b-4373-81bf-7a56955f2f5a", "comment": "Malware payload (AgentTesla)", "value": "3ae89be14b068d09e5fa3e1ceb5d9c81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320442, "uuid": "64c5b8b5-a1cb-44a3-9b04-326e1e63d99b", "comment": "Malware payload (AgentTesla)", "value": "1a79069b1c79b035ce0cd0add0f5d897b207dc88f1b86fc7839dac47f38101aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320442, "uuid": "fbae1a17-509a-45a8-9fd0-8bfd52c84745", "comment": "Malware payload (AgentTesla)", "value": "48aebbc40160140f5c8710844a6569ec5905d6f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320442, "uuid": "be1ea78c-ee34-479a-9067-ab5a8de6d02f", "comment": "Malware payload (AgentTesla)", "value": "6f8535bf9b4547b1401568d804f6acd4972feb0d92a0e726436d1e0951326e7cfc0d823e00c27b709bf2e28f28f0f72d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320442, "uuid": "58d077e8-83de-4d8a-83ea-81d458b1f1a9", "value": "T16C94F113AA2FD76BE9305A328B2AC5710F98FC015554588F32847B6E27F8617D22F6CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320442, "uuid": "a5afbd68-97a8-4f07-b4e0-b189dd79de6d", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320442, "uuid": "0c065d43-def8-4ac5-b3b0-4d9d1029db12", "value": "6144:ax/M1wqziQz5VicSfuhSFq/RAmbs4lq7xapvj9KXZUI12B6VsFSl0IRme:eYzhicwuhSFmNbfuYpsXq56VsFSl0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320442, "uuid": "2acf8503-db45-445d-b5ba-a1f189aa9aa1", "value": 441400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320442, "uuid": "2eb7b9a8-948e-46b1-ac65-97140f5851cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320442, "uuid": "3cd56837-a982-4816-a654-8a09263fbe47", "value": "1a79069b1c79b035ce0cd0add0f5d897b207dc88f1b86fc7839dac47f38101aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc36dccb-0bf5-11f1-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1771328574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771328574, "uuid": "b3391c4a-cab2-43e7-9286-2240f1261dda", "comment": "Malware payload (Meterpreter)", "value": "eb0901c83ff26909348c6223b9c39352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771328574, "uuid": "e59b4a22-5a85-40f8-8883-ad81759d6958", "comment": "Malware payload (Meterpreter)", "value": "1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771328574, "uuid": "cbb73306-a5fa-4507-944a-db4ebe02a44c", "comment": "Malware payload (Meterpreter)", "value": "51821d410fbb24cfb73c34c605a9497574dde166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771328574, "uuid": "42b6a5eb-54e5-44e2-a5c8-ae11cd6de3f0", "comment": "Malware payload (Meterpreter)", "value": "68a46beffec5b3b48ed028b7a7974bcdc6423ac538459415b80e58aa5ec5a5d7f19f7c174fbea7211778259c269e0aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771328574, "uuid": "5dd4323b-d7c9-4eed-abdf-0e7d11b4a36c", "value": "T17673BF46C9C01966D1A3123D5B753AB6AA34F5FA3601C19F3A8CCDE5DBD1CB0A3663C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771328574, "uuid": "4e42445d-3347-480c-8b0f-2c9742d2be81", "value": "fb6bd8ebf4e6421b53c55dfe7d3c43af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771328574, "uuid": "39416205-19fe-425b-881a-9160a3aa042f", "value": "1536:IfjhGeNH0UaAaDFwJA4+s+oQfYq5RxMb+KR0Nc8QsJq39:RsH0ZAaB8ApsyYgRxe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771328574, "uuid": "41951cfa-162f-4664-998b-26ccef32380f", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771328574, "uuid": "ec1cfe54-cc7f-458b-a979-df986a13e235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771328574, "uuid": "9343c78d-460c-40eb-8679-050728b18e90", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a06115-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1771311596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311596, "uuid": "e535315d-5fc0-4450-849c-fe817fbbb52f", "comment": "Malware payload (DarkCloud)", "value": "d84c2f7114062a0ad39c29d282321d86", "object_relation": "md5", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311596, "uuid": "2d6942ee-01e6-4dfc-ab5d-ea9980db04ef", "comment": "Malware payload (DarkCloud)", "value": "1acab5ece6d9068a9e1d5dd982480d781d745d9dff9f8a9008f4b546dbdb990d", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311596, "uuid": "1547e443-9524-4f92-bb8f-9aca65414fde", "comment": "Malware payload (DarkCloud)", "value": "4d9500022f22447d5b43c53c362fa92df15bfb42", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311596, "uuid": "3973a335-d683-4ff0-b089-2a3f0d543843", "comment": "Malware payload (DarkCloud)", "value": "200f64ab55136e7b11f94ff6a1b7675d88539d9f8ebf15f101a7e889902835df0cb45872db68cbd37b16ff11be33db0f", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311596, "uuid": "074f88b0-9ded-40ba-af26-8313528f7ffc", "value": "T141D502FB54B269535A504627EB0F2C1A339B19D53B24D342EA41919C7F3B1938EE2B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311596, "uuid": "cfdbb753-60fc-4d37-b2e0-c63b0902085a", "value": "49152:7Oc2yD4lTP0IjUi9dSd/toV1FKYsZ58NMeknov7SH7AVrgycgFhAnZGuK:7oyEFP0IZ9whtoZK7Z58NMeknov7+7A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311596, "uuid": "672e8447-3642-4468-a368-c8f33293f8c3", "value": 2986971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311596, "uuid": "33a4dc4b-3254-4946-adcb-55c782432405", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311596, "uuid": "d88d6cce-5eae-4b9b-81a5-b242b35f8577", "value": "1acab5ece6d9068a9e1d5dd982480d781d745d9dff9f8a9008f4b546dbdb990d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6263b29-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353851, "uuid": "f5e3ecda-bad9-4f29-991b-9f2e313b6e0d", "comment": "Malware payload", "value": "3f14fcfaae001cac1e23af4071ce00bc", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353851, "uuid": "d203081f-2abf-4cc1-bb10-4dfafd32325d", "comment": "Malware payload", "value": "1acabc68ed940c1de77bf1737c422cc18c1aa5c055ff2d2fb68bdee893ceed50", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353851, "uuid": "3e8f57b3-ddd7-43d4-97f4-952db7e4e418", "comment": "Malware payload", "value": "5c2546f219cb8e55f4014c6dd06dafe92ef5d2ee", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353851, "uuid": "48845386-264c-4b62-9c1b-30ebac46f519", "comment": "Malware payload", "value": "efd4a983c600351894891bfe98627792bef1c3c98f6bf72a1693fff9ce16053d1de683479bf6ddce42237834382dc811", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353851, "uuid": "a7194653-6193-4356-8d92-a356242907ab", "value": "T150162333BA414C76C18247B0B81A7E336F3EB703098D75EBF19C9D467B46AC1996D09A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353851, "uuid": "fb4bda29-01cb-410c-8ad8-1a7b5316c3cd", "value": "49152:9NTT93mIFLe52Le5lxKcPo4txRlicoHSE7wE7Zduim3YGu2/7BNJL:3uim3YGzBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353851, "uuid": "f79ebb28-9f2a-4959-bd14-24a415fb84bb", "value": 4380672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353851, "uuid": "daad5f0b-8edc-4726-8598-04620e477d8a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353851, "uuid": "90dbfcbb-7c1e-445b-9cc7-164c4f848597", "value": "RptR4F19-DURD8932_AnZG8OU.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bafe84-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348402, "uuid": "eb78db6f-26aa-48fd-a5a5-373ec5c15d78", "comment": "Malware payload (Mirai)", "value": "c0913d25e0572196ac59cf31885143ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348402, "uuid": "954c365d-0823-4fce-a92b-85e6c61be377", "comment": "Malware payload (Mirai)", "value": "1accbbb3ae1c73bf4d671715c43d13b0a7281af03e00243675456bba6029aafb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348402, "uuid": "2e03b3a5-5469-4e78-aa6f-013f99a46806", "comment": "Malware payload (Mirai)", "value": "25e4a9a70d2be3ce4317177ee04fa5c840bc3845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348402, "uuid": "31e0ffe6-b41e-4a3a-b31e-f94af0a6c3bb", "comment": "Malware payload (Mirai)", "value": "bb1108033576020f2782d63d0ff3c7dd45247cc4542a30f643bac87e3108df6b76f4a4cce15ef17c31a0c4a557e0331e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348402, "uuid": "43827f1d-5a3f-46af-ae07-da8b126fa243", "value": "T172357F52FF082527DE090AF066FB2774F752246381F4D1323B042FAB586267998E7DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348402, "uuid": "bd941c6e-a17a-4713-852c-8275b0e96097", "value": "24576:OSTMu0ymJkK22BBP/5+TELntZX5J38ZawsFCzsgpu6:OSTMu0ymJkK2wBP/5+TELntZpJ38ZTRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348402, "uuid": "f8985d9b-311a-4927-9f40-d353c4f06239", "value": 1122936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348402, "uuid": "a6b4b21e-3ff3-47d9-b110-e99299a46fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348402, "uuid": "35a12f40-3840-4b93-9d0b-ee6b9d9f9adf", "value": "powerpc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57b3d47-0bc9-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309719, "uuid": "799430f0-5284-4324-b1ac-4690e4c3513f", "comment": "Malware payload (Mirai)", "value": "04294ef934e5e0139d81dd3321dda360", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309719, "uuid": "a00bcf31-c109-41ee-96e3-0bc6df2facc8", "comment": "Malware payload (Mirai)", "value": "1aef13d73030381aa47352985a403bb649d93020e2822fa5b7a3230a8f03c9cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309719, "uuid": "4809e086-de0e-4b90-b031-b848e2d5ddde", "comment": "Malware payload (Mirai)", "value": "3e4d1e757e2449bb531687f74f8096dd5be3be5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309719, "uuid": "3691463c-c52c-441b-96a8-fffe259667d3", "comment": "Malware payload (Mirai)", "value": "44274857278e7523bfe433e9400533bbf16f56a99d97ff26923e11f69df3d181b7d02c55f77b1b1b8dccc9963ef6aa9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309719, "uuid": "5e1a478e-62a0-45c6-9f7b-8d6bcaecf848", "value": "T1E4B31A46B9919F12C4D621BAFF9F418933136FB8E3EA3102C9206F94378699B0F77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309719, "uuid": "ca4cc61a-9dc6-48e3-a15a-ec7a4dea4077", "value": "3072:/PXeO7g9DkyMIOBaU16OMdpuzhbxB1jgInzsla:3eONyMZBaU16OMdpMhdrsla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309719, "uuid": "6a8f059e-6aad-4bf4-9df6-04bbdb44f03b", "value": 109344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309719, "uuid": "0fe41053-5019-42f6-8311-065735a8f6db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309719, "uuid": "9837bb09-305a-43d1-bc4f-5acec41c03b4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d84f70-0be3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320693, "uuid": "da35b5a7-37c7-40a6-bf1e-39ae5dfe6016", "comment": "Malware payload (AgentTesla)", "value": "10747e9acaab3ec93abbe491d57113c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320693, "uuid": "8214e5e9-178d-40e1-8344-ea4d04e1abe1", "comment": "Malware payload (AgentTesla)", "value": "1af6a77d09b2699405b5fa043402b802a173f32800d058cb0b56ff0530d26322", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320693, "uuid": "f00d570a-babd-43ec-a436-1be78a8f66a1", "comment": "Malware payload (AgentTesla)", "value": "b5eef5ded7e490a425c2ce6ff5313952b646259d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320693, "uuid": "4b3c02ca-9e53-44b0-ba0d-45c5c9aca8e8", "comment": "Malware payload (AgentTesla)", "value": "ce180d08c20d90ad0741dc449d134894bf841f6605280f53c9bfb913e162e64b7d3893126f90a80b3d294c2f5c8be2e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320693, "uuid": "a071af8c-def0-4423-997f-7280a1c8b6b5", "value": "T1593400027F88EB15E1A97E3782EF2C2453B2B4C71633C60BAF49AF5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320693, "uuid": "cecc04be-6aed-4160-8bd2-134c5615248b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320693, "uuid": "2494290f-7e35-4e29-b4e1-da70c90ca3c2", "value": "3072:kCxZ6iyqa9PRn6sO+4YUTHo9rG8KaG5jnTh/qcufzz:f6iyqahhX+sq8KaWT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320693, "uuid": "05a87b85-4d33-4040-92a3-c97cbe130961", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320693, "uuid": "235a7f38-0a73-4f68-9576-d62f93c93620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320693, "uuid": "50625291-7150-4cf5-b932-49bbb100c80a", "value": "1af6a77d09b2699405b5fa043402b802a173f32800d058cb0b56ff0530d26322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097e6985-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352299, "uuid": "f0cc5404-9191-4be3-a85f-07fd9fb1ec34", "comment": "Malware payload (Mirai)", "value": "b0ddde001a2d15bbbc52d45e8c9fd58c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352299, "uuid": "dd4e6a90-4b2d-48b0-9eba-9e2c0f327b1e", "comment": "Malware payload (Mirai)", "value": "1c4321c896148e2b30e59232621f9d26670bb0410f38ae861ef463b88fb9a786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352299, "uuid": "5e1c640a-6b5e-4967-9d4d-6ff06e4efbd7", "comment": "Malware payload (Mirai)", "value": "0f5c2b7edd31c0fedd94fe2d7e51d49a671fe02d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352299, "uuid": "a7cb3c5c-03d1-465c-9f80-186f40bf116d", "comment": "Malware payload (Mirai)", "value": "6bae6965dc4abc47803e67b4264065a56e486b7a7ecedbd0848e64699cd0f5a22f48127384be564ff0eda12778fdacad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352299, "uuid": "f4aa34ff-f295-4806-ac93-2742abbe1d0d", "value": "T1C1436CC59563E9FCDC1015393077FF7256B6E93E1028EBC7D7A8AD32A941A02D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352299, "uuid": "45e61993-829d-4abb-a90a-076dac64b856", "value": "768:CoXHT2eWvOW4b3E/yzDLbrCP8kTJwXHU/HYDOgcWt1XfWA+7tOfRc3ky:CojhW4b3uyzDvrCP8ywXyPWTF+7t+Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352299, "uuid": "70ac12fa-9505-4264-8e48-489bf6df651c", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352299, "uuid": "daa567ea-205b-4e9c-97c5-0b5b886c8ca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352299, "uuid": "5eed816e-eb44-4680-832b-6074c48fc75c", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda92e60-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312739, "uuid": "5712769f-7058-461a-8dd1-1bd535b39462", "comment": "Malware payload", "value": "13a2615f2934dd786645bc0adf4ab728", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312739, "uuid": "76f52fc8-d893-4b73-b5db-efb127d66751", "comment": "Malware payload", "value": "1cb006d22084ccc27891587c17c2f92366ba290bd0a314f9d284a9b3b60f3b58", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312739, "uuid": "e6b6da1a-5e30-481c-96ee-36f9d7cf2663", "comment": "Malware payload", "value": "0d3d5e298cd4a3f2282f5b1832fd4384405d579e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312739, "uuid": "2d8f24f3-b741-4f97-be43-aeb0a976fa25", "comment": "Malware payload", "value": "bff0579558df7619e4f080f1748640c8c1d5cfb6bd877847e41726cda168026629c794a5635288c42471558f0f2ce7e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312739, "uuid": "13c8604d-0e37-4492-9acb-027af7302a8d", "value": "T19B35B22442C2C3B222444FBE150459CCC98D6355BD319A6CE876EFA5A1CFEA9CE3CD76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312739, "uuid": "0667fe4e-a690-4ed6-82f7-5e738e26bd79", "value": "384:RrcjMdCjMvojMturxv/6d+BbSJPRU/cbwwcoNUxK5FYpVEEDIRCbQ+YDQP6pELT1:mT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312739, "uuid": "cd4d5322-c685-4092-9758-1406c9aaf5dd", "value": 1135000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312739, "uuid": "1f3ed915-5b0a-4bdf-8080-320c14fe373a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312739, "uuid": "0226f90e-7ce0-4c03-99f9-fa7b61c71532", "value": "izvod pla\u010dila.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1c2f15-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771290569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290569, "uuid": "009fc578-8ad8-43fa-8bd5-3ff8e5e28433", "comment": "Malware payload (SalatStealer)", "value": "a075ee624c607a58b5bf2eba19fbb648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290569, "uuid": "c5254d71-db75-46d3-8f9f-85a4739bab1f", "comment": "Malware payload (SalatStealer)", "value": "1cb9b173c78e33cd27b1aca754eb9e47af42cbbb95d51144aceb42f9ca2b3c9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290569, "uuid": "fb5452a2-4388-47fe-bcd3-7ef1408ad70e", "comment": "Malware payload (SalatStealer)", "value": "d5fd221bc5b65b1cf64d1cbd4b5a7c2c38a4006a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290569, "uuid": "5fb4c7d2-fdc8-49fb-a966-4c1807cf6857", "comment": "Malware payload (SalatStealer)", "value": "b8c182314d64e7fa3e43b71b3f9588c18490213832dbb286f9b043a480880ed58445ecd7d4b232a1f5ca1eb163dfc663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290569, "uuid": "a59d1842-17f4-4bfe-b1ef-50ae17cf828d", "value": "T189C65A11FA8B55F6EA031832416BB23F23315E048B28DBDBEB547F6BF8776811967205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290569, "uuid": "000202a9-397f-4ccc-9468-0bfc9f8e9667", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290569, "uuid": "b5f6a7c5-3d89-4920-a6ef-694a35e6ad7e", "value": "98304:4yRMtjxPPFlG/DED4XuqBQ4rFIlWET8z:mx6WMBxRSNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290569, "uuid": "a5a7c180-a31f-4489-b6d2-0f8a2946549c", "value": 11675648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290569, "uuid": "444f5a59-406e-4058-8420-35cbc6c3b2ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290569, "uuid": "c303abd0-a500-4c61-ae53-d4cb1bcfc245", "value": "b1ah35t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba53cb61-0c07-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771336275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336275, "uuid": "b13bad36-1477-47b4-9737-04cd85088eff", "comment": "Malware payload", "value": "0b970be288f662391b3b5622ae674b95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336275, "uuid": "88ccec79-d3a7-4426-876d-738781242903", "comment": "Malware payload", "value": "1cddf9e2bfe2f9ad5fbd15ab9ae37182c371b22325ce41318f97d6b8d4acf6f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336275, "uuid": "191a407f-7e22-4247-9592-f855ab7a756e", "comment": "Malware payload", "value": "66b94f59d835a4c7279e828ecbdd0d2ab1b46a83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336275, "uuid": "38b43a2b-8c38-45db-b79b-180721f9722c", "comment": "Malware payload", "value": "f2b3fe46ca51b5c0f6bb00625dbcae7a9bad45724e0398688c5d40831d9112deb7c04cc76223f2c2ebc2ded0c2dbfbbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336275, "uuid": "2e75a146-9a36-459c-8b6a-3cd8c19903a8", "value": "T1F5A46B5BA2B3B0FCC153D03443EB9AA3B931743951217EBF85C8DA712E56E60231DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336275, "uuid": "68e96241-10f6-4479-889d-35009f2ba37d", "value": "12288:bKrOdqh+V94s50D/lkaNRengkwvBduv9foatqH2:wOQK4sakaNYMpduFfoatb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771336275, "uuid": "e54b3d2b-3038-40b2-beaf-82da1e6d0efe", "value": 484846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771336275, "uuid": "6f25eb09-993a-465e-be52-473fc734a8a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336275, "uuid": "195130b3-6a96-4a13-bdee-fed2e0e5f66d", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08799218-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352298, "uuid": "5a184173-c9e0-4aaa-b4c9-da9533921086", "comment": "Malware payload (Mirai)", "value": "88232a980d6ba64887c3cbca096754b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352298, "uuid": "8842c7ad-4449-42d4-b752-65a98bd50800", "comment": "Malware payload (Mirai)", "value": "1d084d84e9b66044c1c2ed358e2196635b21c7a847b72451ab6f39728b6fc6d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352298, "uuid": "eedbfa31-3b88-4038-b14c-336f381c9fdb", "comment": "Malware payload (Mirai)", "value": "85438cb729c44d69f7d444843d3c2cb388ba6229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352298, "uuid": "456268a1-f074-4ae5-8126-fb1b5c546da2", "comment": "Malware payload (Mirai)", "value": "0887832a9fb962ed4456ec7128a647da00007f7c0c26e79965bee13c6b77c72ba1079004bcc8524b844d778dda1bea8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352298, "uuid": "30d7524c-acd0-4de4-9a08-b96c3c02ddef", "value": "T1E6331895BCD29A6AC6D463B6FA2E519E3321A3E8D1DB3213CC104B1437CA51F0DB7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352298, "uuid": "d91a16ba-263d-464d-9d72-829412861ac2", "value": "1536:oNA/C3y0ARjBgC+O2Ewcnc7+rL2yBClt5g29:GA/Ci0A55Q4vEbg29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352298, "uuid": "9d3fd187-e2e8-4f65-b80e-6d3e04ddd9f1", "value": 53364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352298, "uuid": "1b3fea3d-2128-4a0c-af80-979d0ce69a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352298, "uuid": "7a96ffad-163e-4e47-a863-32202bd0ed14", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ae8d98-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771344005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344005, "uuid": "84896d85-c68d-4b86-aa99-6edce76bafed", "comment": "Malware payload (Grandoreiro)", "value": "8e3fe730e2c80e52f4eaa890a4659d1d", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344005, "uuid": "6b75bb2d-fced-495f-bccb-9752dec0b706", "comment": "Malware payload (Grandoreiro)", "value": "1d82ec6653858b271b37df17ed4b722b37f6a532b489ab311edb7adb59f6b348", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344005, "uuid": "3d6c6a43-6fd5-4bdb-88fb-52945c4b3b23", "comment": "Malware payload (Grandoreiro)", "value": "b305d25f94cfa6c21c7083a9b57c333e4dca1806", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344005, "uuid": "9106bd9d-6e8c-42a4-b823-ad6057dfb316", "comment": "Malware payload (Grandoreiro)", "value": "7a6851b1092732297f52393ffe6db254334179a9e751c92961772a84308e735f221c7ccb59d1ff063e1267f66c011c00", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344005, "uuid": "72eae082-dda9-4fda-9193-290695526928", "value": "T1AE462333EE510D17C8A04775B47F2E261F3E665703CCA5EB28AC82873706AD6953E4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344005, "uuid": "866c26a4-6bd2-4e75-98e4-12655774ae07", "value": "49152:jzKX/kN4sJvMSNS18vaHP/mMTNmfO4li63wRdYK7UXUr6bXpTpe3M:Pec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771344005, "uuid": "c9224b42-9d4e-4a5e-aed2-b8fa9430974d", "value": 5525504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771344005, "uuid": "4d915af1-ca80-477f-a075-b8207a8a115c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344005, "uuid": "3e6407e4-f42e-4d48-85b5-c5734c0cea75", "value": "PQKJF3719X5668_Hst.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53951a5b-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341686, "uuid": "2e4f9e09-5945-4f6a-af65-512242af2a74", "comment": "Malware payload (Grandoreiro)", "value": "9533993427c6dfe5146c1f01b2b9b093", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341686, "uuid": "b70c939e-13dc-43fa-99ac-644b306098d2", "comment": "Malware payload (Grandoreiro)", "value": "1d8b313c3dfed1f5e3c7759bf122543c41a03291eba436335cef7eaaa015f512", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341686, "uuid": "10d9c019-329e-4ea0-95c1-b41f3dface02", "comment": "Malware payload (Grandoreiro)", "value": "56fdf5d9ad5258c6b23bd42e9def3eaf89938daf", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341686, "uuid": "91cba2f4-32f2-459a-90b1-424a5bc06675", "comment": "Malware payload (Grandoreiro)", "value": "de1614ca5ff3616494bb3a495f1598507e10ad3fac5c2cc6833a33b0d774778c015dd72213c9427b54c99fcf2bf49a90", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341686, "uuid": "bbef17bd-e061-4acc-ace6-6c93986b4c9e", "value": "T1B05623329E19199BCA94C370B43F2F262F3D76534789A0D7389CD586331AED2893F466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341686, "uuid": "3c3b3612-79ec-44ac-88b2-8dc14fdf95bb", "value": "49152:luVU4S0D0jdSu8kKAplNU/VTkJbDJ4ZhNr202vl0OLBRwyqQ9/5il3/937OJdq/e:63Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341686, "uuid": "6b9b8985-9c06-47c5-9cd4-8b046e75449c", "value": 6105088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341686, "uuid": "6b6f6b30-c5d2-4b24-aa81-65476c2ed2e0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341686, "uuid": "8f82bb60-9718-4572-a242-a621bc45f8c4", "value": "0Mrc-Antl22926NVIM401O.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34cf55d-0bfa-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771330733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330733, "uuid": "fdd0de04-9eaf-4cbf-af3c-b5c04d2d4473", "comment": "Malware payload", "value": "219f79a61cfb5a603276fae3f1577735", "object_relation": "md5", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Web", "colour": "#099E68", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330733, "uuid": "aec1c028-ed88-44bb-b049-951d8f76245f", "comment": "Malware payload", "value": "1d95e2a07ce5f992d73596c3230e9dc1e0d4d52c466571f4ef79f4eecfee2f13", "object_relation": "sha256", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Web", "colour": "#099E68", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330733, "uuid": "58427816-1cb6-42cc-ae8e-7e3c4246be14", "comment": "Malware payload", "value": "8661a26ea237e5af8309fb0f13c464949d6b1f45", "object_relation": "sha1", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Web", "colour": "#099E68", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330733, "uuid": "2441daf1-7a6d-4819-9def-376816d02f6c", "comment": "Malware payload", "value": "286d14f167cfa38994ea9ac4c315f88b78e7c538f42cfb71670166041209fbe0000369375d4af3339bc8bfc0b7a1f602", "object_relation": "sha3-384", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Web", "colour": "#099E68", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330733, "uuid": "3ccb1bc8-4cb2-4bb7-9105-15f1550bde99", "value": "T1A1E4B687F1208AC7F84FDABE145042106EF0E4704607F2562B6E895B2FEB9C89F557E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330733, "uuid": "33538940-279c-4a4d-a889-554875970e6d", "value": "6144:t1eMX5Uh/W94gpr2TUPjhMosbgKZOeMJd3ecgqCPMbBu140UN2S2D/11p3x1ZFUu:t99wqvotx/13/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771330733, "uuid": "c294e81c-0e03-4821-8174-9b548d6cfbdc", "value": 688783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771330733, "uuid": "1343367d-f06f-4288-ad0d-cd41f1fd47a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330733, "uuid": "ba5fadeb-3599-423c-8e2b-aa2a1576e848", "value": "Dupe mod v2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a5ee39-0c0d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771338582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338582, "uuid": "4b52b70f-8add-4869-9a23-dcde9f653769", "comment": "Malware payload (Mirai)", "value": "b5cd4ae80f00524a5ad700100d7584ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338582, "uuid": "f5f4c072-7356-49da-945d-f3bae9204154", "comment": "Malware payload (Mirai)", "value": "1da582d66fe33592ea622f571fd3ce3c68d1a2df41c6185a117a49959a14b6c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338582, "uuid": "5a399a2d-3b1b-44af-b16b-c53b5199b679", "comment": "Malware payload (Mirai)", "value": "ac6be7ff0b66df104285588a4c65bd200a201a75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338582, "uuid": "3054c706-cf3d-4687-8e54-9aa114175cdc", "comment": "Malware payload (Mirai)", "value": "d4255f1d37fc1d873c4e62391615c846c1ee4e47326ac496d2f5c50095fab3676b67c7fe4233a8414fe863774a1b4e4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338582, "uuid": "d5a07723-2951-41b5-8b75-dbcbcbd8c4dc", "value": "T1D4C2C0BC931390EEC44DC0F69BD807112EE04F84EA83FD6614C9D5C3996969E7AA39D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338582, "uuid": "6a3c19d0-7c32-4583-9f2f-bd7f2f9ca254", "value": "384:4EYRAoRVMCPsHEuhlyllkvGXZHM6QakJODF/1jfx94oSKGS3NJgGlzDpH7uNj1JC:nYRbVVP7HzF1x946JgGlzDpbuR1JGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771338582, "uuid": "b16b0ea9-6da5-4c44-9dab-dc5baf365bdf", "value": 26748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771338582, "uuid": "9d967b56-b511-4786-aaf3-84e629d21153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338582, "uuid": "3a0471b6-8360-4192-a3b8-5984c9338c88", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e5a471-0c50-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771367693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367693, "uuid": "20aeffb9-e9dd-4dbb-83bd-944ed84c90f7", "comment": "Malware payload", "value": "83eebc4909d3179f5c8cea4899c85348", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367693, "uuid": "6e3b0397-ae06-4fd7-ad01-a5c3def691f2", "comment": "Malware payload", "value": "1e54902649dfa5f7a8bab0461974444fb1f224294009030de740995320a6fba0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367693, "uuid": "34c22538-715f-4567-b060-bd5332f80220", "comment": "Malware payload", "value": "be0340e41d580084221b75435c2f6390965c4b12", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367693, "uuid": "3251e921-dee2-4ac2-8ca1-e497acd0bbc5", "comment": "Malware payload", "value": "c6e4b1d5feef9bbec20f6976616ad959ff3b4778dcd9b0a7694a30271dab3002f10c2c85cf5adb7a99620be4551f680d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367693, "uuid": "88ab65d0-aece-4fa9-a1e5-3f19387e4018", "value": "T1FC73016C52415439C748ADBED16A09B4F668E2C12790B98F35B2E39F4D0C98F7F07AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367693, "uuid": "a798b97a-7f03-4c9d-b3f5-dbbedc3120e5", "value": "1536:UST/e6CRoSu1pn36oj7WouZkcB0GJY6y7RlLbn0A8gN:UU/3NSqQoHfhDbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771367693, "uuid": "059ef0fe-bab8-4356-83f2-d5b9665a9815", "value": 74149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771367693, "uuid": "dc639c95-de18-4e40-943e-9bf7736aa795", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367693, "uuid": "3fe16ba1-fc32-4646-b5b6-9d42d2cd097a", "value": "class-wp-widget-index.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f831128-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342109, "uuid": "333db638-2dbb-4560-895e-d4d66e24c324", "comment": "Malware payload (Grandoreiro)", "value": "4fe071ca3e6bf44a1d4f26bd9ae91d7b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342109, "uuid": "59808edd-b576-4bc6-b9c0-e85556ff7e96", "comment": "Malware payload (Grandoreiro)", "value": "1f9c5af7d47b5b520d1b886aa6e7ac076c1b0c0f6419c5753adfb6d299ddae69", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342109, "uuid": "74c64dd6-2c9b-40e9-9ada-be9fa1c12cbc", "comment": "Malware payload (Grandoreiro)", "value": "9e4ca2472e14c23f5c1b724b23843e1b5615cda2", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342109, "uuid": "71c444e3-afca-4f7c-9478-9a610a21538c", "comment": "Malware payload (Grandoreiro)", "value": "c9bb9cba7d57c78b1ba4e143f22d793b3c0152902292a4c75891e5c34c8d0c17d08817d74f1f7f645aff9fec2b652bfb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342109, "uuid": "6cada7e1-88cd-4f26-9c85-0acf2b442c05", "value": "T1B2763330BD112C25C5908371743F6F366E7EB3270B8992D7A9DC924B2A47EC25A3F895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342109, "uuid": "4f3415cd-35e2-41e1-97b5-61a2bcf570b4", "value": "49152:GNIq+AxDclgzXftenBXuuAOCRpFctpVrXa0Kg82LHzri8/XIflpSD1wnTPFSAo6c:vYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342109, "uuid": "a7a73ad7-10b2-4b46-9ab9-484b576e7f4c", "value": 7294976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342109, "uuid": "8372de20-6ef1-4958-92cd-746fdedb03b4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342109, "uuid": "4f097aa4-2c3b-4305-814c-3ebe6895b322", "value": "34567X9017_Gst-IonSACVTJ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a748d004-0c20-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771346981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346981, "uuid": "e9b05a93-8238-44d6-ab68-fb3778273a68", "comment": "Malware payload (Mirai)", "value": "013b5c4eb47fa84b02185a60ffd76479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346981, "uuid": "ed180d18-d2f3-411b-8d72-7c7e76437030", "comment": "Malware payload (Mirai)", "value": "2035949a25341757ec979bf241ec3fd33d4afb4f1ed8022b96910fe949fb36af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346981, "uuid": "4e70edd2-224c-4c8c-b47a-5ea604f93443", "comment": "Malware payload (Mirai)", "value": "5fad1a53a271b3ee41bb7b8e1548ddb544cb4078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346981, "uuid": "d8d123db-334d-486d-a379-b0e6fe625d05", "comment": "Malware payload (Mirai)", "value": "0e97a767e44bdbd3fe4c24cdc0f96eceb039c2df5a9f0ceb58701310b74708026bdc66a195ff53f204a4cebcee676694", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346981, "uuid": "a77678c0-16fe-4211-932c-8d659fa2167d", "value": "T16B637EC9E283D8F6FC1705706036E73BAE71E0AA211CE686C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346981, "uuid": "dcdb7b9a-fc51-41dc-899e-56d927ef20e8", "value": "1536:pnUQJZdRlDAXO6QyQwOaOAmjxjhp3uJ7RvsuIr5bhG8V:pnUQJ7RlUXTQpwOaOAWxjL3q+uWnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771346981, "uuid": "39518430-1fd6-4913-a0ad-ebcf29950e42", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771346981, "uuid": "25ef03b3-e4d5-46de-887a-d8743c7f5561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346981, "uuid": "304c8e99-0457-4072-bb82-c83783369a31", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b30e04e-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341726, "uuid": "02aa42dc-2bfe-40fe-b819-7dd036104631", "comment": "Malware payload (Grandoreiro)", "value": "95b82966821683642d620b3175d634c7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341726, "uuid": "44b407ef-00ae-4d5c-97e7-ac9d7e7fee18", "comment": "Malware payload (Grandoreiro)", "value": "21026d24c9c3a1b921c060b9c0cb2401b7aab72b02489e4e7c74c0a21dac61a0", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341726, "uuid": "e6f8ee4d-5ee4-47a7-ab60-c00e5f98123e", "comment": "Malware payload (Grandoreiro)", "value": "d7c93f203a9896d9cd5484765fcead0b5ee4922f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341726, "uuid": "1e2e6a56-10fb-4e4a-a938-8422394b750a", "comment": "Malware payload (Grandoreiro)", "value": "69314038d61bdd0408cd9864e59a019a6681252efab8ebfd469f01eaf121e47ad228d3520db14bd7cd4cdce936f489e7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341726, "uuid": "412cdae5-f0c2-422d-b531-352c91460112", "value": "T11F8633339A458D7AC544833ABC2B2F385F3EB7174B8465D7B0ED99472B86AC04D3E069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341726, "uuid": "7ca09282-0955-49a1-92e6-4a93dad2db00", "value": "49152:dhBKMbp3YUeQxII/VmRoHCKl2zyyEioXqX9VXn1QotYzZh1OipsAHsHf++i5Lmvk:M3UsgnXUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341726, "uuid": "42000db8-f698-460e-9b9a-f8f30e19f051", "value": 8450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341726, "uuid": "8ee82309-85ce-46dc-96ff-537447cef2f2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341726, "uuid": "aca7e899-9e9c-46bd-9c87-408538e5b1a2", "value": "0Ord76221_EVUQ8X13T-Judi4076.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8816870c-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286799, "uuid": "b9fc0277-d0df-440a-aa76-8321c8a54ded", "comment": "Malware payload (Mirai)", "value": "5966e12c481c8908606a625ae3dbc4f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286799, "uuid": "5c848f48-cf66-41df-913a-cd698bac2061", "comment": "Malware payload (Mirai)", "value": "210c6a24361ef65a2950cc37aee4f95bc51c4f91db9875f8cd58b876b1af9602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286799, "uuid": "80d994ac-fc54-461e-b516-31b6fe231311", "comment": "Malware payload (Mirai)", "value": "6f53aff30b96e31ee7d4323c5f011252e2a15db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286799, "uuid": "6309b68e-b1a2-4613-b924-b5c200d6388d", "comment": "Malware payload (Mirai)", "value": "de6ad053fa2f43801ec88f3f88fbc7d15552114f982da335a7cb4d6409f22f0da59270eaee7215b5fdea455e46a9d859", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286799, "uuid": "86f13fdf-6d0f-4c20-888c-8fa5e4c38f2a", "value": "T16A63F945FD459B27C6D332F6FB9D078D7A2A1FD8A7E6310299346FA033C6AC12939520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286799, "uuid": "9b2797b2-b325-42f1-8175-869055313337", "value": "1536:Y510WPyaX7KF/yIg4iqxXOyC7xGGZMAvw8i:pWPd5q+7r7w8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286799, "uuid": "fd387fbd-4144-425c-8f3e-1a84321d9e50", "value": 67092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286799, "uuid": "ccea3552-37d9-4a48-9e17-5ad609ed6038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286799, "uuid": "cd5fc78d-7f3b-44fc-b175-1b85e78a6410", "value": "pftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965858ae-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341798, "uuid": "b330c6df-6935-456b-a37e-6091f392a31d", "comment": "Malware payload (Grandoreiro)", "value": "c9e28162ec3f9adfccda27a79773a84e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341798, "uuid": "c0fd5a15-efc9-4440-a5c5-70e309143574", "comment": "Malware payload (Grandoreiro)", "value": "21b4bc452c251d8881906de5a294e36a2d223af387dad86fb0c083d5cec305f6", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341798, "uuid": "192526cb-f4f1-4b95-b223-0cbfd07ffd88", "comment": "Malware payload (Grandoreiro)", "value": "658653ff55338b7b4e6b73c49dd14d12699bc48d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341798, "uuid": "d1ecd71b-a7cb-497b-a86a-b53f0b947fda", "comment": "Malware payload (Grandoreiro)", "value": "cbfdd7cf1a6dbea5a10beb0317243b8b47c021e4edd3f75df5154e1457b8702138c63aa7df2cffcbea2a0b8c5e388e01", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341798, "uuid": "ab69bfab-0350-4667-9e8f-da896e6d323e", "value": "T1F3663331AF695D5EC850037570AE6F256E3CB41383CDA6D735BCA146378AFC0DA2B4A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341798, "uuid": "f67ee70d-ffab-4e03-a4c7-1e27915cb16b", "value": "49152:73GlSIoB5tIPCsqDmyOlzCAAOjvFBMd2Kmwc1rYtrSHmyefS9NLUFXQzpYG1Lq1s:VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341798, "uuid": "bc83b24f-5a30-4380-8bb4-c605e512b120", "value": 7104512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341798, "uuid": "73b4ddfa-4739-4b40-a02e-943242672699", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341798, "uuid": "c51c4ba4-6608-4bae-8790-8d42a5c40fdc", "value": "Liq-Uid701251RZV859UDBFH.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e4a992-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342064, "uuid": "47155cbc-fb44-4f0e-9413-40a88f87e97e", "comment": "Malware payload (Grandoreiro)", "value": "b91a3499ca791a45676dbbd4d7a9f071", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342064, "uuid": "ae1dc578-f669-4686-bcea-c30bc6749872", "comment": "Malware payload (Grandoreiro)", "value": "21de0b631e5af183cbd888714a782840322932a0d65eb5ee8a187a3e99396460", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342064, "uuid": "e4c0178d-9b53-4f60-97a8-b722df6e6a0d", "comment": "Malware payload (Grandoreiro)", "value": "f09f0f5ead92698df16d1fc9c80f1bccbc9c0899", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342064, "uuid": "3bea7ccb-e6f5-4a7c-a8fa-03f2506655bf", "comment": "Malware payload (Grandoreiro)", "value": "0b9fa669eb3f4277213a4b753ccb55ceaf69145998402cf4c6394abaca680b4bd769a0ff7fa629784308764caef2244a", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342064, "uuid": "9013c328-061a-4365-96a1-f980db7da840", "value": "T132862331EE0658A7C6A44378B07F2E391E7D3247468CE2C3349D91D73B45ED25A3B89A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342064, "uuid": "800d4175-2334-4d9d-a0f5-dab648b3b663", "value": "49152:t+tMUHBbjqc3WWhG5K1do1oNNRDLPIR8YWnb4O59y5D5a0AtoABqyeYdz642Vknt:BUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342064, "uuid": "ec8f30ac-310f-4dd3-b674-e904010727fe", "value": 7876608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342064, "uuid": "bb2d0564-95a7-4f9f-b66d-62fbb8013c4e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342064, "uuid": "13905d5f-6d49-4ed6-a100-24a4392b200c", "value": "11556Snc_OI42BRYSH913317olceut.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c12b4d6-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349351, "uuid": "f72ea5d5-4850-48b4-a9bb-07fb6e414039", "comment": "Malware payload (Gafgyt)", "value": "50ae0714abfdcf6ad03442ecaf4d2976", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349351, "uuid": "440511f2-9f69-4157-a008-6e8f9906fa15", "comment": "Malware payload (Gafgyt)", "value": "230d69758d672bfd811c2fd81d890c18d1e28ce87c4641f8c2d3033790f00620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349351, "uuid": "cc37cad2-f54c-481c-8e23-38244c6405fd", "comment": "Malware payload (Gafgyt)", "value": "65db1b9bcf6aa85306d4a007b38598ae6418e1ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349351, "uuid": "09ac745e-1978-4cdd-8c69-e3947ff6aaff", "comment": "Malware payload (Gafgyt)", "value": "82df090d290b537f4271353bc8041ce6e3be32c30da68594188f3e55d3b34ea0bf09c499362d38aaea83bc4df1dcdd8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349351, "uuid": "acdf1759-86fe-4da9-a3d5-9129315f7429", "value": "T163E37D87F606ACA5D9910BF69B8713AC2BB31040AF9FE7E67D0C6A344D916DD5C0BB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349351, "uuid": "77f0c6cd-115a-4721-8b88-e391eb8f266e", "value": "1536:gSjfbd8F9ZlspLJJ+XZqkGltWY9r2gTOCeZgenp/LWJ+rdsiAURmgTHhLd:tAlspF8pqaY9S4Ug6qwrZAURmgTHhLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349351, "uuid": "0e15357f-ed79-4b3f-abb0-57c9e355b028", "value": 152420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349351, "uuid": "8b15b60c-d820-4d0a-a118-a114185082cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349351, "uuid": "a66bb781-4476-43aa-beb8-9d9cb12994cc", "value": "sparc.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b3f4f9-0be1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771319950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319950, "uuid": "1e9f8ede-957f-49f0-9677-ed6cba1df1f7", "comment": "Malware payload (AgentTesla)", "value": "a4c46181894b01236cdce9998484f3ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319950, "uuid": "08fd88a8-b614-45d0-ad27-e829ecfe3e38", "comment": "Malware payload (AgentTesla)", "value": "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319950, "uuid": "9e151845-1604-4cc7-98e0-1f1731b57a36", "comment": "Malware payload (AgentTesla)", "value": "67204fa087d2b397bc24bfe5fd7f7f365b3f8832", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319950, "uuid": "af9952a9-b4e0-4f8a-936b-b058d52c07d9", "comment": "Malware payload (AgentTesla)", "value": "e6006cef8c088e916012c797aa88fc1cddad4995ef98cd9c851b014293387230a55a64faabdb6496bd5af4bc2e8ae32f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319950, "uuid": "cf51739e-18d1-457d-b583-835b39cea254", "value": "T1AE340E037E88EB11E1A93E3B82EF6D2413B2B4C71633D60B6F49AF6518516425C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319950, "uuid": "991dd5f7-7f8e-4243-90a7-962fcb170477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319950, "uuid": "82d7d9bd-8ddc-463a-b3d2-5a2640f0fe1c", "value": "3072:qBz4yAumu2esPywzHvYs3h0P4SPEm5xrosS/Kb:Numu2esqwzHvYWI4SPEzskK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771319950, "uuid": "5ae0d284-ff7d-4bb7-8039-a495ad3aba07", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771319950, "uuid": "87040acd-f37c-45a2-8df1-45967c8786bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319950, "uuid": "33e036b0-bbdd-47e2-8da5-5ade6bf8877a", "value": "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa43ae5-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353840, "uuid": "ca671224-4bfb-4974-84e0-22ba34d5c0b2", "comment": "Malware payload", "value": "9a464a72406e10757d18d6becdf3ba87", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353840, "uuid": "2010fe62-542e-4684-91c5-9939bea25bfa", "comment": "Malware payload", "value": "240abac9944c9cf26f0884f988a6ac6588de9e56e7211cee7802658019c2bc4b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353840, "uuid": "1a0292f5-a596-491f-9f9b-7acfa19cb5db", "comment": "Malware payload", "value": "be033b5fee25ddb0e7710b7cb74446a271b809b9", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353840, "uuid": "3d9f489e-f4c3-4a14-b11c-fbf53fc0f983", "comment": "Malware payload", "value": "13fa15ecfa19192397782a5eba63559ec5e25a29cf38b3d7f1c9b81d1e1146bfa6707867d77830a1912cac9d05543906", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353840, "uuid": "7dfe0b9c-0b81-438b-8907-9b9dbd1581f3", "value": "T147663333BE516C57C6948335B42F1D266FBD7607848EA5F128ACA1C73643EC28E1ECA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353840, "uuid": "fa7fb859-c8e6-4b5b-96e0-4f536696339c", "value": "49152:BOuPs1y35Gj8zkxRhMdX4aY/bYMeGkj7K3VxVDrsqiA93RwkTZflXgLMj91MXX4k:t2dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353840, "uuid": "ce7260b7-f1dd-4346-9a2a-8d8745f6ce02", "value": 6608896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353840, "uuid": "46e3c8be-b3b5-4441-a115-0a8d047d9743", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353840, "uuid": "c01a415d-0036-48a4-b13d-f83782641b4b", "value": "Rpt7991-DLYY2484_AnGP4UQ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094dd13c-0bb9-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1771302477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771302477, "uuid": "3717ac68-5b56-43f7-9de8-2b59d00ecd9a", "comment": "Malware payload (LummaStealer)", "value": "eaa74e35cbf4c1afd87a933d8067e28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771302477, "uuid": "d1b64973-849d-469d-97c6-1d0d94cce7d2", "comment": "Malware payload (LummaStealer)", "value": "2424fa8409d2716d0b353d02c94d3eeb1ded5aa24674432fbcdad2caf62b3680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771302477, "uuid": "f75cef7a-1387-4e97-91eb-8f9864b6f8b8", "comment": "Malware payload (LummaStealer)", "value": "8c8cb80e03ee24c7241800e6399264e344e83bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771302477, "uuid": "e514162c-4581-4933-b796-07d52560fa6c", "comment": "Malware payload (LummaStealer)", "value": "bc1af7c957078759d5b75370fa96df4119b0112054d01b63bbe24c9df6bdbde3d5f8485d136c9c00363f95067be584e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771302477, "uuid": "d7f9f1fb-cf22-446e-9641-14d060bf4ea8", "value": "T142158205C69746F9ED2605BA0C14A3BF173A06519315DFC396ACCB32DFA3ACD0EB4986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771302477, "uuid": "f278190f-9bba-47ac-9e5d-2c3211c46c5d", "value": "6144:qtOuOsVMVu6zTS6b9pcFWUA/+ySa9Z3SowIrArgxOkew:LiVquX6b9pcFWU6+ySoZ3dbrST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771302477, "uuid": "30549608-dccd-4e95-ae58-455d5a6905f7", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771302477, "uuid": "dfe57d52-2a42-4fab-bae5-026f56e4a7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771302477, "uuid": "d62634c4-4ffd-4e51-a742-4364caaf8f0c", "value": "2424fa8409d2716d0b353d02c94d3eeb1ded5aa24674432fbcdad2caf62b3680.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01490926-0bd2-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313201, "uuid": "c913f0e9-e33f-4a38-8441-abc4774cf4b4", "comment": "Malware payload (ChromElevator)", "value": "9275fac95802810cda986a6b7a381342", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313201, "uuid": "ad16f24f-90d2-4fd8-b79b-df2c94c4a5f6", "comment": "Malware payload (ChromElevator)", "value": "24a1eacb0fbed9efb819567b7e25151384825d353254b31ec9d875694f7f53d4", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313201, "uuid": "40ca0f4c-a833-4c55-811f-7471bc301fd5", "comment": "Malware payload (ChromElevator)", "value": "e867f08a423a05d7ca7a05b256f58f0f371d2ee7", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313201, "uuid": "6d067d25-18ef-40cf-8486-ffee87fe3a89", "comment": "Malware payload (ChromElevator)", "value": "288de4b7ff973a6d01c814ec0b7137a94d35e559e00b7e31d21df9ad647e9292619a037a563ba8a1bf412806eb59fc48", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313201, "uuid": "2569f423-23a6-46a2-b22c-9ab8f9cd0434", "value": "T16196D75FA3D003B914B26214F58E75BEF312C47C5322D2282E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313201, "uuid": "cbbda53e-de01-46fa-ade2-7365acc4ae78", "value": "49152:KPbRYD+fVHkfKVGHvFf4qaFzqIUGi3UUqbgdFDR2v/JsgxQipUQ9Vs1tLVW6hLBi:2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313201, "uuid": "5ad47764-945a-4ab0-8904-2926f70f3bad", "value": 8635765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313201, "uuid": "5b176f68-5dc6-4beb-9ca1-d3209a0a1f52", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313201, "uuid": "d68b2e68-4f0f-4e18-9d21-713deafc186b", "value": "nouveau_curriculum_vitae (19).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5143937d-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771342971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342971, "uuid": "2fc9c536-24b8-486d-a220-e8effd259496", "comment": "Malware payload (AgentTesla)", "value": "0d6582a93966a3d5a32765aa212b0984", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342971, "uuid": "a19d9612-933a-446c-96ea-f29ed235a62a", "comment": "Malware payload (AgentTesla)", "value": "24b7d61b1c72c5b2b31e79a266d22037747870c2eb1bfc639ffd4899556a6134", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342971, "uuid": "1bf0d763-4369-4f59-b272-b38186797da5", "comment": "Malware payload (AgentTesla)", "value": "a17b327f3c993c9a57ecf8bb16bc38d4b8f9da2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342971, "uuid": "c86448e4-b546-49dc-836d-c7a7b3c37696", "comment": "Malware payload (AgentTesla)", "value": "fec2a4115029e7d525c2ad9e538ed32f35f89d98b3d6caac1b2ece807a31464fc6c15c7f23b9d6878812319d5d02e9f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342971, "uuid": "65e24e2f-7230-4f84-b6a6-272caf830381", "value": "T19A3395CA37D1B0FC0A6638B7391F61B6A2AE9E40608CD016DB578D787C6372DDC76924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342971, "uuid": "29248473-87aa-4188-8879-59fe8281413b", "value": "1536:3yxpilyiqcqo4yxTusrToX9DdXftpZnKc5HohJabIMW7:COyaqotcsQ52jOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342971, "uuid": "1fa4accf-b201-4f45-851e-209c47817b1e", "value": 51388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342971, "uuid": "d023558f-fb5b-4b2b-b35e-ff400e197b43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342971, "uuid": "50680e90-52b9-49f4-9e5c-d65d51ec558b", "value": "0d6582a93966a3d5a32765aa212b0984.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71fa7d1-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348376, "uuid": "22b8a20d-1eb3-423c-9e25-5844f22808a1", "comment": "Malware payload (Mirai)", "value": "a4663b299b55cc24b0d7c4f23cda6ddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348376, "uuid": "0dbf555c-10ed-4fd5-b5c5-1d8fcc004462", "comment": "Malware payload (Mirai)", "value": "24c100953ff3fabae89d69b23f8223aaa122f3bee85505be9ca7b0f3d960e394", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348376, "uuid": "e13b0182-d47d-4e26-97d2-04a899462444", "comment": "Malware payload (Mirai)", "value": "d5a5a1dbf43cb270ef645affb624c21166ea89d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348376, "uuid": "34ab32f9-96fa-46ac-a5b2-dc83e8e8d7db", "comment": "Malware payload (Mirai)", "value": "75c55555b0288a65d20c8daae3b73d854f68a3746f8f496478b088fed1936d9817fdefb2de7360f7ce8139f4ca46c481", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348376, "uuid": "13d8a3ad-2792-45f5-95af-86a267d9e020", "value": "T10A736B32B9751D27C4D4A87A61F30721F2F2479A25AC8A1E3DB10D4EBF35A5032537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348376, "uuid": "57816955-c92e-49f6-bedb-3766646406f7", "value": "1536:/kjnSCObFJmCGSJRN0Y0TQPtkYiNM5GTzgnsvt78/XI:s2c6jIuCzN8caI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348376, "uuid": "b37d95da-115f-4438-a194-1af3526745ff", "value": 75720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348376, "uuid": "a4286ca0-8895-42db-a34b-2fe2cf0cd67a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348376, "uuid": "5cbf3076-5f28-47be-ab75-9f701fbf1a2a", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5734a3-0bcb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771310346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310346, "uuid": "145b882d-fbca-4590-a86a-1380fe64b859", "comment": "Malware payload", "value": "2a193f0d9926bc1a8f1524a28b1e785b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310346, "uuid": "39555941-2536-4f13-bfb6-0ca8b193b73f", "comment": "Malware payload", "value": "24de62300b8a7af1266a8f125ba33f66f0774e8221a5e497b2d737e6b035ab3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310346, "uuid": "4e60f8c6-6b11-4fe7-a69d-30c666d0444e", "comment": "Malware payload", "value": "ea1cdffd20ebdca0595c2d3364c7877d54fc6a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310346, "uuid": "4cc03eb1-be2c-459e-bf04-e21c21857312", "comment": "Malware payload", "value": "43605b651aa6833d7e74e8e34550d1953ec4d4504a30dde44ef7a4fb432a54f511576887df9141896f2a7c75acac8e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310346, "uuid": "14cf39e5-42c1-44f1-9310-20517cae81a2", "value": "T1651733E4BD491631C22780BD77DA4D228DA1E648AC9467DF9B41B37EB30D2CEF618B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310346, "uuid": "c93a5068-c66f-4b71-9bd9-37e949aee10a", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310346, "uuid": "cb4ac9be-4c5d-46ed-8240-a7084337b7b5", "value": "393216:UqALs3iOKJnouvdTtjQe78NwZ171NiHXHghyhC2nCa1eTijGvv7ErFMRCcYJC9q:UJLsNKCuFp8ewyhSHXHWykafeTHvv7G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310346, "uuid": "22b4f966-7f1c-4bd0-9ede-053c9cf588b5", "value": 19423352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310346, "uuid": "db47871f-58c6-4053-9ff3-c2f0c06c006d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310346, "uuid": "eb71b524-0ff6-467d-86c6-bea8e9c18de8", "value": "24de62300b8a7af1266a8f125ba33f66f0774e8221a5e497b2d737e6b035ab3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0547d2-0c47-11f1-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1771363581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363581, "uuid": "ed678248-7b42-4080-98dd-0849e82c666e", "comment": "Malware payload (ConnectWise)", "value": "48bf340e95c97b81f68778f5a2aec611", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363581, "uuid": "4f8ae5a0-aa04-4435-9b53-9fa404354598", "comment": "Malware payload (ConnectWise)", "value": "24e250fc5160df45b509a0739d7fb099100e758dfcc3301a3cfec3d0e2b06264", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363581, "uuid": "c1a08855-1692-449a-baab-9708a6a3cbd5", "comment": "Malware payload (ConnectWise)", "value": "4043a4d8830edf5bdb7e8b5ba54568409e9e200f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363581, "uuid": "6bf7b9ec-7546-47de-99d9-cf45b60fec04", "comment": "Malware payload (ConnectWise)", "value": "d60c199dc85871ed3241b190da293e2965bbcfdc3cb9829299b38b0ac6b107d0904a9ea7816ac57536188f38b9bb321a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363581, "uuid": "0a2347de-e334-43ef-9a2b-90fb64eec6bc", "value": "T1A4A6237127F88429F1A75B39EE3A89E22938BC64DA26C05F17743D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363581, "uuid": "080cd953-adf5-48dd-b421-edc07197821e", "value": "196608:2KaLNkbgmi4QPKaLNkbgRKaLNkbgpKaLNkbg:YWgmiHnWg1WgNWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771363581, "uuid": "0c06a0f7-b772-44c8-adce-db9a72c9914a", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771363581, "uuid": "2d10a4d1-f7c3-4cec-bc61-951ef135a6c3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363581, "uuid": "97cb472e-13da-4334-8e78-9daecd9ed7f9", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5a7758-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343100, "uuid": "767e5cf5-b0db-48c9-8521-7b080aef4155", "comment": "Malware payload (Grandoreiro)", "value": "b2ceb2e0c7c53057d7b4599ee10baef1", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343100, "uuid": "a2e80a33-c015-4c7f-8473-270ae2ab623b", "comment": "Malware payload (Grandoreiro)", "value": "255f6ae1cb241f1c7b735143d0bfd8e320b1181536565d511b457ed16fc1d8de", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343100, "uuid": "1bac9dff-6378-4382-8770-c4b0d175d5dd", "comment": "Malware payload (Grandoreiro)", "value": "374bd40cd6a6affca6b23f6b4460964e9622c8a0", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343100, "uuid": "0e34231c-3ca5-4156-a955-427bf6f79025", "comment": "Malware payload (Grandoreiro)", "value": "9e17d55251dd001dd452008e17b9a521a8115f24a436008e81c6264b43da0a1a160b094009d786aa36c156db1ebfc58c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343100, "uuid": "ecae95ab-1f3f-40c5-afca-0bf471192b04", "value": "T1BF562330AA905C2EC3948375713F2B356F6C7A734789A2C3758CE186379ABC1963F895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343100, "uuid": "0658d696-59a3-4264-baa5-774bdcd615e6", "value": "49152:05/AVfd3zVqxEGcz0gwyCwDiGyaiFnsN41TsJ2ybsVrDa6pqtyfwKVNsAC8J82mE:fFbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343100, "uuid": "e29dcbe4-65bd-40c4-87d2-f5847465606f", "value": 6197248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343100, "uuid": "ad01d593-a549-4cf5-bbb2-947d968929c1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343100, "uuid": "419ca261-41aa-49dd-8f0d-af78ff77d301", "value": "AutL3311UBIC-7335PM92F9uzclv_Em.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b80127a-0c33-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355068, "uuid": "c8508056-3468-4b5f-9ca8-fb1a896c8b37", "comment": "Malware payload (Mirai)", "value": "c05187d159e13edf35db91bf8fcc4533", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355068, "uuid": "8a3364f9-0023-489a-87c5-76361995f6c8", "comment": "Malware payload (Mirai)", "value": "2586c909528701a22594b87b828cdf9c6c6e06e7bb91d246b979324dcf5d083f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355068, "uuid": "e461727b-3415-472b-83c1-f0b2ed86d55a", "comment": "Malware payload (Mirai)", "value": "6d9210443b95c098766571e4421bcc770567a845", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355068, "uuid": "99a82df0-8ffe-4cfb-8cc6-d5a9143623f8", "comment": "Malware payload (Mirai)", "value": "3ba28553c0cf3fab9f239bc463db6b5fbcd8b83cb181cb9cc8a82dec9b59555670b845cd6c2359890cbc693ae5bfb557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355068, "uuid": "9770000b-f27f-422a-a2b9-7852c4c9fd41", "value": "T1FC131986FC81892EC6C01776B66F218D3352B3A9D2CB3203DE585F1177C5A1E4E7AE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355068, "uuid": "55b26180-2f4c-40b4-b1ad-b4e84943c0c8", "value": "768:RG1zWTyzT1F+Cqaa5mL5GDdZxOdUjqdKA2sDci0GAO1qrPPi4wEfuRNts:PgTbz1agFGDdZxOdUOzK6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355068, "uuid": "6c9566c1-573e-412e-84e2-9cc1cbf886eb", "value": 43348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355068, "uuid": "62b8dd63-3ffb-4e5b-ae4f-a30c7c1193f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355068, "uuid": "c4282975-3654-497a-8291-eb3d8676db06", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49327930-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342098, "uuid": "ffdd0834-53b5-49d2-a05d-aa1468f9bdfd", "comment": "Malware payload (Grandoreiro)", "value": "ac8466a30f4b70f69dfac4721eecb87c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342098, "uuid": "4d266b9a-54b9-4323-8036-c1c6fcbdf47a", "comment": "Malware payload (Grandoreiro)", "value": "25deca62f52081e128cb96ba2e2e33db3149a03730edd588cf594ecd7c80f113", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342098, "uuid": "08d48f47-23c1-40b6-983a-65afaaef5fae", "comment": "Malware payload (Grandoreiro)", "value": "1d2cb15110ec0d28040c840c5196aad9b7c2a546", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342098, "uuid": "14aff072-94f4-4010-a958-5e6c1034ae75", "comment": "Malware payload (Grandoreiro)", "value": "741398f061a06adf69489415b125213ea87dcc512ef24d60f483be50d54aa78db158bb979765be6c89cada2e8b74bfe8", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342098, "uuid": "df667e9c-c354-4725-a961-7ed97f6ec313", "value": "T1FE462330FE60A837C7A04336B05F1B229F6D2593474CE9C7B5AD5192278BEC6CA7E464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342098, "uuid": "c1258b39-48d6-489f-bd94-aae4ac0f80c5", "value": "49152:eaaHwhiNqRPBqoH81bGfZp022zamrVzcsqGGG8PgC/vD8FHV3qR/OjjebS7PQMSl:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342098, "uuid": "69811664-75da-4e8d-9ee5-80bdf63b94ee", "value": 5400576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342098, "uuid": "61b3a2c5-eb6a-4601-a76b-7cb9d8fb7ab6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342098, "uuid": "32ce9911-a7b7-4b9f-bd2d-ddcce748d0c7", "value": "2716FX7BP_CmbMJITHZ-51841.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffc8990-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352605, "uuid": "b1107807-ece1-4574-a645-d26dbe302a4d", "comment": "Malware payload", "value": "79411fe819c4e9a9912e7ac66af1cda7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352605, "uuid": "9645a62f-cc1f-483b-8586-0044350de81d", "comment": "Malware payload", "value": "26369b5b2c0080a965e739deb17a4b2763e7a0d89b217f22c8fbc2a581e933da", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352605, "uuid": "3f9a5411-1a0d-4a06-bda0-ab97f7e824d7", "comment": "Malware payload", "value": "ebaa1fb6414f68d9bd1f9572d8e3a72914074d2c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352605, "uuid": "03771e29-1626-4c48-9d38-f40758313c51", "comment": "Malware payload", "value": "21de32d3768464dec4d82d4523ce6f929e601fcb7d9cb3e800d84586bd0e613bcb924c4fbafebaf894a2fb4bc615e0c6", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352605, "uuid": "dd27f684-292d-4aba-8256-a29e22a02e34", "value": "T1A3963331AE916D6ACB988375B07F2E362F7D6F030508E5C738EC914A374AEC5C62B459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352605, "uuid": "165cfacf-35ed-46b9-9f76-f7386efe96e7", "value": "49152:XzJsesu3icyR2T4qtYZ8qMFiDL5VWwwqNRdiPCjHTSbT/WL2FWw2TitwinqIQd2/:cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352605, "uuid": "948ce67b-4e69-4113-b1ad-5abb45c8c28a", "value": 9347072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352605, "uuid": "e0ddd7d3-4e15-4540-b129-b758111f6141", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352605, "uuid": "53591cfe-239f-4c53-bdaa-3093ae17dd52", "value": "SVQPPF64688510CFCP_Vr-Ict2203qnizol.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daeeb479-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312707, "uuid": "0a7edb57-470e-40a1-8e81-8d0cf09e2c11", "comment": "Malware payload", "value": "b4d623486a911f0f42b6870005c58449", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312707, "uuid": "37312cb9-a24a-4636-b3aa-e3191143a249", "comment": "Malware payload", "value": "2639fa0ea0e5cc2c97b2183d8b033c666f4fdd1f4ebf9ca2615b454887fa40c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312707, "uuid": "2e77e833-1130-46a3-9aca-b9edb32de1ad", "comment": "Malware payload", "value": "0a94d6b022543ca679aa5459e0581bcd5aa69606", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312707, "uuid": "520063d4-543c-45e0-842e-90acbc5cba14", "comment": "Malware payload", "value": "fbc279c28d15df8f34e1f22dfc9d260066fbd7f1e52a59186dbe6d99979b53862fe2abfd63e1c3fe2e2740e213ead4dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312707, "uuid": "0545435f-83dd-4ead-b036-1aae3625a8a9", "value": "T1B023E7CE31C371A81B623D2711AFB1E3E63ECBD858CC6560D2A59D61BDA031DCEB5924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312707, "uuid": "f7b3f0a0-05dd-4d40-a596-4f20adb7ef4d", "value": "768:DYx+tI46Lutae7pYFcLTl36ajGQqBJD9kYkJ8luyOuedzxMlZ5Wh4J7up21DSUWn:DJ6cLh36ajvU7TOuedzxqDHupiSUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312707, "uuid": "58061cff-3e23-40cd-992b-28a4c8f7e357", "value": 49215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312707, "uuid": "0e59b996-de12-40eb-9a3f-046af4a722ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312707, "uuid": "dd542d26-80b3-4942-94a8-4617b397b9f8", "value": "b4d623486a911f0f42b6870005c58449.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9976fa9-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351763, "uuid": "200e0dd9-ac30-404e-8b48-7f358ea44925", "comment": "Malware payload (Mirai)", "value": "2c0ee6e649d372121e241f7cdf387366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351763, "uuid": "c603a819-f090-4b97-8aaa-f77b5aee52d0", "comment": "Malware payload (Mirai)", "value": "265b95e87b6c31b68e81b066a8171d639d6f58e2da948c97e9b62585e20bd0ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351763, "uuid": "9731fdcf-64a5-41a8-96ae-a5f4f9db82c9", "comment": "Malware payload (Mirai)", "value": "1dd77cbda897f4bb4b252f1169b396f0fffb3ebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351763, "uuid": "5c9dfa5e-9552-4852-9866-ce6b55827430", "comment": "Malware payload (Mirai)", "value": "cf4ab402175e53051dcb08f1832ece4ea5704f04318376ddea5a4560334c4f6b8ee0aefc937cc303ad4c30278a95bf3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351763, "uuid": "5309b6ef-7deb-47c5-9c7c-ff66cf259cb5", "value": "T196237CC0A543D9F8EC150AF53173EB329B76F07A2129EED3D794A532D842702E64729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351763, "uuid": "3704d536-28b7-467b-b2da-1ded6c4cd34d", "value": "768:gjo8WnBsux3TUi32+4qbBYSWLAs9QnbH+YMbJoSVO+Meb4an:gWBsux3TUiG9qbBYSWj9QKY8JoSVO+1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351763, "uuid": "3b9d73e5-15b0-475f-a3b2-6826a595c231", "value": 45656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351763, "uuid": "ef9586f5-87fd-46af-80f9-acfcd3156369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351763, "uuid": "2fd99f94-b899-49e6-b326-ef7576806bc1", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23eed8fc-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343324, "uuid": "daf61f9f-3e1d-463b-ab4d-e108967352b4", "comment": "Malware payload (Grandoreiro)", "value": "7dd3940a550fe3a6278ec60342b02202", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343324, "uuid": "6fbead87-8c01-446c-a170-3f01c1dd86dd", "comment": "Malware payload (Grandoreiro)", "value": "265f965c2da2997b1a314ba3e41bf059f78df656f89f0172452ee760e8e4c348", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343324, "uuid": "c01e0647-9dd6-4c42-b1dd-cde4af9a29e4", "comment": "Malware payload (Grandoreiro)", "value": "9c77503e8cd8858b969139dae5cd1668c19aeb9d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343324, "uuid": "2692fd31-1eca-4597-a1fe-4217fa130713", "comment": "Malware payload (Grandoreiro)", "value": "96541e32bf30b731657d432e8aef515b7269106ce5c6b662e961373314472678bfa862dc3427333588d6515a16f072f9", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343324, "uuid": "6278441b-46d8-4c60-9b4b-5df68030e88b", "value": "T1AA463333DE00285AC590C376B42F7A369E3D7E43858DD2E4766CC6973F81ED1862E4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343324, "uuid": "5745b2e5-4429-4281-b8fa-be15d230f8d2", "value": "49152:O/XKkhxDFLPM9ihTXxbWqd3pDSqHdeKB8DRoJpfcuMdf6QEbgND9WwlFWenY4pyY:ZAUvyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343324, "uuid": "614be11a-4223-4e56-816e-172f218e0c96", "value": 5736448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343324, "uuid": "14599f02-828a-4de1-82e0-4a0a11e94312", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343324, "uuid": "d558ad30-66ac-49c1-8f50-eabf9ead0f7e", "value": "O205M180003XESCevmbn_Desv0130.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3cf3d5-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341756, "uuid": "628abeb4-6583-446d-8c26-341810fc62ef", "comment": "Malware payload (Grandoreiro)", "value": "cbf0c27779eded1290705726b31dd29b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341756, "uuid": "d05f0d46-b7a8-4370-9a7c-37512e414fc2", "comment": "Malware payload (Grandoreiro)", "value": "272a5e170bed7bfd02782fddb379a77a2df1882c0d7a7c7e1646f91c51cdda29", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341756, "uuid": "b451411d-f56e-4d68-ab2e-b5151391944e", "comment": "Malware payload (Grandoreiro)", "value": "43c844edd88b4ee9d9fb714192d098d4e493821f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341756, "uuid": "bdb15624-6720-424c-b9b5-c29e11ca4856", "comment": "Malware payload (Grandoreiro)", "value": "29a32a6f903a91f70abbdbc60ecb5f4f5823f8d7d90e4c8958109d8b7c0ed78fcd865e6f372583e45d2fe286c437aa49", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341756, "uuid": "87a0a58f-a402-4868-8d3b-8d008d973662", "value": "T1CE562330AE455C6AC190433AB87E3F359F7DB65707CC86C529ACC1023746ED69A3F8A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341756, "uuid": "1ab4d3f8-a2a0-4876-8a48-7a466deea1c1", "value": "49152:5G4ngtGy2Kk1FzBJimofyBTSx612OTiKiwIMJcW7PkYP2nD7elYhiFhlyuFI8VLx:2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341756, "uuid": "16d75906-4e9b-4443-8b07-daefe7af15f0", "value": 6348800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341756, "uuid": "788d98c9-50f8-4692-8a8b-8752ad1a910a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341756, "uuid": "182b78a6-4593-42cb-83cf-21b61aa82bd2", "value": "0VldcQJJDN801690LRSX_MT4ZFT.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d851f121-0bc5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771307979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771307979, "uuid": "e927afdf-1bb1-4401-939c-0119279693fe", "comment": "Malware payload", "value": "6129ff01b60476e20071ac17a1a08d41", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771307979, "uuid": "fa04cb75-cfa2-48f6-92bf-50d41e45ab54", "comment": "Malware payload", "value": "2766f0eb3ad85b42d161759e689383ddb700abcb917401153a503dd4f8eeaf6c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771307979, "uuid": "2a00d5f4-8029-41a9-a3d6-bbde390f4fb8", "comment": "Malware payload", "value": "fd04b5a146a928e98a2e362bc6b9ca96e6d505a5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771307979, "uuid": "403a574e-8690-40cf-b10d-54337f63e60c", "comment": "Malware payload", "value": "ea79fea6618cbea218a62db846fe6105bd7232ec44982cbafe0495199854b9e049b4e7982f32ad89ef8b7152970df42f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771307979, "uuid": "a7e6b450-0458-42a8-a578-65ed76c319ad", "value": "T1BD15F2A3F16C255AE81FCE7AA2018D213F6889D6CC47F45E11FC059B8493CDD4F6D2AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771307979, "uuid": "dcd73f84-2b07-4e66-811b-957482ffbf78", "value": "24576:DDfEHT7NaERFjeSy+INxHT1OvHZ22J/87JZEXyzys63Iou1lY84Eeqq6E+jCB:DD07NkDNxHT1OvHJk79yr3HE6E86E+jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771307979, "uuid": "a1aadc05-e38d-417f-98bc-d582ecc7ad9c", "value": 912958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771307979, "uuid": "a5176223-d3bd-4134-816e-5f45ff2d6acf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771307979, "uuid": "63236e2b-f787-4887-b5a5-0084aa53aef0", "value": "2766f0eb3ad85b42d161759e689383ddb700abcb917401153a503dd4f8eeaf6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd42a564-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771313195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313195, "uuid": "b95e403f-c2d0-4a9c-a78d-8a31fbd1251e", "comment": "Malware payload", "value": "04d2e609e63557ec660d830287b8be95", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313195, "uuid": "f1e23f57-c25c-4858-b96b-ed7e372e11f2", "comment": "Malware payload", "value": "27f1c6135bd5d5ce89eaf705f78a450cdbb026ac98b33fd0fbf6b6d242fc1dc3", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313195, "uuid": "50103aba-f14e-4220-bc6f-90cef91957f7", "comment": "Malware payload", "value": "887a947c5cf979284c42380179c4be7e8460bc52", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313195, "uuid": "5affc9d1-828d-4b0a-988a-daaf140fe670", "comment": "Malware payload", "value": "3666dfb4b92dcb155d176c9df6d103e374b6b161fe4a6dbf909a26cceea15dc80f514dc1ecf8e88b0015f8a3eaddf750", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313195, "uuid": "6de85764-e3d8-45d2-9d39-61de4f6bdf6e", "value": "T19896D75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313195, "uuid": "32769b8e-d2ef-4db9-9027-2e361cc09afa", "value": "49152:PqSGSTvh2wxUW+lc7H3ZvLwGtRpBecApq5bJGrloULGT6Q7N1sR2Hul49j88YBgD:0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313195, "uuid": "48b226eb-5857-4d37-a848-31a00f39a302", "value": 9057122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313195, "uuid": "cd8659fd-056d-4910-83c8-48689ccf70b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313195, "uuid": "43fbcf0c-ba86-4a12-bdf0-beffacea97d9", "value": "nouveau_curriculum_vitae (18).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea2d19e-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341785, "uuid": "20940996-9c8d-4fb0-a591-80c259bc96e8", "comment": "Malware payload (Grandoreiro)", "value": "ad23b2d915433c5aee94364f5045dea5", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341785, "uuid": "6ec7e746-73d3-49f6-b9b0-11d7107b35e2", "comment": "Malware payload (Grandoreiro)", "value": "282f21aacae7521ca9936f15a3a8b5cad101272f1814166e1ad41f85be8b68c6", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341785, "uuid": "fdac4843-7390-43c4-9b44-f91d9f56916d", "comment": "Malware payload (Grandoreiro)", "value": "a2ba2b417f6cb98858d41fae26b4c409fa095e31", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341785, "uuid": "6c12654c-4181-484e-a617-51957d4b6d74", "comment": "Malware payload (Grandoreiro)", "value": "32194849661a34deb7dc8f00f9a6e76351648bb20f6c8d87c9a01ab5661fce400875a513ebddb6c69ca6e07e54893894", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341785, "uuid": "4c438f2a-d9e1-479d-a86c-87fdb4639f3a", "value": "T111362372AE581C57C0500334702F3A726F7D7A0387CEA6CB359CA65B3B59DC25A3E4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341785, "uuid": "2f69cfff-02c5-4e09-bca1-45cfd8124fcd", "value": "49152:qCjMKValQuTlyPUqvg5fY0ZMALrjdDlGQ+6OBys4yEA7cXrAFJ9whUVOaUZOxS/k:aZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341785, "uuid": "40eb36fd-1c91-4bf3-a55d-ba806f390fad", "value": 5269504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341785, "uuid": "3dfa199d-b4bb-473b-bbf9-e264c0d8bc54", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341785, "uuid": "7cf71198-f836-49db-9731-2f850778824a", "value": "Liq-Uid25175AS40HPIV.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdc2157-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1771311803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311803, "uuid": "6b521241-41f7-4718-af4a-c75d5698565f", "comment": "Malware payload (DonutLoader)", "value": "539bc00e10ed7904b48e8f9a94c58c23", "object_relation": "md5", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311803, "uuid": "24f9ab8c-cfc0-4a60-a53c-c8bf49ead195", "comment": "Malware payload (DonutLoader)", "value": "283aef05e0d1fee9507b30bc62681ea3c66be52a80543f024b9500de541f24b0", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311803, "uuid": "328c5453-f306-483b-8d96-61b00113aa01", "comment": "Malware payload (DonutLoader)", "value": "12eb56d24ab0e24d4a3507646a9e3af5c55af86d", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311803, "uuid": "ffd09f45-82b3-42f0-b2eb-f7bff077ee4e", "comment": "Malware payload (DonutLoader)", "value": "e6115f5ed4e0da1603e129ecaa3aa70ae230a6668e8a2e4f2a6ab71b6d4623e4b5a8da506d8b581f5b67da2b9a37eafe", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311803, "uuid": "3db4de44-25fa-43d1-8524-5c4c363588f6", "value": "T1D913E80E7202A4E8E81BD1348EEA97B2F5F13C15A0766B2D17E0C7614F24DEA5B39F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311803, "uuid": "ca931ee6-160a-4754-9b34-39c76f06fe61", "value": "2a79b5a4257d74ec4bf75d136ce1134c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311803, "uuid": "f979816e-0ec7-4fe1-988d-98d3a9870c55", "value": "384:a1DbxnPYjXyKt0K3qkZjusLAN0BkYT0mevO:0xnPE76kjusPkY0tO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311803, "uuid": "b5eed155-b9ad-4879-a630-f6ebbafdae98", "value": 45184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311803, "uuid": "d3ba8d93-a53a-4070-bd6b-b176f367b900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311803, "uuid": "4cbb9b0e-17dc-40ae-b263-06d530395098", "value": "283aef05e0d1fee9507b30bc62681ea3c66be52a80543f024b9500de541f24b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00f586c-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343210, "uuid": "bf090230-ab56-4f05-96d8-631543156583", "comment": "Malware payload (Grandoreiro)", "value": "b97d0e1b8f4bde8066b977d052e49738", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343210, "uuid": "8652b2b9-4301-4145-b7fe-82f231709f3d", "comment": "Malware payload (Grandoreiro)", "value": "28cd5cf5a483fa124e71bd28052b183fe2d8c424f14e8f59cb85742aa3e9645c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343210, "uuid": "537ba16f-6e07-41e5-95ba-05c7715a04ea", "comment": "Malware payload (Grandoreiro)", "value": "5a65588fdee4b89e0eb3386a2f71d6812b3f2625", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343210, "uuid": "5e7abb0f-41d1-4634-afda-affdcb88250d", "comment": "Malware payload (Grandoreiro)", "value": "8a6f3b3af7758a02977eb558f8e95879c9a41cdc99569e0d3789ad3c543bd4fed9a3e99a283c343807e1e49b37545327", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343210, "uuid": "9a3d3157-24e0-4f5f-a48c-9f3e0d9f14bb", "value": "T1E3462331AA502C5BC6B04735B12F7E222F7EA603538953D339EC514A3F4EEC2993B695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343210, "uuid": "930a58bf-b071-4459-937b-d70a6dd58347", "value": "49152:jKn6kT5QrnRvS5J5/H0ncm45ChQCPXKf2fmY35hIFL86N8c+ezW8nFqBVyfhorC5:BIZyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343210, "uuid": "e44ea1ee-17e9-4d96-89ef-78614b8a2a37", "value": 5750784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343210, "uuid": "cfb70fe4-4a61-414a-9aa9-9c27a999b18f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343210, "uuid": "44dbe2c6-8a69-496d-a4cf-fb173fbcfc39", "value": "FnzFOZKR-4509660L39DQEJP.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a45b28-0c33-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355026, "uuid": "861b3da1-5f82-4031-8307-2e5eb9fde589", "comment": "Malware payload (Mirai)", "value": "7e4720044f4f48d0aa8975e8c5026659", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355026, "uuid": "e42c722f-ebd8-4d15-bb9b-db28a9c39d04", "comment": "Malware payload (Mirai)", "value": "28e56049acc628b29d70f4f6b7e206621a821f58072afd115c524416c9c84435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355026, "uuid": "93e6c8b5-7d08-4704-b915-f5c40bb68781", "comment": "Malware payload (Mirai)", "value": "2426e711a7ecd67e292495c9b9f0c881d6e16d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355026, "uuid": "85165afb-0a1d-42af-87d8-a2505ad5789e", "comment": "Malware payload (Mirai)", "value": "31111327019640f5d0a38ca69c8fb9368e2c8185e3252eebfa7c205ef4358df0cccb07e802a76c51eca315e4fb9a79ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355026, "uuid": "a417d9de-f7ad-46a1-9a90-ad08a3bfb615", "value": "T1BBB3D91E6E21CFADF369C23587B78A21A75833C626D1C685D27CEA011F6034D245FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355026, "uuid": "3f549099-e022-4de5-bf9d-cdd8326284e1", "value": "1536:071cSXpDd5Ncrg1ntj4qVIwxKCxKzeK8CXYqrQuFxhrdnHDeCWWyEWNn3Ull:61ZZd5NcrdnzYqrQuFXdnHcWyEgn3U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355026, "uuid": "cbe9e9fb-179f-479b-b071-6068a35b3b68", "value": 110388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355026, "uuid": "af9ebb3f-0457-42a7-805b-ba3f1205820f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355026, "uuid": "fbcadf2b-3770-4817-a87f-b516af9976e9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47423c49-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771312889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312889, "uuid": "282b19aa-1ba1-4c02-915b-6fb1ff25a2fd", "comment": "Malware payload (Formbook)", "value": "6fcef5bcbab4f2445b4dc8e83b5b03d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312889, "uuid": "03d9196f-b2cb-4b0d-8860-a57dbee64f5e", "comment": "Malware payload (Formbook)", "value": "28ff05bc204bf106c50e52a9435032a023eefefb71279a5d2c7625954897e6e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312889, "uuid": "085fd135-48da-4dee-bed1-e7b4cc6699b6", "comment": "Malware payload (Formbook)", "value": "5d4fa4b65fb7e9107498420f73d9c6fdc1531114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312889, "uuid": "4fe6576b-ccfc-47e7-a8a1-24b2acf6f71d", "comment": "Malware payload (Formbook)", "value": "bf6aaecb0110b9d9d71aad4c03e14a1b9f44f917e359302925ac3ecab3cd0caf5fba52dfd6221195092b5754cb23b363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312889, "uuid": "72bb253c-610d-4ccc-abb3-aa82d4ff1f2d", "value": "T18A2501482B16DD13D86A0FF119B0E3751BF85EAAA511D3538FF6BDE7B9327852C01282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312889, "uuid": "3668e749-bd18-4396-947d-3b0bd2357076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312889, "uuid": "2b7ab324-a3d0-4f20-9f64-9d2dd7c41468", "value": "24576:Iqu2VKQepIupIwDhxdUQAZoZ4ye2SgqTT+Ia9GRWcPpxwfAB87:IeVKQYIupIOxdULoniTT+IgGIcPpqd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312889, "uuid": "daa0e42e-a580-4ab4-ae03-40f278bdd434", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312889, "uuid": "14aec4ca-eee8-4e66-b5f0-7fde4aa94507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312889, "uuid": "c1f5cac3-e1a4-4802-b1e4-65eb02cdfa9c", "value": "Invoice Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1077fc65-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343292, "uuid": "14b2421b-6b8a-4dc1-9836-cba00444184a", "comment": "Malware payload (Grandoreiro)", "value": "b30d02ccb16e6f2a4707e91065d0f532", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343292, "uuid": "954c9022-0b21-44cb-a3e7-9fa73351d376", "comment": "Malware payload (Grandoreiro)", "value": "295a63629e2040ab4c461c886bee00c28894cb24fd5a9047cf7cc978a002f8ad", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343292, "uuid": "3946f39c-4015-4a61-a5e6-08e119571f9b", "comment": "Malware payload (Grandoreiro)", "value": "cf1a9ba0e9500ba7a9d98becd810122a7ee32656", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343292, "uuid": "3b76db13-f26f-4394-93a8-21013816eec0", "comment": "Malware payload (Grandoreiro)", "value": "ab3bee7688211892fe760004135287f2b7f321b29fbc2fbafc3e7ad27d5b75aa493f491f02373b78952ca44f75de536b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343292, "uuid": "016b1547-a587-4d16-a8d8-20066ba7a6c6", "value": "T16F963331BE542DA6C6988372303F6E356F3C6B43478E90D7629CA1872767FD1463B0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343292, "uuid": "5913a12c-9281-4e95-85c3-6e1262409716", "value": "49152:XBzCWOQao01ei1OtEt/G2m8/IhwlDuFm7B1hTUp5KivVNc2As719VtzTXpVMo7m0:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343292, "uuid": "4f5bf3d5-5a03-4949-94bf-9a6001402444", "value": 8693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343292, "uuid": "ad334d4e-b4c9-4e27-aa5e-4b416edc219f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343292, "uuid": "62a68c7a-89b7-4862-8e78-bddb8190137f", "value": "Not-Ar7121GNJSMJXHQPJ642623.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a3b21a-0be2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771320131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320131, "uuid": "6f366bdc-2be7-4f8a-9657-4d369098a82d", "comment": "Malware payload", "value": "f8f99947ae265ecec52de723c2c17508", "object_relation": "md5", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320131, "uuid": "4e770885-8cb1-4516-9a22-1f2560d0f890", "comment": "Malware payload", "value": "2992ca29c7f80ffe65886f062abbbecf66c231d19bd7cfb6ddba6a34e1e0effd", "object_relation": "sha256", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320131, "uuid": "6ae54ef8-04ec-477a-af69-55c019902f31", "comment": "Malware payload", "value": "0198f7171bc22c6458a283a186f62a285413e3bc", "object_relation": "sha1", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320131, "uuid": "7a525be3-7e6a-431f-a3df-8f147014fe6b", "comment": "Malware payload", "value": "a4e6b46cb8ac6e0168e7b71a24acc0e03041f536439dcc5e158a8d2c9f5df088109d296715071a8f5a9c100c76afb91a", "object_relation": "sha3-384", "Tag": [ { "name": "AGEN", "colour": "#04DC9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320131, "uuid": "7f15a28a-3d89-42f3-84a5-6833cfc66cc8", "value": "T187B633155D637E2DC98CD6BC506F2F0AE1A08F9618F0A15343D2B1DB2072F17B52ADBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320131, "uuid": "5cded454-9b58-4308-a3b5-48b801a2b7e6", "value": "c9a3edae9204609d90d0770c3583acd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320131, "uuid": "05b219e9-afc1-4977-8688-7b79f24a3e40", "value": "98304:2LzsdHU+DTwl9zOHz7t1Q5RRlWY9HJ3CChZfYQmGmQZbTHbKs/mkB:M8U4TIqY5BZdwnGmQ97KYZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320131, "uuid": "1cdb5449-a28b-4529-8b36-6ba701be0aaa", "value": 10639900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320131, "uuid": "46540b49-15b8-4700-9b3f-27cdb8f6cc98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320131, "uuid": "10e15984-29f2-454f-8c14-4e5e2cf38b1c", "value": "\u521b\u4e16\u5947\u8ff9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c4e632-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342207, "uuid": "29df750f-f6c5-4f4b-b83b-f3d35e22b830", "comment": "Malware payload (Grandoreiro)", "value": "50a2b844f2dfe59ace96134c212ee7e6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342207, "uuid": "fd5dfca9-bca1-4dc5-b373-2c5cb4f58116", "comment": "Malware payload (Grandoreiro)", "value": "2a2bbd38ff6d54514126a924c2d799251b4123c5c581cf542a76f4caa1cb6174", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342207, "uuid": "2343ec9b-6f23-4e19-bd52-ff21b0e5aec4", "comment": "Malware payload (Grandoreiro)", "value": "c6b7207ef1dae0e154e284f32db868e46040f0ed", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342207, "uuid": "6c6ffd76-0fe1-44dc-b215-9dd4f2c2b093", "comment": "Malware payload (Grandoreiro)", "value": "a48e848327160da8595aa791b60c910e31fdfc6d9a15e7b57239ab0ef923f8a432618ac533f98640db44a10fd7e1c743", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342207, "uuid": "6c190315-fab4-4c6e-b027-61d1653d5b26", "value": "T1BB563333BD856C6BD5904736B86B6E35AFBDB203064DE5E3709C918737029E21A3EC91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342207, "uuid": "32cc2083-1589-4cba-90be-04f1550de40e", "value": "49152:wP/pr7xsZ3rd7mTpfyeCp2tgKsdOBDbnWlDBpl+t9kSecJ6wt31KREoqNCR:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342207, "uuid": "c9898d81-74c8-4a89-a56e-069104d0aa7f", "value": 5953536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342207, "uuid": "0b8e3e98-7950-4e2d-a7c8-ea27b3180e19", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342207, "uuid": "03ee56a5-db30-4bec-ba43-3eb5f05eb51a", "value": "6754Cer-NEELSR467I_Not667743NDCC.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a9ff20-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309046, "uuid": "6ba3a569-e131-491b-96a8-020a91b79902", "comment": "Malware payload (Mirai)", "value": "8ed10492b28930c63e0df404da6f577a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309046, "uuid": "323ddbf0-287a-49f9-bc36-d25e570b02e6", "comment": "Malware payload (Mirai)", "value": "2a7716c001a315bd40dcb441e9fc55cf6e6b96b267bb250d6241a9de6bad3887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309046, "uuid": "92612d2e-650e-4be4-a519-38dbb10adb8e", "comment": "Malware payload (Mirai)", "value": "750c0b813ad28c6522f7a1a1af33327da54eb930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309046, "uuid": "6258ae83-bb1c-4775-952d-fba2513ca6dd", "comment": "Malware payload (Mirai)", "value": "4ab40dad69f123120eb0f7dece1ac26978c2165f4e00bb9252cc038feee8fae91f71e8e5cd8abfed3050cc997e65291f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309046, "uuid": "7d2a54be-371d-4f86-95f6-7098e9198035", "value": "T169336C02775C0E43C42A2AF4353F23E5D7EFEAA120E4F585694E9A46C175E33059AEEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309046, "uuid": "e032be38-cff5-4ab8-b26a-618e240b8572", "value": "768:+x4rT0M6NIYnCTsTDr6aIwUSAk42hftkSGsv6H1ILt6q:T0NNQTsHrjbjfTS1Ip6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309046, "uuid": "cdb903dd-40ec-46e2-8360-e2363587071d", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309046, "uuid": "e1501773-4e08-466e-8984-ae931da25d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309046, "uuid": "bb6e23e8-bbfe-4f99-b662-b52778696a87", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdad23f9-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352628, "uuid": "b15f38ad-d085-44ff-931a-550ec4b38d75", "comment": "Malware payload", "value": "fa971d79bec81dc831c7b1e7284d31ac", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352628, "uuid": "9c7b6253-af62-4409-bdf4-9fe4f85bc97f", "comment": "Malware payload", "value": "2aab4f30d692b0fa23fd0c2825ab874b7f83ded1751b26c41c1acf6d81729110", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352628, "uuid": "64ad9542-2df2-4064-b969-41f8e2b91699", "comment": "Malware payload", "value": "4e9b05fcef0762080bb7183df22e8016ee8d4dd9", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352628, "uuid": "5fd89f21-d567-445e-8002-1cbc8baf0492", "comment": "Malware payload", "value": "7867fdd64d45b7228ea506685cd9153d8aa13b3fc02297a190a54f9fc1d02c21dbc5c28ab81e2125a88d4735116ea894", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352628, "uuid": "07f8b475-c7c6-444c-b5ba-ca4056876d20", "value": "T13E763331FE522879CA944779716E3E312F3C27434688E5D27CDC91832786FD2667E8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352628, "uuid": "410d9f41-01bd-47ae-a416-fe8e6123ce4b", "value": "49152:eVDMp4Vp3UanwSlr46PgabdkKhRXcWSAGQGVOCcC8GRiJmeho8E+3WpR8jBI9L2R:Xx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352628, "uuid": "a2297a72-03df-4c7e-81f7-a59135d745b7", "value": 7544832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352628, "uuid": "a291a32f-de3f-4bec-9dc6-fd263616691c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352628, "uuid": "300e41ce-3c7a-47a6-80a3-09727285e770", "value": "TmprPHATLK8040-B448B.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45431025-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342092, "uuid": "34e8e53a-5687-41f4-8752-7dc5c309d65e", "comment": "Malware payload (Grandoreiro)", "value": "737b835c5cb7cdedbbbb80d23bb04d9b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342092, "uuid": "842edea9-3702-43c6-84f7-e2261642b27b", "comment": "Malware payload (Grandoreiro)", "value": "2b021f5e87296348e4fe999929159a44c78a210f41b9206de20e58ae1e215c42", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342092, "uuid": "e3a37a81-8f63-41fa-9e36-89b063c23a10", "comment": "Malware payload (Grandoreiro)", "value": "0b739a61e0fcf0478dab626e02278b5f2670bc70", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342092, "uuid": "dde8c210-7be8-431c-96e2-fd30bb3636ea", "comment": "Malware payload (Grandoreiro)", "value": "af9856fa9c4a712e299d72444be408bc8db28226476d392816ca9258b8e6ee6d3d1df0b0129d711c0b0bd6fbe6febb03", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342092, "uuid": "a8bd8bdc-11ed-4979-bfee-44aacb8ea850", "value": "T1A8662332AE554863C19083B0701F3E367F7D7B47878C94E7295CA4C72B96ED18A3E4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342092, "uuid": "bcbcbbfb-0e65-4a15-a6e0-19a6c83fd741", "value": "49152:mTXyo/EnLi8xUPB7aUk3x4O+zuSoiy2Y1tAu3pdIUplw/x0dxn0u/Wc4mWio/Xzj:YU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342092, "uuid": "7e01dd53-8590-4178-af05-bd4a769ad639", "value": 6963200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342092, "uuid": "7e31f861-5960-4fc5-a386-42f3e3f9cb51", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342092, "uuid": "94ba3a98-00f8-4d60-8c79-987707128305", "value": "224282528_FndXLFCU-2361rmvpj.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca44156-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1771312710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312710, "uuid": "6defc357-d851-4b47-900a-a8fa62108acf", "comment": "Malware payload (CoinMiner)", "value": "1710ea0e24bbd06cff4094c8f1ff9641", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312710, "uuid": "0893fafe-8b46-485b-ad65-455d7ca1096b", "comment": "Malware payload (CoinMiner)", "value": "2b02ac7e3a4fab94eadfc5a41357c13baf64791500de7f4583c6e6ce9e1174f4", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312710, "uuid": "14d39e41-fab1-4125-bd76-5a88c788eedb", "comment": "Malware payload (CoinMiner)", "value": "485e14181dbc2630dac704953528343fda96e820", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312710, "uuid": "42cfa69d-fc60-4538-9ce0-26728786f3ee", "comment": "Malware payload (CoinMiner)", "value": "234f6cf0c50175c4eb4b22a2b17ba1eaea8a11587e3df2c74d73a2e4d2b8be26238cd7a7801291523903b3a4c66ed5e1", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312710, "uuid": "bd434b14-e68b-4b2f-8551-01d6a5bdf160", "value": "T17796D79FA3D003B914B26214E58E75BEF312C47C5322D2282E5CD568326D97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312710, "uuid": "deb8e24f-8197-4775-838d-bf7574b18c50", "value": "49152:/IOxS3+GklR7lSz/8Zd9YrJZ4WWLaOmnNO1+ooYu3gzrIZIUw2GW2XRzSkNHkuAl:vdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312710, "uuid": "cd3d1071-5d4a-45a0-9e91-336ddbf420f6", "value": 8876799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312710, "uuid": "3da9b078-66b9-4c74-ac38-e6df88b5fdcf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312710, "uuid": "112dc797-4868-4b70-9e5f-47faf258bc0a", "value": "nouveau_curriculum_vitae.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da46761-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352306, "uuid": "376c912d-e795-41e2-a55a-0ffb706f287b", "comment": "Malware payload (Mirai)", "value": "5d66f07d4110f0281e4a35a20aa7ee0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352306, "uuid": "40f63eef-23fa-41ee-801d-b728ab28509e", "comment": "Malware payload (Mirai)", "value": "2b708a9f17a01575e41a26d09bb542bd7b7d889617af00091d447bf6b622fa33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352306, "uuid": "2a369064-dd5e-44ee-b025-bc26351a5a88", "comment": "Malware payload (Mirai)", "value": "9a1e6d67a76d076e141a79661e59a4e522da646b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352306, "uuid": "b61a783d-68f7-455e-ae77-bfff8036bedd", "comment": "Malware payload (Mirai)", "value": "04db77359c9ea79d00137b63edef252e5a197f1b8fdc657ddac2fdf5f3a5b72a8459f48207fd077a7267b8ba794dafe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352306, "uuid": "0cc8b426-3a15-49fb-8cb5-77b1d8e11ef5", "value": "T17D53F946FC818A06C5C513B6FA2E118E33136379E2DF73129E106F6477CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352306, "uuid": "86317f9f-283f-416a-bedd-7fabd67c493b", "value": "1536:MZniA5dB9VT22IrmE2RJqWhQczKvk6VnaPgJALBIkiQ3xtZWZ:ydptCm7vqWOczK5Vaj3xtZWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352306, "uuid": "a7c2901c-71cb-4ca9-8cf7-8dff823c39b2", "value": 63172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352306, "uuid": "cd5c5441-797d-456b-bce5-7cb35ca824cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352306, "uuid": "de733e35-7e49-4c9e-a88a-1ed23d750dde", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853a90d9-0b99-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771288941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771288941, "uuid": "36492e5f-049f-4884-b710-8c1c2cd4cb10", "comment": "Malware payload (Mirai)", "value": "dd22b3f69c9c79a287dfeb8f9e2d24f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771288941, "uuid": "23c92a3c-8198-44a0-a598-365f23b4a1a8", "comment": "Malware payload (Mirai)", "value": "2bdc4103f68ce6dee71c46dd8ea44051f820e5bbf14fbc6f929bd6307cbdcc3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771288941, "uuid": "de36d79d-c7a2-44bd-b2e5-ca0a55bcdffd", "comment": "Malware payload (Mirai)", "value": "e61aa41180d05bc8292747c00cef69fb0ed20ab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771288941, "uuid": "8d218e94-a790-4028-bd3a-4e1757d5138a", "comment": "Malware payload (Mirai)", "value": "8c8ee0d80d374e86d90b9322ad9507ec830f80c4c8ccf1447bc5b7c7c0c00c9e6e55875c09d92c56f84926784ca3129a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771288941, "uuid": "ed71ed6e-d16d-4a14-a391-6a86962e80f1", "value": "T1BA734A95B8818E12C6D012BBFF5E529D372663E8E2DF3203DD255F50378A86B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771288941, "uuid": "a21977af-6b37-4079-9e41-06244f5c3b81", "value": "1536:y4p0xJo6yNRAG87avR2f8RhzulCqMoPkIv5f8cDfXmoR8tOgT+VZoalanzv:y4p0Tms7QbHCgq9Fv5kOfXmeiwoNnzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771288941, "uuid": "a7c09da8-17af-4715-9547-b3d25583af75", "value": 76808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771288941, "uuid": "a6099836-9f54-498c-b8eb-997563bab2c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771288941, "uuid": "02efe602-5724-42cd-91df-58017c1712e7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b2075a-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349333, "uuid": "c227058e-a9fc-47e7-ad35-6866dda680c5", "comment": "Malware payload (Gafgyt)", "value": "e509f03a979975baa3cc18226007b4c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349333, "uuid": "d7101a53-4ca7-4589-ac8b-0dc634a11958", "comment": "Malware payload (Gafgyt)", "value": "2c183c1226ff7fb631bcdb92a8566d0d86c20c944ba509595e377fcab9d4002b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349333, "uuid": "97c3c5cb-b535-4184-b189-1534ed4433bb", "comment": "Malware payload (Gafgyt)", "value": "f71b85e901dde2b9b133c1015139db6b6a98c066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349333, "uuid": "d29ab136-cfd0-40a7-a287-a4df1384da5a", "comment": "Malware payload (Gafgyt)", "value": "afe45b9b112376fd0017b9edd7f94c5042cc8cf00b52aefdda0bbb0fa6751adf67835af5e3729f183d8a5977102d9487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349333, "uuid": "6bba03c5-7b2e-4947-8ccb-38171b663c2b", "value": "T179833A46AB81D6B3D14305B212A79F660033F93B1A5ADE99F35E7CF48F185C4B222F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349333, "uuid": "040a9239-7aea-4f3e-b7bb-788b942557a3", "value": "1536:UsfSa9AGjVGoUEJUScbUxoFfYrr3KjRcMo1B6Af88dCNlmOU+P9Fqg7mLI2VOYjE:Us79AGjV1UAUScbUOfYrujRlozBf8mDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349333, "uuid": "e8e50e32-192e-48b9-828f-e544585dded0", "value": 84905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349333, "uuid": "c792fa3e-f04f-4d5b-bf40-056489ac43ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349333, "uuid": "5a152727-446a-4346-8003-8eacd3299c8d", "value": "mips.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bff8da-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312397, "uuid": "d3116c7a-8fbf-4faa-9146-b2bd4c538262", "comment": "Malware payload", "value": "769dc0785e97cba2e161bd9a6260e377", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312397, "uuid": "2e2e21c3-7a3a-4ab4-8e58-f1625943e033", "comment": "Malware payload", "value": "2c877f822fa779670276035d79d697c9e6dc7d00bdadd09fed58b327d0f6e955", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312397, "uuid": "8be286ff-2b39-4f29-9f1e-68c506cc1115", "comment": "Malware payload", "value": "cbf5976e38d8722f44c0dfa9afaf8f697923356e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312397, "uuid": "121783cf-1cce-4a4d-9985-3c88d5f34d5f", "comment": "Malware payload", "value": "f601cd00a1a276c4b8a7ec561b2d3b1cd7de8b8e68b9a80cc426f00572a9472dc7c60ab1d2474db468b5d48676e40999", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312397, "uuid": "cf3c2d5f-b3e7-4507-b5d1-0fc5595cb09f", "value": "T17D45229D7927CF9C5BC0D1EFE465ADA89CC463A7068C3921AC0EA7DE6C011EDA911C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312397, "uuid": "910f7afa-3e30-4436-b386-f4a74e7d0687", "value": "192:XCtMkPOFxPCbxAUsZZjC5lIlJlFN1OklliSdtlXCq7qUiOX3ttkUemFyqXksNV6h:XCtTFIde+3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312397, "uuid": "1fcb76d5-ae39-4707-9d2d-bca9f29bfbdf", "value": 1183844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312397, "uuid": "071674d7-d3cb-4b72-a6c3-6c975a6a48c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312397, "uuid": "e69c07a7-cf1b-4ac2-a98a-af4e38a2dffa", "value": "769dc0785e97cba2e161bd9a6260e377.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304ca3ea-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349358, "uuid": "c3d7f86b-1a47-4e74-848c-ff7a5afc4f78", "comment": "Malware payload (Gafgyt)", "value": "c4802a27d2a0b725102aad8799a6232b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349358, "uuid": "1b5e59f1-3bdc-4919-8333-15c9dd90fa91", "comment": "Malware payload (Gafgyt)", "value": "2c971f396a473cfeeeaa949e63ab1a4611a13d31dec17632e1b0da169d2d52e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349358, "uuid": "3ebcaa31-1ce9-4d65-aebd-37297e874d87", "comment": "Malware payload (Gafgyt)", "value": "b8937e56f1446ae2b2841d7ec40e7309c67d79b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349358, "uuid": "f1635920-e122-48a0-b116-6952b455e591", "comment": "Malware payload (Gafgyt)", "value": "93961b4f1a974b2acc57328bffd3319348da3ab72aa3030e6af2e70faf37c46264ad85179a00a613ee97325990cfccac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349358, "uuid": "877203f5-3553-4722-91b4-b293b4def437", "value": "T17BB30804F8448727C2D327BAF78E439D7735566457DB33116A38BEB82BC6B982E29170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349358, "uuid": "c24e5135-ae91-44e7-bcf7-ef38cddc7495", "value": "3072:9lfKjGRicFHj2TJUn77agD3UmGVrQAXiUXouX:OjGF4JUn77fwmGVrQAXiUXouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349358, "uuid": "fdcb5d79-dfb6-4c3e-ab3c-e9911f37fa56", "value": 112657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349358, "uuid": "d4dd786a-4b89-41b9-b1a4-d6fb855720da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349358, "uuid": "6c6df15c-f531-4422-9752-84785003d09f", "value": "m68k.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8906029-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348405, "uuid": "1f455f78-7922-4750-9e21-3235838e8b48", "comment": "Malware payload (Mirai)", "value": "8f2c0d32fc7f5024dace9d00c9531ca4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348405, "uuid": "3739abac-19a3-4c07-8cd4-fd14a6885d70", "comment": "Malware payload (Mirai)", "value": "2ce4aebebfedf724061a123cba6430613878630f418d7a7e544d8e5717caecaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348405, "uuid": "4466bfa3-b3de-4c3e-ba0b-b8267fe5f7c9", "comment": "Malware payload (Mirai)", "value": "719f791456fe9e3425687824ac583aaa3f8a5be8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348405, "uuid": "73948151-82dd-4ebe-95a6-3653af251b56", "comment": "Malware payload (Mirai)", "value": "e2083e9963115e54ca8e169d52e51d83aa14a9cdc6f7effe707e1e8136a8afcb944b69fea11722c6d411c590fbc7ba4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348405, "uuid": "5f5b3038-92e1-48ce-8192-75fab79e02f7", "value": "T1DCF46C6377218F64E365D67005F387119E9521A30EF290C6A2BCD2207E6066D6E6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348405, "uuid": "fe404840-5443-4cb7-abe2-46c518e73961", "value": "12288:bpEPKmln4Dzrs61rwSWnWv48nGNmzzuf0eXbt0gp9kMToBid3:NwKm569Z48nG0uFXbtEeoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348405, "uuid": "1ecff754-9a6f-4427-80c1-a633b44e38e6", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348405, "uuid": "d91c618a-077e-43ba-aa2e-3b23b22a761c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348405, "uuid": "13c1a8c3-5fbd-4134-8ec6-cec42f481f6d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5ad35c-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771343501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343501, "uuid": "6e05538a-e5b2-44a3-b66f-1377bcee813c", "comment": "Malware payload", "value": "793c485e036f09c6868ef430cdf21eed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343501, "uuid": "8d6d84bb-e6e1-425a-8ce2-e2b46373e729", "comment": "Malware payload", "value": "2cf0314fbf743eec4dcddec6f4480e4a5a11eda4df0898ee2683f216081d653f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343501, "uuid": "3f4a6083-633e-4a2e-9911-f35e89286d93", "comment": "Malware payload", "value": "e420e271a6f562f0716305bf56d9bc835651973e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343501, "uuid": "fcd21616-184d-46c6-94bd-6935b432dd9b", "comment": "Malware payload", "value": "e0bd7c07d1c7571f0b32d2edff5f45afa536510c296f966ca861e6695eff77dcbf2eba0de256a46d06076ec35559a943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ShadowRoot", "colour": "#E5A954", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343501, "uuid": "f3b29539-01f9-4eb6-852e-2264f059c999", "value": "T1E405E7247B949E41E544193F82BE2618D732A0F22313AB47370BF7615D44AEEED2D3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343501, "uuid": "05ae3138-15e8-462b-8864-13d3959e0373", "value": "12288:WK6rq5ioOVHj4h0RHhEUxVHEiiwaAbw0nXaR+:/4DD4hOEUxVHEis0nqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343501, "uuid": "12389105-a21c-4426-a4e6-32dea6ec7b2f", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343501, "uuid": "c21b8979-3809-4dde-a750-98d4a40a8e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343501, "uuid": "e2f4cd4a-31c9-4d1a-9571-a82a6b77fb89", "value": "2cf0314fbf743eec4dcddec6f4480e4a5a11eda4df0898ee2683f216081d653f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252d7d49-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349339, "uuid": "e5c3b2cf-c977-4b98-ae61-781b34544e91", "comment": "Malware payload (Gafgyt)", "value": "88e02cc5d09f71071a01ef250b3c95d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349339, "uuid": "dacba6f5-9cbe-449e-b4ad-2a66ed69ea3e", "comment": "Malware payload (Gafgyt)", "value": "2d26a137057bec40a07c4cddd7e04587b11e8222d6b0800163f1a24264ca2a0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349339, "uuid": "02367b68-8634-441e-b5a0-8756743f74c2", "comment": "Malware payload (Gafgyt)", "value": "24b4335f6f8b104d16b75848fb17f919937e1e8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349339, "uuid": "b8c3616e-d2c0-43eb-8294-107718d9a379", "comment": "Malware payload (Gafgyt)", "value": "b433d4b60c7a6969d4b7aad7b8346c0649e6a20b78e3ff306550145b66200f7b9cf16d0e526f455a8ab679fc8cde4397", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349339, "uuid": "baa9f4cb-2ccb-42d1-868c-fff334e9b2d0", "value": "T151D3C55AAB619EBBD81FCE33059A4601248DE64682D97FBFB2B0C51CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349339, "uuid": "81240de5-9e72-4ef0-ab7e-e16d548bbe96", "value": "1536:EybeTzNNT9DERkLMurNpZ3efJp68E1wYqijd00PUmkVmSFxBC7vXZX:EyENNRLlrvJF1tjdlPUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349339, "uuid": "9b8dc07f-eaa2-4eed-9cd3-f8fea3504bd0", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349339, "uuid": "d7a690b0-184f-4fab-898f-4e599ff0d177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349339, "uuid": "a0cda4e4-c5c3-4f42-b726-056dca4d03b4", "value": "armv6l.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5e6050-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348412, "uuid": "2392eeef-10f1-444c-853a-3be66cf5735b", "comment": "Malware payload (Mirai)", "value": "ab2d6dcb3089d4eeafcf29039e8d2af4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348412, "uuid": "8cc736bb-426d-4d4f-9bcb-a0b62267ef58", "comment": "Malware payload (Mirai)", "value": "2da23c54278f79a046b8a64c90f2adc374e80bd11362121c65b951824f13f084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348412, "uuid": "b2c19f5a-c60d-44cc-a153-61d01722f5af", "comment": "Malware payload (Mirai)", "value": "a278bf40b7b4332209f3b6176c201e5f0f6ac418", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348412, "uuid": "95a6aa80-cf21-4811-82e6-2fc678978cff", "comment": "Malware payload (Mirai)", "value": "36a5ae062eab90df4cd73527a8fadf019f20750517aa04ab76719dc6d1f5395c022d957b003571b6ff3f84a4bbbbaffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348412, "uuid": "8d4f6b1b-98d0-4944-b7cf-276fa5f72d99", "value": "T1EAF47D59FE4E3C41E3CBE3789B4E87E1E22FB190D32351623981534D94C6AE9CBB0656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348412, "uuid": "3ac11961-ba88-43f9-a8b6-ee4d3d9b88f8", "value": "12288:GA8gXcv9wvK7ktrJHbyMYF6auLV5X4Wqv4Bw5lmtKi:hjXrK7UHZy6f5XNTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348412, "uuid": "b3310afc-41be-4a51-aac2-25afd9788087", "value": 729320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348412, "uuid": "4cc772dd-dac4-42a1-beb9-ec93de2836f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348412, "uuid": "c42eeb04-a76d-488e-b8a8-51eea14220b9", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe49c9b3-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356575, "uuid": "a4f8a503-077b-4fd6-8225-4a5075a095c5", "comment": "Malware payload (Mirai)", "value": "2e2094871ece33bee6374ae06c75f9ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356575, "uuid": "d3c5c704-1666-41de-adda-56ac0f037aaa", "comment": "Malware payload (Mirai)", "value": "2dabe2478ce51bfcc86b6626d5372f159881a413a7449ba128e62b8e9e733329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356575, "uuid": "160f557f-e2a1-4db5-8d5e-1973e072d359", "comment": "Malware payload (Mirai)", "value": "7a294a0113f13731ff76a43ac0b59b03f2aba3ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356575, "uuid": "496855de-cd4f-470a-93fe-8e8faf22adcf", "comment": "Malware payload (Mirai)", "value": "cf5cbd12c09bd5a189a07dbce259a2bd1d1d5901b5cf795e95942bdeb14201cf71d5cb8b0420fb4a29eee67cf26deed2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356575, "uuid": "6d92c61e-2ec0-4757-a160-47ea5024c022", "value": "T16A933B07F58180FCC48AC1741BAFBA3AD822B1FE1278B15B77D0EB122D99E511E5DE90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356575, "uuid": "12aa8566-4345-4eff-860a-b298660db413", "value": "1536:ela9bWSZKwZnbFCssOxaSc+1OtUo4ygK5DKQUL1j595zYkTcf5qc+fPGIJzeyY:HWQKYnRZySc+1hTMDKB1N95Jcf51+HJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356575, "uuid": "d9f33a99-cdbf-424f-8740-e743c1bec6da", "value": 89888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356575, "uuid": "2b125202-752e-4694-b4dc-14c4e83177bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356575, "uuid": "3509dd3a-eff2-40dd-a3d2-90d7cbeae190", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006abf5b-0c37-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356579, "uuid": "29289fda-3080-4b4e-b24d-5d3892c35121", "comment": "Malware payload (Mirai)", "value": "0812cf1783eaa2c1fb3ff7569539f194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356579, "uuid": "5b445079-a4e0-4fdc-a53c-730cd37b26fa", "comment": "Malware payload (Mirai)", "value": "2dc2d754cbd7c185e97dfd538e8c369719b5ce2890fafc3cd73bd92cc0a68643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356579, "uuid": "4720d4f7-cd94-441b-9078-dff94b4726d5", "comment": "Malware payload (Mirai)", "value": "70f736978f60bca4ade6a3a04aca5a1b616ebf67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356579, "uuid": "1446618d-63ce-4761-a285-938eee0427a8", "comment": "Malware payload (Mirai)", "value": "bf2c69751a2688c50bc713df06578c6c43ae834bb0b86b8a6e7e3906f765a90fb4308539c9a496e88fc3ce0ada0fafb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356579, "uuid": "c69c5ca6-2ce8-4970-965d-7eb28ed577e4", "value": "T19E836B91F68B80F5D017487000ABF33FCF32E5A54161D65EEF698F36EE63502A512A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356579, "uuid": "def0ddf1-117b-4142-bc14-cbc9590c283b", "value": "1536:i3vrelsAsIyV+C+KuGKdwi0KWZ4iRcgvjcqvkC+t/zrjA:evrelsA3yV+C+KuGkFW+iRcgvjDvkPjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356579, "uuid": "50f2e833-254f-4cac-952c-fb56ad435afa", "value": 87536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356579, "uuid": "9744f4da-7ffc-48fd-819a-4d0c30ad67e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356579, "uuid": "8aa1d6e9-3a2a-4c16-951f-705582579ede", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b014345-0c3c-11f1-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1771358986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771358986, "uuid": "8b51bfc4-f9b2-410f-9465-3cc0fa0b4f4b", "comment": "Malware payload (Hajime)", "value": "545134facd8895dd8ac9487f023f4e80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771358986, "uuid": "f429d85b-4b4e-4176-84ce-28ff1acc26c6", "comment": "Malware payload (Hajime)", "value": "2dd81bd16e851c6c22d5be7581ff3c9cb437be81f3a3cc6e73263df4102fbdb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771358986, "uuid": "ee99b4df-ba8c-48ed-b8e8-02b2ef95cd07", "comment": "Malware payload (Hajime)", "value": "5c53e991aef65f352e334fce0375e1e6ac92dc7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771358986, "uuid": "03556843-69cc-44f0-9b1d-95a5d39062cd", "comment": "Malware payload (Hajime)", "value": "0ae512dd92aa5bd43510268cd2a51437ebb83af03424cea383d66dc5ea8d6f74458a66d991fc6722db80892e1a3db5a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771358986, "uuid": "b5e193f7-36e5-4a78-bc5e-05d887bfc5d3", "value": "T18973121613A9256166324AF0E7FE2F88E64D6B6C8FF1AC24BC117CACE93335D1CD5518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771358986, "uuid": "3b7a4869-302b-47e0-9dd9-3d3ef3789f85", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/Je:yYI0ARqw1qAEv7UIFM8oJorFquyjkRku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771358986, "uuid": "385d649c-bfdb-4831-a671-66e658ca5ad6", "value": 77024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771358986, "uuid": "7e153719-6cee-4ad6-9c5f-3db7d78ddbd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771358986, "uuid": "756d0798-f560-48c2-9284-68d4ff6a3baa", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412084ae-0c10-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771339937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339937, "uuid": "9d3804ff-fa91-48a7-b0be-fc3dc1f891c8", "comment": "Malware payload (Formbook)", "value": "0507c59803bccfba2c6e91a08a763f9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339937, "uuid": "09219b55-f63f-41e0-b27f-7e6ed1ba9c4e", "comment": "Malware payload (Formbook)", "value": "2e0055261615c13e5efadd2fb5137d62e24dd82cc0cc4a40e7f2ee759fdb85cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339937, "uuid": "83217f84-d7eb-429e-8852-fe2f9bcc1159", "comment": "Malware payload (Formbook)", "value": "2f782f5ae009eb11bdbfbe034d00681e10fb195b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339937, "uuid": "0ca14499-258f-48d3-8a9f-856b646afcd4", "comment": "Malware payload (Formbook)", "value": "05698378d3218615f6fe261d53515993815c315b57f4f8219dc13976aed90ef97d2ef180db25f03ea20d03a10379ae4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339937, "uuid": "adc09e0b-77df-42e2-9672-d083333b94f6", "value": "T18A551258276ACD02D4BA4FB02971D2B087F55E4AA922D303DFFAACEB743A7511D45383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339937, "uuid": "fd420812-5207-487f-adce-347bfd92a545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339937, "uuid": "91ab6519-35d1-48d8-b1d9-d392cf52c0f9", "value": "24576:zqu2VNFx3tArtwoqFHA5jiyWO2j55Ilh3Unx1anIrygo5cyrfgs59KVBbp:zeVNFxdAJwnHAViROY+/3E1acAr408VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771339937, "uuid": "a19dc612-e4a4-4d93-b0a3-11e2a8278983", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771339937, "uuid": "daa30622-7de8-48cc-b165-c7c7004f52cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339937, "uuid": "fc5f5c33-1120-4b9a-a00e-2aa2c5778196", "value": "New Order - VRFBT2025ENG037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b185af-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290551, "uuid": "028f54d1-44fe-4ed3-b088-bc482949fdc4", "comment": "Malware payload (Mirai)", "value": "7538028d9303dd42af1255da0f961779", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290551, "uuid": "c36645c7-aa9f-4ef7-ad50-8da7f8d4e274", "comment": "Malware payload (Mirai)", "value": "2e56c5a66a1444bd7a69ae6a3fab12c7899da9d7395f72fac7ff3e226edfee27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290551, "uuid": "c4ce7d84-23c9-44eb-b065-a5d40630344e", "comment": "Malware payload (Mirai)", "value": "816eb1ebf54a9aa0c89f684002450a7f24029dff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290551, "uuid": "af5bd5be-b9a0-474e-8adb-267080ec22a3", "comment": "Malware payload (Mirai)", "value": "76c5acbdb6c2ec054ddbdc8f3417368dfb89ebf3d16c8f7fedacc86701441c77d91117095b76fdb3ae5fd63c0550db7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290551, "uuid": "4bc57aa0-5dc9-4127-a533-8fd6115f1d40", "value": "T110235CC5A147D9FCEC190A712177EF319BF6E93E1198DA83C359AD73E942602E5032AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290551, "uuid": "5b6f186c-01f8-4caf-9cb7-2a1d4fc6714b", "value": "768:r+WtjNuFWGttXEsLk+sd6bVHUzFkZsMWfd/0A6SDZkqAI:r+csttXEsY+sdWVHUyZ3WV/0A6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290551, "uuid": "d012c9dc-cd5a-43db-8279-643bcb9c67db", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290551, "uuid": "c27b5449-658a-4af5-ac88-8539d0189836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290551, "uuid": "501eb1ae-e89d-41ca-a19f-c0b154d30eda", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68781bc-0c20-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771346979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346979, "uuid": "091877fe-c8f4-4b7b-8d18-2bd4c3d81175", "comment": "Malware payload (Mirai)", "value": "1a999c725f7e317160dc47249dd856db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346979, "uuid": "9c72f439-2d61-492f-a378-a8a5841f0736", "comment": "Malware payload (Mirai)", "value": "2f2d721db46d14fb8d759b8b6f49c28b44586ba89063085528f57fb618783e0e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346979, "uuid": "f499106b-25b2-45f5-9998-80b69ef1e97a", "comment": "Malware payload (Mirai)", "value": "4a49adc25e2fc53f97b7eb4948099a56e9645231", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346979, "uuid": "0dc1d8fc-8939-47f4-b4ad-a87717590ae2", "comment": "Malware payload (Mirai)", "value": "f28c9d16dbd0d1a463501fa59f8d39b1ee1673a1fa46f156bc30c0412703940a99ea4cc007e4906c69e0296b0fe5b468", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346979, "uuid": "4df9d5fd-f87b-426c-8df9-f8be9fde8758", "value": "T1434194CA279174756CAAA963F3B906187580A8C516F86E445BFC78F4C48CD24FDD4A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346979, "uuid": "bb67d156-9e1c-43ae-b04f-7d110489827d", "value": "24:v0n6yd/sF/sc/s0kTld/sGKM/sPG/sn/sgJHZ/sp/sUKlh/sY/sk/sePeH:v0nVGur0kxGG0PR0gHKaUKc/zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771346979, "uuid": "e6c3810e-bbbd-4388-a999-3fda55a4bcaa", "value": 2002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771346979, "uuid": "a1714e66-0087-464b-a7f0-44d6d649906d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346979, "uuid": "cd063ae5-4da5-48f4-aebd-fe3238cf0279", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c2a7c8-0be2-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320463, "uuid": "59c9869e-5d37-4390-b198-9f1c50723a6e", "comment": "Malware payload (AgentTesla)", "value": "986f443485f22fc1424f424d6b1fbcad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320463, "uuid": "d6e32134-6ca3-488a-93a6-20a1c2e6fb6d", "comment": "Malware payload (AgentTesla)", "value": "2f5b016d760e3a61a193909474130c16d16ebba9fe7a135164d7db431ac25f7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320463, "uuid": "2ee3c7aa-2325-45df-9713-645b364b4828", "comment": "Malware payload (AgentTesla)", "value": "9040f1289b6b0791b8981facc0ca23c8ef32b13a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320463, "uuid": "fac65e16-ccb0-4759-9d1c-7e849d24f877", "comment": "Malware payload (AgentTesla)", "value": "98097ae945bc380e5bd0f95aeb9db6de80df4f1697992b80f78a1afe68cdc3f336ff383e0856e3910f1e8151a596a566", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320463, "uuid": "77b59426-e088-45e0-b31b-46f877c96d56", "value": "T170D40131780C8722CA6844308477BB26C77E5BAF7BD57E5FBB483D543A767813A16A08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320463, "uuid": "5dbe09f8-23e5-4863-898d-276b708ca745", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320463, "uuid": "83c4464c-0f7c-4040-ad6b-42c5a6c168f0", "value": "12288:RTrTMrhP8tzE47E9tuE83azDjLrbnPJf5kiKV3FNkaoiMOKS69:RT/mPXrA32331f5kTVVOaPKH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320463, "uuid": "a75ca670-439f-4c98-99e6-1d67b07b9e5c", "value": 633824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320463, "uuid": "f4c23a3d-8c4d-4a9c-a454-36897b0e709a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320463, "uuid": "daa7be1e-b7d7-416f-a6d8-eca11768c316", "value": "2f5b016d760e3a61a193909474130c16d16ebba9fe7a135164d7db431ac25f7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656446d9-0c33-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355030, "uuid": "e122c061-ea6f-4c98-ae62-5442d234aac7", "comment": "Malware payload (Mirai)", "value": "c32e8f6b5f4cd9b11a270541b1b02323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355030, "uuid": "ce71890d-2400-4a66-98da-8c39613aa8bd", "comment": "Malware payload (Mirai)", "value": "2fa26a7892c3f99629c5589e384751b5cf5a18d0fae036b38cfae06ef9384f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355030, "uuid": "497d5d4a-376d-4001-a434-cf2fc16b9081", "comment": "Malware payload (Mirai)", "value": "6a136cf8ce7e0103375ab658d496a948135313de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355030, "uuid": "13dac276-428f-4f3b-b5af-8fb370f8cb7b", "comment": "Malware payload (Mirai)", "value": "d5afd34c59d0152a7851c4679d915f42fae3c37503519878ec98bdbb2978c8e32535379aa43c46959ae5af6b49c4e334", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355030, "uuid": "7e9986dc-d5dd-4fda-8b06-61c2364d5c24", "value": "T1E992E1729761BC71C3A14833D27CC6873A76287484EE3B37A24C2464BB8BD075EF14A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355030, "uuid": "3fe311f4-6dc2-44f2-abfc-b270fcd0866e", "value": "384:ZoMonikH/nmKDTxN7rjkm266MLm511BzDo+x2KUZ2n/EM+9KhymdGUop5h7tc:enBHfzD1NLk+6MajzDoc2H4//Xs3Uoz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355030, "uuid": "e69a0aca-c2d1-4c3c-83bf-78dd57cbcc1b", "value": 21216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355030, "uuid": "80a1b0fd-660e-4e44-901b-f38d00fe8ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355030, "uuid": "551e3d2f-e956-4a84-9127-f323e3a82162", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dd3b6d-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342150, "uuid": "48e08a19-89df-44b9-b021-9a28dfda0abb", "comment": "Malware payload (Grandoreiro)", "value": "379d51f2b6b115bad449445a8614a30d", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342150, "uuid": "ebfe4d08-1596-438e-8d6b-3045e016e52a", "comment": "Malware payload (Grandoreiro)", "value": "2fe0281613eb48387f2ad37a05665a3d2abfbba5b5b693cbfb9cecf8309d5eef", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342150, "uuid": "2a5a3f32-a7c1-4510-a163-2bb5b1b6192c", "comment": "Malware payload (Grandoreiro)", "value": "669fada81d870b8f4f399746ba721cf6b4b5db1d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342150, "uuid": "b5c536b0-d531-4bbc-a286-144ea26dcaa4", "comment": "Malware payload (Grandoreiro)", "value": "0db9a28c69e717c13701377168e6824058b430024c45af63e073d6855cdf9dc9adbee495521d027ae4c6af4cfb11f264", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342150, "uuid": "1b1aa01b-c0a9-48f6-b23c-3bf4b0ffd675", "value": "T168662331FF921C7AC6618734706B3E291E3C65438288D9E3719CE5873355ED15A3A8BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342150, "uuid": "f3c6b3ee-6c35-453d-8c1b-d579d0d406a5", "value": "49152:GAYftJQft5r7frPmWsmhu0E200h8kDpXERHAruEteVUuUgD3Rn1AW6Pu4qy8Q4h8:uuim3YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342150, "uuid": "96c59f0e-0204-4c34-b8f4-a87d4db6bfe1", "value": 6696960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342150, "uuid": "ba971600-83ff-4a74-ac69-2c384acb8efd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342150, "uuid": "4014fce4-c9f7-4e33-9db4-a56576900e80", "value": "44546H1U9VGTKQKA_Grn-609449nnmxb.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ed6709-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352322, "uuid": "91d00ad1-b402-45fd-b4c8-3d4c838591b4", "comment": "Malware payload (Mirai)", "value": "65869836b714dc49a01dcf63675ea0c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352322, "uuid": "52ba569f-1d9e-451b-b599-48498f325182", "comment": "Malware payload (Mirai)", "value": "2ff2038b6a6e299c63f7ea6997e8998c8d9193740cd48c20875c814b6bc967e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352322, "uuid": "0ad389a5-f53d-439f-98a4-b7ec521c465a", "comment": "Malware payload (Mirai)", "value": "30c48e279cbbe911bdf836bf35cc83ae5430778c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352322, "uuid": "2694e16b-a970-467e-9b87-6b76e5fcab02", "comment": "Malware payload (Mirai)", "value": "fae94996fdaa84ace83e8544a7876c46a1cc172f96d0a81e9762bfdfe174150b29a34ba70a4fe5aef94f7753616836b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352322, "uuid": "42642f4a-4ecc-4acd-b3f4-0dbc210e523b", "value": "T18173940E2E619FBCFBAD863587B34E209248339626E1D545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352322, "uuid": "767f6e72-1879-4286-84de-56e6ff0da9d5", "value": "1536:b4Z8VUay6+vl/R1KIdysUmR9EiYHXwgNNN96MMFjDETBK:M6Zy6+vdGIdysUKoNN97MNDIBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352322, "uuid": "5880c1d1-d7bd-4b85-8e59-6a3460049956", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352322, "uuid": "db3fbea7-e2fe-4060-be9e-556646b311e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352322, "uuid": "3a982660-c856-4e7a-b230-b93df3945b5e", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6584d538-0bcb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771310363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310363, "uuid": "a8054f1a-c871-42a3-ab89-47372e3555f5", "comment": "Malware payload", "value": "353b33b62cc381fd0adbd8a3ef1e238b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310363, "uuid": "c2b9ce84-43e3-4e15-928d-dd307f94e192", "comment": "Malware payload", "value": "305abf68fcdfb48170753bbf117216cf8a552a2bdde3e8ebc04a2b6c3e030452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310363, "uuid": "b5f1f064-83b3-4c2b-a8e3-538d6fc84a7f", "comment": "Malware payload", "value": "757ef42f429b4153139500c8ab81b083105c7279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310363, "uuid": "9ebc2131-540e-48d1-bc00-ed8344622ea5", "comment": "Malware payload", "value": "ca35a78b624a555181e28c08190b6274f014584f01943db8495afa0c2fca5de6c791031e12e22b37fd53dff47b1dd65c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310363, "uuid": "11772d34-e83d-4660-93e0-ff71e46b804f", "value": "T1A917337A354294B2E3D1D3FA9F01B0412BC379B84964F62FF34C2916EA11CE6746937A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310363, "uuid": "db836e0b-0541-438f-9bfb-57249cc8818b", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310363, "uuid": "0964cedf-71bf-425b-a6b4-d014e2e4d6b8", "value": "393216:Beea7fJsF1Gmmz2el2qzQrhzxkl0BwKM70eulzPAMoJ3zVwmZDRM/tZ82:BeeWfc1Gm8x1ot2K+dulrAMoZVtp242", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310363, "uuid": "6b11cf76-14e4-4660-9cec-d32f2abf0e43", "value": 19427384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310363, "uuid": "54dda7d0-7771-479d-ae6c-b00f2480728a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310363, "uuid": "b4689a71-6278-4d48-af28-f2d8451d0edb", "value": "305abf68fcdfb48170753bbf117216cf8a552a2bdde3e8ebc04a2b6c3e030452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db40315a-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343202, "uuid": "4c62d34b-4957-40e6-b57a-7c012d8cf008", "comment": "Malware payload (Grandoreiro)", "value": "9dd96ce478d24492ad7bdde56fe6966f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343202, "uuid": "b29c0007-9cd1-4507-b77c-edbf76f13458", "comment": "Malware payload (Grandoreiro)", "value": "30715ae26588a25625e2b793ba4bd8a4f03aef62d54b6f3f8acc92059e7ce2c0", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343202, "uuid": "ee2d2540-f3e2-4862-8fa3-1be482945559", "comment": "Malware payload (Grandoreiro)", "value": "ca3e895a95a3cd13659d959b69c9699c768e0b4e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343202, "uuid": "d6e36f06-2e62-42c9-a9bd-18df860e6b62", "comment": "Malware payload (Grandoreiro)", "value": "9e0a6440f547c88efd5bd99ca9db8c018f8f63a5a5a684cfce0a98dcbeccf1c7afddc890bce5af13a95572431d11af5b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343202, "uuid": "6c3d60b8-80a1-4d9b-871c-854d3e114170", "value": "T11F462335BA80AD2BC3500372753F2A356EBC771B49C9A5E0758CD6533B02EE29B6F485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343202, "uuid": "749231a1-ffa3-489f-b224-9629314e8f67", "value": "49152:C4d83MzI9aoqcZGXkuy1bk7f2D0lqnV/mOnXHZEdY9yg3ukRZJHrQvfen+m48CoY:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343202, "uuid": "3cc0e27d-5dcf-4044-a6a0-2ebb28b6f435", "value": 5406720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343202, "uuid": "61bb416c-bc57-4b3a-9a90-256a60b50b4a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343202, "uuid": "83ac1671-42cc-4c52-aae7-0dee06ae1cfa", "value": "FljUYMMPR4705-3E7EMMGABR.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b99b31-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312804, "uuid": "16b4fd42-6b2c-4fb4-b378-739d9c9dd444", "comment": "Malware payload", "value": "3cbeba9590d434f8b3ac0b8830297a8f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312804, "uuid": "d53ffe04-41d4-41c8-b678-9460b7ad68cb", "comment": "Malware payload", "value": "3076b893b53adaef70b5efea711cb7a9c628fa20d782e1031345076179615e61", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312804, "uuid": "8b2494be-e3c1-4a6d-9af1-7f9333c5d212", "comment": "Malware payload", "value": "12a3a75ab14291ce4e795cc3c5f94fc3127e98b1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312804, "uuid": "6bcd9439-cf47-4567-a013-26f8878f69ca", "comment": "Malware payload", "value": "b9a19ea2fed9bc26721bc35c7d59ebc0330a4abc3158a5888c71d7491b43197856fccf01804264d2b4622d7a6224bf36", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312804, "uuid": "c4a815a3-3cdf-4d19-9113-01fa296a74bf", "value": "T186763370BB532D7B0AA4872A705F9F262FAC1E9348CDB4D68295F0D6224E785857FC70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312804, "uuid": "c3fe381b-0d65-4f67-836c-29b3c19e9257", "value": "49152:Zrwr6uwvZtpFBBXUS/eh9QQC7XcgiBZI/SgBXHBKoUNNE4jYrynkgPXIZoHcLSzp:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312804, "uuid": "c376fa62-0f10-4ae2-916e-00e63baa2a13", "value": 7181073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312804, "uuid": "88f66df1-73f3-4d77-ac15-38a69d55ca56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312804, "uuid": "16cdf224-eae5-4e9c-ab9c-8793631a5535", "value": "Acuerd28XA980448_GYKLN7ARTkzola-0Cita864943.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc459901-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343258, "uuid": "cdecfde5-830b-47ad-9386-2ba5a25c4f97", "comment": "Malware payload (Grandoreiro)", "value": "ff7a0fb1eb6aa512c7f6a654522df9bc", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343258, "uuid": "29d46cd1-1854-4ae7-b290-a459d8150a26", "comment": "Malware payload (Grandoreiro)", "value": "31ec06d2d4dcc2e7b948fece8d3710c1404dc08c5c16cb83ed1fcc86bca982dc", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343258, "uuid": "e55b7383-d521-4a19-8a57-fde82f8e9921", "comment": "Malware payload (Grandoreiro)", "value": "c039895861a26ae70670b0114daf7705e0ae73ec", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343258, "uuid": "e2a1a401-204e-464e-a0f5-671d19318f21", "comment": "Malware payload (Grandoreiro)", "value": "4739df380b27594790c3af2d532f57291cad688ae7e5f7d5eff4b1b87c0f6e0b01fb3294f4ddd5d0449b4d33c37197da", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343258, "uuid": "61fa7ed4-6fd8-445e-b741-f729177a4e9d", "value": "T1951623325F445C26C4C18730B42B76326F7E760341CCA2E638DCE29D379AAE6576F896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343258, "uuid": "61f8ec1d-39d1-44e5-9f0a-7049443f4dd6", "value": "49152:niZRIq1EKZjV3rYmJ3I7KQQDc8JUTceM2GgB+ijxyENbYtF:2tF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343258, "uuid": "0489bf00-1f3b-486d-be1f-0f7d5312871f", "value": 4251648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343258, "uuid": "e5faae56-04b1-406d-a00a-652f71db0b8e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343258, "uuid": "330253fc-ff8b-400c-8469-8a37054e23ef", "value": "HCNAIT9XA9426935_Hst.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16d195b-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348393, "uuid": "22e32f9e-ee6e-4330-b8b1-6461f9633a4d", "comment": "Malware payload (Mirai)", "value": "627ec9f1c616669513ead462d8a83bd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348393, "uuid": "cd06206a-1d24-4882-86f5-a407a287c773", "comment": "Malware payload (Mirai)", "value": "32010a8966f216bbc585ddfa46ce81e12c986aa330433e5ef1d4c22bf939761e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348393, "uuid": "a3436d7d-b1ab-4035-a4f6-eb9fc9279996", "comment": "Malware payload (Mirai)", "value": "04808fb876734dbb6d432e6a1b78975c447525a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348393, "uuid": "0dcaa120-c7ba-4e67-83e4-7640517b62d9", "comment": "Malware payload (Mirai)", "value": "910b41c0f078289332a134ea0ccc598d74f622afa2eae174947890ea4835d128bfbf29e391cf71031bf8f192d0a2e739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348393, "uuid": "63a8897f-0752-46e9-9753-f4c57d9e4f55", "value": "T139158D2AB2B3F57CE00BC03457DBCAA25535F07522212DBB26C4DA353D6ADE11369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348393, "uuid": "3f851534-cea0-4765-a7c5-839c2867f15a", "value": "12288:SF6kwxNggj4PYrdvHYX+73+SPmh/U1OTVWa3yObfaLqoqWcayUH+cd3HX:Q67xNggMPCNElZt3yGaM2+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348393, "uuid": "3848c71c-e256-4997-8fdb-4c7538b30df3", "value": 957256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348393, "uuid": "7b80f882-f4bf-4f6c-8454-b73290c1106c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348393, "uuid": "3df8e178-67b7-4baa-ab30-5b7d59135ac8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f79260-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352667, "uuid": "94b4c609-8cf2-435a-82f8-3d1fcfa4eb6b", "comment": "Malware payload", "value": "2b52b07a7dadd3798cdaed28891ba0ef", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352667, "uuid": "4048da21-9afd-4042-9996-789713ba72cb", "comment": "Malware payload", "value": "3209f5de0e8dd52b3cbcfd135e71f23ba2d130d08ff2bfb8abed0b77d19fa167", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352667, "uuid": "bcb23c43-d69e-416b-b113-3b67f938e7db", "comment": "Malware payload", "value": "c7777eaaceb562bedf85d1f9ed40abf4a8528046", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352667, "uuid": "c49985e7-b965-4831-a6bd-a01908358957", "comment": "Malware payload", "value": "adb6ec394ce84c8921379d16183b04212a69ad50eabbe37caf60d0d25c24ca0a6669e05d810229fde14bba85d0e352cd", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352667, "uuid": "dbe2fe71-8a62-448c-b465-259a59a0a823", "value": "T18A663330AE591C69C59403BA722F2D3A9F6E7603418865D7356CA1873B0BFC39A3F8D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352667, "uuid": "c128907e-09f7-4798-a3e5-e12d0dec5898", "value": "49152:49FAU7ehywC8WZlXoM1Jyxn/NCPE7xvASQ6EgWl6Qg0s+Lk9/ZgsKnWVSlR92Hui:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352667, "uuid": "0fbf6bc5-dc00-4990-bb41-c797af1692d3", "value": 6699008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352667, "uuid": "19a60f94-b7a7-40c8-8a0f-d5e0c1860fe1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352667, "uuid": "e5fe366c-539f-49c6-9dab-34dc7fab5794", "value": "TxAFMXA9802438R14_Dcla.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d494aee-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300820, "uuid": "6ea1ea7e-9282-4c25-9778-b2d94ce57408", "comment": "Malware payload (Mirai)", "value": "43f0c98e1b7aabf75ccfb278714b8ba9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300820, "uuid": "814bd583-5157-4c01-8c51-bbb3895fb867", "comment": "Malware payload (Mirai)", "value": "323cf396b87d5f2755d4b8fb3da27174f2ca6ccfad1e55ffbd9cae1e9e457475", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300820, "uuid": "b2637e4c-da47-4ed0-b214-815272396fd8", "comment": "Malware payload (Mirai)", "value": "9d60d1d71fbfe0a4df28afed024fab846aca5339", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300820, "uuid": "7b413ef8-2d88-4c95-a764-3946b79f00fd", "comment": "Malware payload (Mirai)", "value": "b1a576601fe216bd349974c54acffd691e9651d076ece455184e117f5683ce86dae4af07cdc06a9b9f399c4c797517a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300820, "uuid": "82a5436c-3cbb-46a2-88e6-e3585d9fc366", "value": "T16C513AC682E40D382CA36A13E6B7E16C76C9945229FDFFA5D9E4BEF0065EC503940753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300820, "uuid": "fd4b092e-cfba-4ee1-9138-05d095a3e8db", "value": "48:ve7t7N7heE6GegczPe0KWeKoUe7K7o7Ueff3be99Re2cgexpVecSOew+CevfTeHg:ve7t7N7heE6GegczPe0KWeKoUe7K7o7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300820, "uuid": "68c5edcb-d519-4dfc-95bf-6e5294b2af81", "value": 2910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300820, "uuid": "6ff381fb-34ad-42a9-b873-fa11887a39d3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300820, "uuid": "7e899bba-18c9-4a92-a376-e841ecf6847d", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414c5c0b-0b9e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290975, "uuid": "118ca75d-61d3-4ec9-91ef-2617b8b5cbed", "comment": "Malware payload (Mirai)", "value": "fc49baf77bec8876df0155f5b51badbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290975, "uuid": "a729c978-6aa2-45bb-bff1-cad34d775ece", "comment": "Malware payload (Mirai)", "value": "33048b7f4686cb317be9e97d71955bacd9a175f36a2c1566bce9f088e425f6e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290975, "uuid": "56307093-513e-4cc1-9baa-63a334cfbe8f", "comment": "Malware payload (Mirai)", "value": "c7d29580562811a6d9892aeeddd07f664cc241b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290975, "uuid": "aabe1b8a-2481-4e5c-a026-1c5fc660a892", "comment": "Malware payload (Mirai)", "value": "574eeec9e59b019b6a8a140fc7902734ebeacfe63aed968064aadda0035a0a996a80a097b40f108e8334502128de5666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290975, "uuid": "9f81fea8-5a44-4ca7-889c-c36a833cd595", "value": "T17C234B41761C0E47D2A65BF4693F27E083FEE9A020F4F588260F9B868175E77508AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290975, "uuid": "e42b43cc-3a02-4a96-9925-105243dd0bc1", "value": "768:ADwEd/2X/wnjv3E9TbSvusR0ws4hY5yuxK8WZ8oqr5CCr0GSvtFABU0s5m7qEZ:jvwUbSvLXY5yuxfKQPg8fss7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290975, "uuid": "674daa0b-529b-4cb4-be24-fec76752ef33", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290975, "uuid": "1960d6a9-51fc-4751-ba02-15251b9ecbea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290975, "uuid": "e2f82caa-c8fe-467c-937f-9dcbba6a8b5a", "value": "miraint.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4005ad-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300841, "uuid": "bce93756-c7d4-471c-9fbf-3822b1418f33", "comment": "Malware payload (Mirai)", "value": "c7fb4c34829e46a84b21b4c3a07518a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300841, "uuid": "8f3623db-f332-43a5-af6b-2c2b6f211e32", "comment": "Malware payload (Mirai)", "value": "33057cf9b579700d0820ed2eacaac92178a65c1b0914587c575c50ebede3a770", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300841, "uuid": "adf3a782-d8cc-4bc8-9cca-a77d7f6c61bc", "comment": "Malware payload (Mirai)", "value": "b834b8c45a891f29d9b9bda01654265025f3b18d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300841, "uuid": "9e4f3d41-8b64-4e00-ae22-241d4ddd7517", "comment": "Malware payload (Mirai)", "value": "968c9f7f05b4bb4ef2343b88336dc17f959f8cf730d1a26edee308bad62e7d6390017e7f1f9e2a01b312c702bb06ca9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300841, "uuid": "a6a8df1e-5a9f-446d-84db-c24f70f42479", "value": "T16333E682FA4B84F6D80B49709067F23FCB31D9794071D29EEF9AAF35D93794241122DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300841, "uuid": "e4f9fcf2-ef5f-4703-9766-cd4f6cceb37d", "value": "768:i3FmuGaJY58nw6ZqHZ9OuJguaIUryKzBvJLHbRYe5YDUq5Sctg/r7q3rI1GXm1KQ:YFrGCe4w6Mda/Eh59tAr7ac1G215", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300841, "uuid": "8fd90f66-d649-4d84-a0b9-81891a1ef837", "value": 54160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300841, "uuid": "df8b5d67-cbcc-4578-83da-5bd9d1967119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300841, "uuid": "c4b24884-5135-437b-ad36-a766c9df84cb", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af14389e-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343128, "uuid": "abecaa9a-04c7-4c81-9bb1-ba2e53b2f304", "comment": "Malware payload (Grandoreiro)", "value": "d323ff402ebce3adb87c46475c18ecc7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343128, "uuid": "b2331cc2-15ed-4ae8-89a6-8dfc1c9f5ea0", "comment": "Malware payload (Grandoreiro)", "value": "3315dc90253ecf070d082e3a16b9b470a5ff566d0d2c49c86bc20ef6c7aa8f86", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343128, "uuid": "c46258fa-5efe-4d44-900d-6eefcd00c78f", "comment": "Malware payload (Grandoreiro)", "value": "e86c7403287467e3ce525e36ad04b097b8d1ffda", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343128, "uuid": "cfddca2a-bab4-4bde-9228-31937ed127cc", "comment": "Malware payload (Grandoreiro)", "value": "6d4961ae33a5f6112ed8f087b918a6f6f9456abdf11a8049ba7cc3af1dee87945b77e58db5250737eefcd629d2d6536d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343128, "uuid": "8e7b8580-4527-4d23-82a4-42b99c0d06e4", "value": "T14A562331AA950A7BC6904338B43E7E316F3E7A5359CDD19A79ECA0823B4B9D0C53F845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343128, "uuid": "b90503af-f0ee-4bd8-be7f-cb7b82cc5e2b", "value": "49152:GTwn3bjdXauyRTje2OwsZPff+pi3sT8RrNwxcy2NFrvspKV6GnyApm0Lyv8rlUIU:hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343128, "uuid": "5f2c764c-e109-4391-800f-c20b2174f578", "value": 6148096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343128, "uuid": "0e423238-3b35-4ead-aed4-df8f11609cb8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343128, "uuid": "841c3d17-5c44-483e-8a54-fb22c6e128f9", "value": "BJKL586702Deb-0GI7_Ha597405.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115cb189-0c2e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352742, "uuid": "5bf4d1c4-7b4e-4f7e-afb4-ef0d92002bb6", "comment": "Malware payload", "value": "44db0860571b39ba0090797e72be897e", "object_relation": "md5", "Tag": [ { "name": "151-241-154-184", "colour": "#2884DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352742, "uuid": "48ab3664-753f-487e-819a-d35d30ac4d34", "comment": "Malware payload", "value": "334c18a6a2d10c9fda30e5a3f99e23949aa761a1767d915d3922cd83daee5d05", "object_relation": "sha256", "Tag": [ { "name": "151-241-154-184", "colour": "#2884DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352742, "uuid": "465ce4c9-40d7-445c-9f91-9a7bd384d975", "comment": "Malware payload", "value": "50f23f92283e204b2b8a518d7dc984c05160f0ef", "object_relation": "sha1", "Tag": [ { "name": "151-241-154-184", "colour": "#2884DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352742, "uuid": "8028c4f4-e522-444e-b733-ce4cb0feb4a3", "comment": "Malware payload", "value": "508e86e1e83a17d559c1ab3539dc213919ebb990f2ff8544a09e412bd0e82a73cffd0a2997ce3eb0d5f818a6328e253b", "object_relation": "sha3-384", "Tag": [ { "name": "151-241-154-184", "colour": "#2884DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352742, "uuid": "7848bb60-c87c-48aa-ac3b-272015f54b1d", "value": "T10D066C53B288A53FE06B1B3F583BE670583FB6602A1A8D0B6FF4195C4E396406D36747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352742, "uuid": "adb51510-333c-4288-b475-f9b1e21e6f99", "value": "2d2e8944b3765aa8bce16e9b5a7db77d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352742, "uuid": "e347a356-a247-4f59-a9cd-55502dfbee9a", "value": "49152:VuJuvra5hv9AH3JE8lsSVCjqHNcrzi1kXHLgA86ToQbC4GhDOt5:VuQrei5ptcr+kbgcqDC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352742, "uuid": "11d26695-c5f0-4f6d-a51b-617e3082fafd", "value": 3715584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352742, "uuid": "288749df-238c-4e30-a9c4-eb86231c80ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352742, "uuid": "04e8e40e-0c81-40c2-bba1-f4f9b7b5d72b", "value": "cyber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b8e37e-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286796, "uuid": "27695dca-1165-4fa3-9b8f-4672257fd9db", "comment": "Malware payload (Mirai)", "value": "b434fb52fe7e3079046c8cbaaaf5708a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286796, "uuid": "af13f156-877c-486b-a4e4-b0841d8a82a1", "comment": "Malware payload (Mirai)", "value": "33aee8ae5b2454a6366fff8e875b5b3454c34f3d5dbc8d6eab0934d4f8e4bdd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286796, "uuid": "332168f3-4ea2-4306-b0ec-889b8e67e99a", "comment": "Malware payload (Mirai)", "value": "6323c13cb21ce31da4c8a6f25d2bc9277bf2c562", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286796, "uuid": "99c8bd98-6a88-4ccd-9cd2-f49369ba774e", "comment": "Malware payload (Mirai)", "value": "eff02a20cbb999b456018ecb5519a0303bbe7bd619c7798b72fdb7d828a3b005b0a24cdb0d8cdc426ba2c64fad3bde8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286796, "uuid": "aa5124d8-236c-4a24-a8b1-f24821f01247", "value": "T17F730856B8814B12C5D5127AFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286796, "uuid": "b06b935b-e1d2-4d41-b4bc-e87784743d86", "value": "1536:2ln25xPBXk1wnnkL7+KE007sxdEya6t0bIeiNNfsvHTGcV5GYIWd3:7xpXCMkM/+za4NfsvHqcVERM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286796, "uuid": "96243e78-4422-4420-9aee-6c6be8cc1a7a", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286796, "uuid": "d32508cb-24f6-4c4b-8b31-83e746216328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286796, "uuid": "0adcbc68-121d-463e-96e6-05db8f45c9b3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e313371-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771290540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290540, "uuid": "f6fbe9d1-1b50-417b-b512-31fb9fb03d8f", "comment": "Malware payload (SalatStealer)", "value": "5115dc34939379c02d636e1cbb4908c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290540, "uuid": "b7650f5b-ecc5-4ae2-a736-73664f928dc5", "comment": "Malware payload (SalatStealer)", "value": "33c23b0eb595f2469b11d2a14430cfb787c9c951c9357726442969cd409fb713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290540, "uuid": "9eac42ee-e0e7-436c-b097-f9f9459490cc", "comment": "Malware payload (SalatStealer)", "value": "03528374fd3aa7bd073898c90c30ccd64edb594a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290540, "uuid": "a4fc125e-bdf5-4c48-825a-c26c2271f713", "comment": "Malware payload (SalatStealer)", "value": "b1f987095bf45dcaa95bad512ad5b0109f66c2a75609578273f1a3040211b2f4f5041f7090ac5c841fc780ff0146c173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290540, "uuid": "5a83286f-5f2f-42e2-a981-18893c407248", "value": "T1CBC66C01F98B56F5E9034932409BB23B63315D048B38DBABEB447E7AFC776921D67209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290540, "uuid": "1a56b6ae-ff1a-4fea-8894-6960d0919e15", "value": "49152:wtTYc4qJUviOjy14voQF4ZpoY2zIgLp1RGuwG/l/NaAVt78niHYjMEX6J2BfhjQV:40c4qJmytu+G/eAVCivEKYsFDHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290540, "uuid": "f0603184-8f66-4160-856d-0338a91188d9", "value": 12107264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290540, "uuid": "f628139e-f50c-4c45-99f8-dbeaa486f9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290540, "uuid": "b34807b5-306c-42e6-96ba-df5607867bde", "value": "158mv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75c46f3-0c49-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771364697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364697, "uuid": "cff7b45b-9e50-48fb-b31c-86042d45f45b", "comment": "Malware payload", "value": "9da1d6efa7bb5f37c8d56d64067415d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364697, "uuid": "45304b6c-dba9-44e3-ad5a-1784ff1fe681", "comment": "Malware payload", "value": "33d26e10c1d2f640d60b95e9cb66bf04f88ffae5cc148a3e482aaea9e8c0b8e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364697, "uuid": "d9b8e1ba-115c-4321-aea4-6d0b84fbb94a", "comment": "Malware payload", "value": "68725ced8f0e35465e8fa6841a42d3d60842848a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364697, "uuid": "b04f9461-08e5-480d-b3c4-da01dcfa0677", "comment": "Malware payload", "value": "678556354004932ad20e93511d6ffd8368639cec028509a814db262c969f1566d845876f160669030aa47347f8e92626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364697, "uuid": "3810191d-a408-4295-8314-a5629c008dc6", "value": "T1E5873B87F8E22DD4D4EAC571D525815BFA61382C0B3C23DB1AA0F7241F3ABD06A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364697, "uuid": "2dd3ad0c-678f-4b75-92c3-6150103d26a3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364697, "uuid": "1bb4efed-b38b-46d4-b52d-dbdf6b1f7b6a", "value": "393216:dTeUCz4DMcV66W4z/dpf3XhRUU5DSL5bFt:dtMcU6W4z/dpf8U5DS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771364697, "uuid": "35a0c2c5-eb9c-497d-a883-ad834c2ca0ec", "value": 37022208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771364697, "uuid": "192028fb-92ee-4cd5-af11-8a8420cafd6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364697, "uuid": "d0fde21c-aa60-4829-b1a1-2b47f66bd363", "value": "beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759a75ad-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342173, "uuid": "13501845-3c6d-4460-bc04-90e458596ac9", "comment": "Malware payload (Grandoreiro)", "value": "d78c6dfb873eb5c0add3938c7e767865", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342173, "uuid": "52dfa224-b3b9-4da7-adce-953714be8c2e", "comment": "Malware payload (Grandoreiro)", "value": "34cd1dc37e8aae0b5f528fbf00de838e770482ed1a66597c29b586deaef5037b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342173, "uuid": "f8ada8c3-91ad-48a3-8f59-16b3ae8cf9c5", "comment": "Malware payload (Grandoreiro)", "value": "17179337621c9da7e88d7d9944a35119e75766b2", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342173, "uuid": "4f58d8f6-9b39-42dc-809e-0b6b649e4cf6", "comment": "Malware payload (Grandoreiro)", "value": "878663ec5682c6d7ff52ac8263db696578e6ab8c8eb5175d97bf1bfec97e2a7e819f84bb9606a33f1615213e2ea09e23", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342173, "uuid": "28007e4d-6283-4b32-b9ce-e0bf088c9697", "value": "T153162336EE81489FC6A14776B01F7A326E7CB203438D98E2749DA1423B4BFD1D23E595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342173, "uuid": "69ff5854-0870-45cb-999f-f2bee80e989b", "value": "49152:HIn521Pv5ksas+auD70xhY8F1AnIPSstb8pTmoycO/3Xs/ZZzr6ofo4Kj:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342173, "uuid": "c240f18d-82d4-45c1-8c4d-927b4c07dfb3", "value": 4243456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342173, "uuid": "3197a159-1527-4591-bd95-558b05f3f5d4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342173, "uuid": "b981bce1-2722-402b-8b3c-4a9032f4362e", "value": "572769TF8QCProc_UYXSC38757ME8Mnvrnv.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96f5034-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343226, "uuid": "0b5db372-37d4-48d6-a160-3cf3dd629e45", "comment": "Malware payload (Grandoreiro)", "value": "049089e415b722ab4a812c7b390547ea", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343226, "uuid": "ee1ee1ca-86d0-44cd-9ae0-834513282bd1", "comment": "Malware payload (Grandoreiro)", "value": "34e057652d5e6aaa50de2d0b21ad077334957216ea2926332b4ce2886628810c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343226, "uuid": "23c02165-256e-48d7-891d-6f1b54164c2f", "comment": "Malware payload (Grandoreiro)", "value": "f3cf51a11583abfde2b25e1ace9a76b7b9e6a2f0", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343226, "uuid": "e6a71ff0-8edf-4ce5-b9f4-26393156f64d", "comment": "Malware payload (Grandoreiro)", "value": "d05a4fb4d309e5f92f6439e7ae951772a5d94164b9188c829b350ef30c7390405418c5331644053ac9db50b44b18df21", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343226, "uuid": "028641d9-25e0-42a0-b694-55b0b332485c", "value": "T1766623315E549C6BC69087B9742F2E311F6D7F2786C8A2C2A8ED80C73746FD5862F894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343226, "uuid": "c961cbb2-2a6a-432b-b1da-b9e86d81dfaa", "value": "49152:nwo6oxy5Vn6edZblSmQu0hd7IatAaFjUQVm0/5fA+yrIggrfdQv2LX0XHWGKYVmH:E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343226, "uuid": "20bf661f-08f9-4b37-907f-28f1111d9f04", "value": 6836224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343226, "uuid": "108c8133-5d90-4651-8092-a7a1fd223a93", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343226, "uuid": "c1b98a25-9aa3-4421-91ec-01e4bc325ef3", "value": "FSTTOQ6478CUL4ST_Vr-Ict057383skev.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3299f90a-0bc7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771308560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771308560, "uuid": "44f856df-d1e1-4295-b8f3-b9ad3060f61e", "comment": "Malware payload", "value": "39f2cdcae9a6b28454e7720eb0f58d79", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771308560, "uuid": "615a85ad-81da-4ff3-bede-1885ae39fb1b", "comment": "Malware payload", "value": "350f78ceec8ae8762b0b279437a983c07fd85f68d9d91f3476becf302c7b3ea5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771308560, "uuid": "8fc31afc-6558-46f2-84e6-a409069c213f", "comment": "Malware payload", "value": "bc1cd8b8b6109595fb56d31ae384dd370e2cbd46", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771308560, "uuid": "6e0eda12-c2fb-4490-8836-31551b7de897", "comment": "Malware payload", "value": "eb8c06a5d69d46765f5806733ea21ac118f92529da6f442cf0f52473b0a9bc0bd588735f00a68c4a6ff4ed91642f72c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771308560, "uuid": "6a6eab3e-8e71-4503-a756-2598a3564e8d", "value": "T140F0125676E26FF344A8EE8D621E66953227786C6C0C4A58E4DF601FAF74AC0BC10504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771308560, "uuid": "6ac5b5ed-fffa-497e-bee3-feb8054d549c", "value": "12:biCdzB1dzBebPdza+dzaodgdzoAdzohdzoGdzoXhFPdzo4tdzoha0LK27:bzdzXdzMbPdzVdztdgdzVdzYdzPdzehI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771308560, "uuid": "699ddb5e-0237-41ca-9152-1a4c091c85f1", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771308560, "uuid": "7b361398-d728-424f-af79-9f46a2ff2ecc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771308560, "uuid": "83805445-725a-4a82-bff0-d762f84d576a", "value": "ftpget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c811a08b-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1771311817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311817, "uuid": "b0ea9ec1-14ac-44a2-b3e6-ddf10655a2b1", "comment": "Malware payload (DonutLoader)", "value": "410dfa1c0d8ddddca24f3c566051e686", "object_relation": "md5", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311817, "uuid": "ebcbef8c-8ea5-4176-a0a6-1b0bf06bdf63", "comment": "Malware payload (DonutLoader)", "value": "352002a140ad95183796c8744321f7a1888a9a012eba0962729d4a4d5f44c4c4", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311817, "uuid": "ccb72711-d32e-4950-b4dc-1a3babe9a011", "comment": "Malware payload (DonutLoader)", "value": "591eef0eb9eb03e5f43d89ccac4dbec1e8a439fc", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311817, "uuid": "d8050979-a776-43bc-8933-c0dcecf920b9", "comment": "Malware payload (DonutLoader)", "value": "eb7837fd6e2a940d22e49ef3aa8a1360ac97713a40e838cb6ea8fab2825c38a81e497d202d928d66c9df6318d3da0a73", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311817, "uuid": "ed1152f2-a77f-4b99-b6b7-ac341b7098ce", "value": "T1A7A2FA0E760394D8D91BC1348AE98377B6B0BD11A5A75B2E27B0C6710F60DEA1F38B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311817, "uuid": "f37ee09c-e698-4874-b2a2-01633b06bd43", "value": "29b6b557f85de78ab4ccc71e922e9a7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311817, "uuid": "534557d5-1ba7-4abf-8b64-37150b7f901e", "value": "384:0yE7lDK1VW+70XGqkLQ/8F08Gf2Tymew:xE7YrWJX2Q/CDGfGyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311817, "uuid": "237cb167-a9b9-49de-9b42-1017ecc546f1", "value": 22328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311817, "uuid": "b2e2ede5-6aa0-43ec-9fdd-55590ae7c2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311817, "uuid": "1a4975cd-843c-47e8-9359-c37ce8bb4118", "value": "352002a140ad95183796c8744321f7a1888a9a012eba0962729d4a4d5f44c4c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eae9d17-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343047, "uuid": "71b79489-a6e5-4038-8522-e3dd524bd73d", "comment": "Malware payload (Grandoreiro)", "value": "b6bd7a0ec6eccce68da84a775574d201", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343047, "uuid": "543fbd83-07dd-47ca-9d77-0c0765cb7658", "comment": "Malware payload (Grandoreiro)", "value": "35428d3fc7a7c478990b8d912569c611cb2206e9e6e4c1a1c688487745430742", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343047, "uuid": "c887596a-2bc4-45fa-8e94-bd21f1f566f6", "comment": "Malware payload (Grandoreiro)", "value": "cd732921ffa17f067857c99823c02d458bbf8d4a", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343047, "uuid": "492e7745-f794-448c-8866-9babb0be76a0", "comment": "Malware payload (Grandoreiro)", "value": "c257b96e3197bd430484706b8537dbad980d05392dcc6f422c4e57c0073dc80223f710920cfcb086a2e411a7b9a4d0b6", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343047, "uuid": "a32af13f-198e-4e92-ad76-5fdd4f0c2f01", "value": "T145A63331AE956D76C6344379B03F2A396E7D36630888EAC279DDA5C32707FC1522F885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343047, "uuid": "b6663c4a-9a2c-4a8f-86f6-ed47bc7d79a8", "value": "49152:0wv2slUSRScSRc8+AIQadmRtwTasvoLtzyIyp5nHLD0l7dDmaGRx9LVsCvftM7hO:xmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343047, "uuid": "0dcc3869-ce26-434f-8051-7acc04b1f700", "value": 9750528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343047, "uuid": "3c38dd40-7963-43d0-869a-d87761091d76", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343047, "uuid": "a7d1f53d-7a5a-4fbb-a6ad-4ab85936932b", "value": "9654IDR7_CmbNJSQIX-27944.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa90f17f-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348409, "uuid": "94deae10-7e54-40d2-844b-7ec9eae245a6", "comment": "Malware payload (Mirai)", "value": "339e78b413f64a3ab4c20db21e09928d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348409, "uuid": "318cf7e7-ae1a-4f04-b724-a000d1ed48f9", "comment": "Malware payload (Mirai)", "value": "35aa937385cc4b9d7b85c9ade1f2faf6e51d91bbdff55d8e2c54a9938646cce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348409, "uuid": "5ee66205-9fc7-4fc4-9374-970750fd7fb9", "comment": "Malware payload (Mirai)", "value": "c5743ec7a6e3f90b4ac3b41ced5695aeb7ffab21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348409, "uuid": "fc5aa0b4-41c1-40a4-94cd-78714687c41d", "comment": "Malware payload (Mirai)", "value": "571780756e2d93576dc9b3644e53503e398b07eeb910eccb9595f8f8b6f41357e8d80a077d5ef60ae22e1b12e8caf808", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348409, "uuid": "9a8c10d1-21fe-4e49-a6c1-bdd7750ab04a", "value": "T141156D89EBC794E1F65300F1068FD7F71924A2265053F6F6EB4C2A977432B522E1632E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348409, "uuid": "416f530b-eda7-48c0-ad2e-f72fef4ebed8", "value": "24576:CAw50kXOhakhPRik3vX90GufsKhtoqNQH/1GQVmkBo7ZMg:S0zhakh3fCJsKDNQwtMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348409, "uuid": "e1c0b9a2-cdf6-491a-b099-0376471fc8c7", "value": 910428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348409, "uuid": "7a7707dd-064a-4df0-901f-c80c3e57a2d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348409, "uuid": "9d5377e3-b13b-412b-a1bc-a340311dbb51", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af7b755-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342074, "uuid": "c58890cc-3f08-44f4-811e-2bcd4c0810fe", "comment": "Malware payload (Grandoreiro)", "value": "571905fdb64455f5ee0ece38e22b2cc4", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342074, "uuid": "399ad1ae-a1f5-47a1-903b-c093e93c4b5c", "comment": "Malware payload (Grandoreiro)", "value": "35bf603c5b9b4b33a01b7182d3dc000107fbe374caa3d1ed7b2b2927a261f921", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342074, "uuid": "b7420b01-d154-4157-86c6-ab0b5feecfef", "comment": "Malware payload (Grandoreiro)", "value": "a248ccb96d388ad211cf4ffb804d9d245db0a766", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342074, "uuid": "fbd6f705-6a2e-46b7-88fa-99d552fc555c", "comment": "Malware payload (Grandoreiro)", "value": "077d9c526716a1979eadf5c77705f77230745714a2802f03d426327dcdd169ebf7f902445da1b4339457d1fe2ce5b950", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342074, "uuid": "1ccf4baa-e0c9-4639-91fa-d6538aa5cf0c", "value": "T1A0362332AFA62C5BCAF4C335702F5F255F7CA553C048E5E524CD92823787F90866B8A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342074, "uuid": "7897111f-dd3d-430d-acc8-e102ae7ffcf4", "value": "49152:SUQuXgv7ebpw9qdadpEROD0dmgVlrXEkjtf7P0aRML7nyraujIkHAKiy9s/TVMce:5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342074, "uuid": "a26e2563-671e-4d2b-8bb8-d146f4d81952", "value": 5316608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342074, "uuid": "4493c873-4764-421a-9e56-df0f0e24c167", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342074, "uuid": "2e29297c-bac5-4c4f-8efc-e83f6aee8f1b", "value": "1604HQABZ_MdtJH4U0T-2031.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7ed35f-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300818, "uuid": "72e7a1e8-24b9-4dbb-8e76-8a30fa80b08a", "comment": "Malware payload (Mirai)", "value": "b7bb9c2329806e913b5b85b600f1c880", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300818, "uuid": "ddf1ae94-e9ae-40c2-8970-4b4af8b0dc19", "comment": "Malware payload (Mirai)", "value": "35d3c267340249ad9b727e5d09ca82999c1676f16ea3408eb7458760f75e3153", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300818, "uuid": "034f5ccc-b615-4546-b449-b2f54581cc27", "comment": "Malware payload (Mirai)", "value": "d6e00e432e580095c039ac4cfd9919763d70d207", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300818, "uuid": "23d80a2b-ae36-419d-989a-71e10832bed1", "comment": "Malware payload (Mirai)", "value": "2732afb7acd1ffb7f9645b8c34d468404e31df5b5a329f045e630c02e9d5fd706d3e73bed371f267e2cc42aa05483e2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300818, "uuid": "fe38e3ff-7505-4059-bd05-e115cafd53f3", "value": "T152C2E058CE262072F06E8178B50786DAB8FBB26D7608AB163540A89F36CBC6419F45B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300818, "uuid": "5dda6a43-27bd-4885-8514-cc323e6cc013", "value": "768:+gLCdFkuASsA0IBHoYFkFLN7vIxdgjelHje3uOs0WjssA4:Rec3AhBILLNcxaoHjeHsZjxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300818, "uuid": "b1592036-de4d-4b05-b640-70a149f177a8", "value": 25820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300818, "uuid": "d6175d80-6494-4c55-9290-175bcfbaf5b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300818, "uuid": "75ce9330-4397-43a4-a8d2-d74685ab3dc8", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f3bd8a-0b9e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771291228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291228, "uuid": "6f8c645e-4074-4cbe-a034-e8b09265a56a", "comment": "Malware payload (Mirai)", "value": "672c7ad8f580a2dbd9481d449b67daad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291228, "uuid": "5a386967-9363-4afa-9cef-432f51f0cdd7", "comment": "Malware payload (Mirai)", "value": "36c4dc3b4efbfb9881f777101f6b6c9718310be0721ab9bf47a505b18a1f708e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291228, "uuid": "4de07482-58d3-4ec3-9833-650f19089831", "comment": "Malware payload (Mirai)", "value": "e1e530a18d35338c3b1a44e9943a0a2b6603e5a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291228, "uuid": "59dbe42b-980f-48a1-819c-f77df25b65e2", "comment": "Malware payload (Mirai)", "value": "d0213e43af3457c78e89e7aa2a67b1265a7e6f7bb9adfe06c56a56e5825ac263c873f109a02055bce8c7a8e779cad783", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291228, "uuid": "1ba80857-f99c-4eca-bb9a-d0aa1c339c2d", "value": "T10284E09BF7562D82C5E7C63504868644571AE19B23F3C34A7A071A7B3C2A3B68F3D349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291228, "uuid": "389f71e7-c377-4af4-a9e7-403142e447e3", "value": "6144:pL5f9F0dOtBfm/UmolLxLT7iv61jWRftIoKDWgpjmMO:Xf9F0YZm/1kTZxGftIozgpjmMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771291228, "uuid": "de257580-77c5-464a-acdb-0216802d62b8", "value": 377940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771291228, "uuid": "ee9256fe-7d77-428e-aff5-33e72b30011b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291228, "uuid": "68a67163-7907-4ba7-bfde-82434799fb99", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5649cb8e-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348133, "uuid": "54a35412-4c63-415a-bd59-6f8979ac5a56", "comment": "Malware payload", "value": "7feaec37a08148f0973423372b73eedb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348133, "uuid": "9bee3a2e-ee53-421b-a822-d4b8b9f5c573", "comment": "Malware payload", "value": "36d99a394e6e9e01e039b813c429aff57cfa12203e04b258dccdc23d7c3a37e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348133, "uuid": "877a72fb-71fa-4f93-ab52-b200f5a7f2f3", "comment": "Malware payload", "value": "3a418cfb8625e1921a4c49ed06aa00006edc0da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348133, "uuid": "4395ccf3-faca-481a-a244-432d68bba06a", "comment": "Malware payload", "value": "aef4d3d7573b9e28df570c7f0ffbb8693ce7a3ffb7b6ef54718560f57af2a1dabc72b8ca51add2c418163c18a35f837b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348133, "uuid": "55193855-71e8-444d-ae06-e409ffcdcd15", "value": "T134E34A4772E531F9D1B79139C9A20A06FB72783547609BEF03A046762F236D09E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348133, "uuid": "f7b61b05-117d-4622-b464-2f30eec27102", "value": "e2eaea6074855f0fab75d89df8ea1e40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348133, "uuid": "18781ad9-c2c6-4b04-9ab4-561348cc537f", "value": "3072:7nVfIg2EsxCGmXVAaqB5zIi93ykCaVQkTk:Lh2EswGVJ5zIKyL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348133, "uuid": "274cc34c-1293-4011-8d80-4657777b7260", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348133, "uuid": "e1f2d29a-0c42-41a5-8390-b176c2a0e2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348133, "uuid": "e2083d04-f7b7-41b2-b32e-be47e2e0be05", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c79a7bc-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343043, "uuid": "802b2ba7-edb3-4cc8-8404-3156acc2b7d0", "comment": "Malware payload (Grandoreiro)", "value": "4c139449484e4cbcbf26e256ec5ae42f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343043, "uuid": "f8617301-47a7-4213-b785-e630b9253484", "comment": "Malware payload (Grandoreiro)", "value": "371af8f81881e1bc75b9d5aed5517f9e9cc8e7b540258cfccd4d71ca94626439", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343043, "uuid": "a9170996-b10c-4e1f-85c4-e042fa142cae", "comment": "Malware payload (Grandoreiro)", "value": "af1493c2f60b5bfd3d943ee40088fec18a110120", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343043, "uuid": "499a2d45-b040-45f3-9f2f-74cc925fce3c", "comment": "Malware payload (Grandoreiro)", "value": "3ffaf89bf2b54fb24d431837262f56565da9e3b09399fe153f910a97db480e9c49f7708c49ef1937ac726df33da8b22c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343043, "uuid": "d647c6be-2fdd-4441-95fa-e53da8f9e5c6", "value": "T180563333AF454C1BC5548378B52F9E1A3F6CAE1BC1C8A6E374AC95CB3786DC0962B458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343043, "uuid": "9dd103e4-11e8-4a11-9bdf-94cf7eefed83", "value": "49152:jeKUKf7+ZpYpvhv4s1zcgb4A4jxZsvH/fXNPaaQVR5q0BmFWzMb9k4iMdxPq7FIz:avBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343043, "uuid": "0d9b5818-8449-4f1a-a20c-b96458b3acee", "value": 6451200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343043, "uuid": "f51aa9ab-cf8e-4c5b-8188-94a95f9c8de8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343043, "uuid": "4cee6648-eaa9-4afb-8585-5ff1efe7fd56", "value": "9581K0U2DSUHUL_Grn-454226nkime.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7da116-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343310, "uuid": "8a62229a-25e3-4dbf-9c4a-fa8a8fe29d4e", "comment": "Malware payload (Grandoreiro)", "value": "ef705998a7ae7e08cfe72909a82348e9", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343310, "uuid": "2da18cfb-f552-46a5-9212-e6ef8d6a8a4d", "comment": "Malware payload (Grandoreiro)", "value": "374217bcdfbc9f623a048d16bd55237f0571b44b53ed82c1bb5f2a9eaf0e649a", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343310, "uuid": "0251e803-397a-4454-96f7-46e2fd3c99f3", "comment": "Malware payload (Grandoreiro)", "value": "35c93f2eff84c03538c8f8ab277dec7ac9b311e6", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343310, "uuid": "7376ce39-56d4-40f9-8c09-c2db4e32e654", "comment": "Malware payload (Grandoreiro)", "value": "87322177e866bcd143238901c1787ea2e64aeefd7963824d2ceb8d4cb6100c3bd8d1b0ce99f5d0603b58a3bffb181320", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343310, "uuid": "688ac935-a531-4b6c-af4e-c409241ddcf7", "value": "T1CE662332EE44A82AC9944372B06F3E391E6E77234B8C92D3359C92472747FC9993F495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343310, "uuid": "3ca85841-2afb-48c0-a261-9d6bbbedf30a", "value": "49152:3AiqNIWmBJzSUgk20wU1dx/w/egqJVC/dxCzXKw/4JX8KUq+hdqbHjg08Bldro5f:jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343310, "uuid": "0bbbac8c-7969-4565-9628-5f041db89150", "value": 6699008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343310, "uuid": "01453cb1-6561-48b3-ab06-b8612886e222", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343310, "uuid": "e55b89e2-b21c-4364-a848-548cc20c46ad", "value": "Nta-CrTBL1P_260454AYAPRRMJM4L.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2b1a89-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341729, "uuid": "7625918d-d1af-4a21-830e-48cdd02c7973", "comment": "Malware payload (Grandoreiro)", "value": "b95545253523c0004ef68cee53a97611", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341729, "uuid": "f289211a-2b0b-4f1e-b64f-96a5ebaa5fad", "comment": "Malware payload (Grandoreiro)", "value": "377e85d2ad4e04d49859d55d784ba8a69dd2f9a8d10d0ad3fc67e3f6847da3ae", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341729, "uuid": "b7bc9aaa-515c-489b-8b50-c7415aca1a9c", "comment": "Malware payload (Grandoreiro)", "value": "6c6c3adc04cd9ea29e408a135b0f3eb92628be5e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341729, "uuid": "db4d0283-faaf-4b18-8153-dc0d8910778c", "comment": "Malware payload (Grandoreiro)", "value": "70e97f7fc37f31f757e2d9874be45180ecdafc717f591f365e34a7c70115d903f3dfe9cba0bc974a3cc4a57605b5d12b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341729, "uuid": "8bc91698-0adb-4695-8475-ee9eec18064c", "value": "T15A963330FA416CB6C2A44334B13F3B392E7D7A4349CCE9C665DC6583674AFC6592E892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341729, "uuid": "84bad98c-17ae-4570-84ac-6f4a84d615c1", "value": "49152:dC9C2ribWsp+d/4bUrglVPqfDdv11eFmXu9TQ+rO+N0sz8SOvVjfVVezGF5ZT/Fw:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341729, "uuid": "f12952d0-fc75-4b57-bca1-c0d7fc6ee73d", "value": 9156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341729, "uuid": "218a4682-3a6b-433c-ae79-d1f5d6a71590", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341729, "uuid": "cbacdb5e-43ea-41bd-b997-75601a7c937a", "value": "0QTY7S964292SCEZGS_Arb350038947Auzko.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4048ad1-0c16-11f1-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1771342707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342707, "uuid": "e070cd46-bdd1-494a-b00f-79faa9f58438", "comment": "Malware payload (MassLogger)", "value": "ad7f3a7bf167c4f4654ccc9b760e64e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342707, "uuid": "de1cc206-d8db-41d5-9414-db5882ef38c6", "comment": "Malware payload (MassLogger)", "value": "37aa7d9190359b510684537d0982d8ced5b21792d88a28cc8736fb2358011543", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342707, "uuid": "aad9c7b4-96f3-403e-b077-1e5827195169", "comment": "Malware payload (MassLogger)", "value": "88d48cff7556ff80ea50e7ac49aed25696de6d84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342707, "uuid": "f4901e99-ef87-4c6c-a2c7-e82b45c8ac56", "comment": "Malware payload (MassLogger)", "value": "4e93cdf61b78c8165d19869f7d756a2cff24f4b634392bce145573643d3b82df93a045e1983c380c84eba6e11a2b7aaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342707, "uuid": "f4d16c12-dd7a-4127-b4b4-ddb88ce05606", "value": "T14923E7CE31C371A81B623D2711AFB1E7E63ECBD858CC6560C2A59D61BDA031DCEB5924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342707, "uuid": "e8dae52c-aeb5-41b7-9b70-f7826d2c096b", "value": "768:DYx+tI46Lutae7pYFcLTl36ajGQqBJD9kYkJ8luyOuedzxMlZ5Wh4JTup21DSUWr:DJ6cLh36ajvU7TOuedzxqD3upiSUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342707, "uuid": "d631b995-3a54-4fe5-a236-e635dfc6756c", "value": 49239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342707, "uuid": "f4ddf38b-461a-4dab-be56-53fec10ee232", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342707, "uuid": "bc002137-6001-4be9-92ca-770ffb186fd5", "value": "ad7f3a7bf167c4f4654ccc9b760e64e5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb367c5-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343230, "uuid": "f95bc676-b9e6-4395-8ee6-780faef7f758", "comment": "Malware payload (Grandoreiro)", "value": "586e2147df273c4e5fce81345a7e71fe", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343230, "uuid": "5a104d27-ee75-4684-acd5-1670f083494a", "comment": "Malware payload (Grandoreiro)", "value": "37c480d1476e1bb5a36747452c5a6a2667dab8644c443094cfffa611a81925d1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343230, "uuid": "a762ee2c-2da0-4d29-8cec-e7254a684f23", "comment": "Malware payload (Grandoreiro)", "value": "50957eea915eb3f44a7e155a017b6064ad2f27a4", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343230, "uuid": "e8a515d4-2867-4eb2-8fec-bd7398292801", "comment": "Malware payload (Grandoreiro)", "value": "3c4d93f822bdf88c4cff244ee15d83a73cdcc457dfdaf3357931fc239fc1e4297be341c99072c748fdb0d1a1304daee3", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343230, "uuid": "2437c94c-d418-4103-9b60-ce1f9fbb0757", "value": "T1E3662332AA151D6ACA6043BCB52F2D3A6F3D134B4D48F0E3698D95573B4BEC1852F8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343230, "uuid": "c35ff83c-7cc8-42bc-8279-bccde41369a7", "value": "49152:1ZV3Q8L9oE+9iV9lM90qRLuF+uJOzREaoDjRWgK22NtxyzyikkQJ3fXtiYMpnFe+:kFx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343230, "uuid": "021625eb-d6df-48cc-a858-461274fc5b64", "value": 6543360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343230, "uuid": "fd9542c6-e014-474c-9e09-6e2d3c0e1632", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343230, "uuid": "95060eed-286b-4428-a991-7bbeec206186", "value": "FYRJC4212VT70X_Vr-Ict882902sfjxj.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b13afae-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312815, "uuid": "20b1557d-fb94-4500-a5eb-d440021bdaff", "comment": "Malware payload", "value": "339c42cae70b4a4c118cf6b3354fdd86", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312815, "uuid": "e2147c32-97e8-4cc9-a17c-643aacede4c3", "comment": "Malware payload", "value": "381adeabdebea72c3dc47d47b61bb41d0e9f73c9f38a5c79e8b48f4ee986003d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312815, "uuid": "bb38be21-e90c-47cb-8e2c-5eaf934f10f3", "comment": "Malware payload", "value": "9a60bb065a762717ca1295348152ff910ebbfb83", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312815, "uuid": "906df9e8-5724-4765-b465-932c6ac051c9", "comment": "Malware payload", "value": "f122cd962eb403f48fa320945e4be7ff1b520ca6fbaf64bb1f07c63aeb96f831052fd13c62954717ad8980bfbc364509", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312815, "uuid": "c5a57871-fe87-4557-8f3d-d7c24d9c2ed1", "value": "T1D6563330ADB52D7B02948334B06F2F266E3C5D53C78DE5EE41A8A0C635957A24B3F4B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312815, "uuid": "504f4765-4683-4859-a28e-ce3d65459056", "value": "49152:LhAwIvuXpHIX9VFF/CrFN8icI+abxsxdPC7FU8BkFafbWJD2EztJLTUk/okL+qST:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312815, "uuid": "e190e263-9e5c-4adc-a0c5-24603d60aab3", "value": 6425861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312815, "uuid": "74e7fad5-07e6-45ec-be5d-d3f0d7b75410", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312815, "uuid": "f2679c78-b441-45f8-9df3-72f75ee6ee97", "value": "00156UOROFQMediacn_Q4JKaaobkv0263EOZY6B7GC.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24fa447-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771343160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343160, "uuid": "b270f2bc-69da-4636-a126-44677162c36e", "comment": "Malware payload", "value": "46bb0694fa363eda7b7ce52e42e428d2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343160, "uuid": "4e9aa335-e64b-4aed-b1e6-cd3b4b0b7e96", "comment": "Malware payload", "value": "381e76ba7df5e71e21792461420f7620f044dc2e8918994809e0eeb4bb8330b7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343160, "uuid": "f4315a5a-e269-439a-925a-99f0df6d2cfb", "comment": "Malware payload", "value": "7776c5bb5de0e4dfd817787f05fed172947935e7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343160, "uuid": "ab17d6f2-07f9-487c-add3-d986fea7001d", "comment": "Malware payload", "value": "afe73e69691c52a15e1af38ce2172154d6b32be02c98c56a3af2fb40bf47af7880b84da1b67489ce2ab4169b30a8b0ba", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343160, "uuid": "df81447b-07f7-4f58-aefa-21a106747c9b", "value": "T15B45FDB4E41014E4E26669D34132A5B9427E38DB9E7089D8CD7382BF7B93F6E02CF911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343160, "uuid": "16b8acd1-6b4e-476b-88e3-97fe53361155", "value": "3072:6XHhJ2hlLsL5YGakPzyx87OiL/i+x7CTKPHjhquzG:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343160, "uuid": "689c2b38-0d5d-485a-9167-38c1cbba9201", "value": 1213446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343160, "uuid": "8984c94d-568b-4322-a2a4-f305e22b7bb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343160, "uuid": "334b20a6-4c27-46ee-9127-17b62dbf7176", "value": "46bb0694fa363eda7b7ce52e42e428d2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ba03df-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312828, "uuid": "e42c9f36-7c07-4b62-a693-d1c924c8b8a3", "comment": "Malware payload", "value": "d87cfa22dc9649f199aeb23839db2d99", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312828, "uuid": "026a430e-aace-4c90-b45b-45f611602ad7", "comment": "Malware payload", "value": "3942183c30a2cfc57d4a86a921967a91ed1bc04a96828807d2ab3c5fa0ef360a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312828, "uuid": "83aa1dc0-5d01-467e-84cb-c042a9ac70de", "comment": "Malware payload", "value": "e978a035f87e88ec792c24e01154f3a21586539e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312828, "uuid": "5869ac1f-47b9-44cc-9a20-e2c9d8d8a9b7", "comment": "Malware payload", "value": "e57dd0b5d26a9c2e5074be2a5e3435556e269e836697545df3118b31683109157dae2c1a43dee7216be7f50068b1ae3a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312828, "uuid": "7f2cf85c-df74-418a-8c94-9373a045aea1", "value": "T110763331AF691DAB0758833C71AFAE269F7C5D53858CDADA46D4F287344FB80812F468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312828, "uuid": "fcb745f5-31da-4537-9f72-7ea59af4ed42", "value": "49152:nWEQh6yEGyqSF2A69IoL6X1iReI4+YizZN5ayjOaLtwZnCW0lRiNoTzWxuQyp26k:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312828, "uuid": "36d9d9e7-6015-4999-833b-4a04c417ee92", "value": 7490170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312828, "uuid": "e90e8b4d-3d00-4e8a-af70-39e5b7d145e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312828, "uuid": "1a30e821-dc29-4299-a9af-4faac1eeb507", "value": "054913Sobre_Escrt86SAfasfzGHBXM-113427AK0Q.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377dd29d-0c32-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771354524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354524, "uuid": "53ed6ca8-b175-4796-bd26-f276670d76a3", "comment": "Malware payload", "value": "dc6ff962d18b3585079e272537dd6dbc", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354524, "uuid": "4f0b0b90-6b6b-4b97-986d-0f256d0cbdbc", "comment": "Malware payload", "value": "39521f2bc49058330d31911d54a6c9689579671a29dba5d9e8b116ae43b330d3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354524, "uuid": "56a752ec-aad3-4d17-a538-b440a3a2a05d", "comment": "Malware payload", "value": "0144eb0967259c77d929c0bc7cb0309ed53ae312", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354524, "uuid": "a67251ac-5325-4fa9-a7d7-0b4834e212af", "comment": "Malware payload", "value": "b7c47eec5affb6bcd37f11c5a709af801e90d90115809d3211730e74d64d1d690542abab871c276de7c4046a665d1146", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354524, "uuid": "06508946-e732-4ee1-af2b-a6659974b55a", "value": "T14A552328FF588703C20ED6768886D296250C7C417782D6BF73A9332EF6752B2169725F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354524, "uuid": "4fb592bf-8a7e-4f6c-a458-eeea2f5be9eb", "value": "24576:MOmSZ/NID0EZi6nt2TGEakA5lBczML/CGc87Ygbbwfb5IhFIlnRmCKLU1J:Tmy/o06nt2TGEnAMMOW7YgPwmEFRH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771354524, "uuid": "451b90ee-8484-43ea-9412-52dee198ef5a", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771354524, "uuid": "1ebb8c7f-5ca0-482f-b1e6-c32ea29b75e7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354524, "uuid": "c3b49456-e7f1-4afc-b37f-76c97e108ce4", "value": "SecuriteInfo.com.Trojan.GenericKD.79340617.10855.17844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53211ee-0c0a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771337609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337609, "uuid": "2701c0f8-162d-4158-9a81-b2415b1689f3", "comment": "Malware payload (Mirai)", "value": "95157b51318e1a05eff3c236b305427f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337609, "uuid": "0c45c700-a7b9-4952-b696-719bc373fc06", "comment": "Malware payload (Mirai)", "value": "3965e5e651a7a2551eb4ba2cb7de3ad5caa5864fdb263ef946fce72cb66f2c03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337609, "uuid": "1d2b64b2-c548-4eac-8527-7a6cd6d9bdd8", "comment": "Malware payload (Mirai)", "value": "fd4fb61eb08bd204c55da433cd2b5a59d48ca961", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337609, "uuid": "fb7e7dd4-1f54-4dad-9bec-53d290b07b03", "comment": "Malware payload (Mirai)", "value": "9314fc043793fcf3c2a95ca7d220e0aaf4f32374967c562fb353c533aa7b2209c3f8bfc5488a8b78a0d0a715b1447d21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337609, "uuid": "1b8702ac-773a-4da0-abc8-11799cbe26ee", "value": "T1A6331986FC81C916C5C417B6F66E12CD3B2623AAE2DE3203DE155F1137CA91E0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337609, "uuid": "6a71c2b6-0b38-4add-adb8-30cc81e0d754", "value": "768:LxthBrFPmK0GxriJ5it5xGeHJdKA2sDci0GAO1qrPPh4P+OHGRNIpXdhZe4U:9th/P2Goni/xGsH+O9tej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771337609, "uuid": "82b25647-b34a-4f92-ae7d-3a56da617996", "value": 52060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771337609, "uuid": "5680ec05-b61e-4efc-8733-513978600ed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337609, "uuid": "34cec9cf-8004-4e1f-8694-7fb51128dd1f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160ec811-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342871, "uuid": "b9e38534-23f9-46b3-a4f9-795893b79fbf", "comment": "Malware payload", "value": "47971cf42d917dd5fdd6101768d697f5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342871, "uuid": "8b136a9e-5ab6-4335-ac21-11657d40a5e8", "comment": "Malware payload", "value": "39675b248f5869e69167ee24cdebb1a196a747a80ab6ce8a80645e2f1bb39d0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342871, "uuid": "04491a68-b1da-4cf6-918a-14b807997e1f", "comment": "Malware payload", "value": "e7e3660c34878c0509765eec57558a3da4a491b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342871, "uuid": "d94f2c64-7ee6-415e-b71f-0925df325ab4", "comment": "Malware payload", "value": "0647c979c3127a28849e0b74c8267416a8b553cb8944dffa1551b9440df251416bc21a423b0cfee2531cdc2d77e2e25d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342871, "uuid": "39718120-e86d-450c-8b06-0353844993a4", "value": "T18C35FD386AC510E435B7285AC4C0372E9E3D6479ED7789BAE87187EDCD120AD631DE23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342871, "uuid": "e0ddcb57-a904-4580-8606-cf875ca390fc", "value": "96:vnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn8:8odNxW4EkvgPmfg5RFzfcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342871, "uuid": "59cbe00a-1759-4de4-bd29-bb8cbb3006a0", "value": 1106853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342871, "uuid": "bcd60ff0-af29-45b5-9e2f-da1e2a0c1568", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342871, "uuid": "d9e37e71-bc94-4082-ad73-e7fd947e58fb", "value": "47971cf42d917dd5fdd6101768d697f5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ace7f1-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343295, "uuid": "b7734552-e90e-4735-a44b-424710c6e99d", "comment": "Malware payload (Grandoreiro)", "value": "04345c79453a221037d56cc83fea074e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343295, "uuid": "3b4650ed-67d2-4561-874a-8ab2699aa5c5", "comment": "Malware payload (Grandoreiro)", "value": "397576ee57bdd2a7a7f5f0e864202f9884b3fa36d8bbb9d7bf86f3feaacdbdff", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343295, "uuid": "1daa7ce3-ab6b-4a36-bf2e-4ca8fdf1ab52", "comment": "Malware payload (Grandoreiro)", "value": "6bda1507539e40efd6c156f3dcdb4f637f548d94", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343295, "uuid": "98dde341-0b6b-41dd-9063-06106f7dd885", "comment": "Malware payload (Grandoreiro)", "value": "01eb6cf756c0ff2513d85f73ce62643355621a51c8bcbe45423ea66afccc9509cf46edd33e98ec9ad83d358a1ccb8538", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343295, "uuid": "28de95e9-eaff-49c4-ad45-5dfc5bd6264f", "value": "T195362331DE511D6AC9904336B02F3B365E7CB557818CFAC171EC828B3B49ED24A6E4E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343295, "uuid": "ac0eea0a-ba59-4006-b25e-b7e87e484964", "value": "49152:wkDDtgvIccbjz3GfZr6/NGApjP6xe9qbseF+njURC2Hl8L6l17u:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343295, "uuid": "d1f4622b-43db-46b2-aab9-35762535bc8f", "value": 5083136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343295, "uuid": "6059a859-e061-490c-9eff-bb19aa545513", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343295, "uuid": "bcc4d4e5-f62d-4b16-bbe9-f024ed510d2c", "value": "NQL708371POBYPYjpeb_Desv48098.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56fb557-0be2-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320483, "uuid": "67286f80-4cfa-4fff-8e8e-06533a3d3814", "comment": "Malware payload (AgentTesla)", "value": "8fe08532addc18a3e86df1d6e07bc71e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320483, "uuid": "3bd0c2c7-6bf2-471a-9f69-cbd1592117fd", "comment": "Malware payload (AgentTesla)", "value": "3a1590da13adc35094c271978472100d22bd7c23890b0f1f9b7a9b5f2cb8b559", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320483, "uuid": "5f6f5ff9-20b9-4dde-8b1b-8c4df1d51d1f", "comment": "Malware payload (AgentTesla)", "value": "030adcd170f770c6d136be8f0010db5dfac92985", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320483, "uuid": "b2398d2d-1e26-4af0-90e4-951305651ce3", "comment": "Malware payload (AgentTesla)", "value": "168c1658ca9802d149356e5e189479f4ead1106928c3ced7ad59999bc942600e7e15564c44d02aff700e48ad737e5ae7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320483, "uuid": "1439231f-1510-439f-b15b-f088b4c336d8", "value": "T19E05D016961CB847E7C016F70BD59296F6635DA436A273E206A3FFBE0B7C103AB0519C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320483, "uuid": "6f659095-e0da-4b08-a063-dd978cdf85b2", "value": "12288:XWTYGEGwJrc2546vMz9WEqEOMAEa+PClaoJdy8//IPNsowUfCvw0yovNmUFf1xVb:XgEGwBc2hve9gTiC8odyigG+SZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320483, "uuid": "897abdcc-3813-4cce-ae0d-cd2585634f18", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320483, "uuid": "e4f77ec7-1669-4a92-867d-7bbd12afec0a", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320483, "uuid": "6803d172-b021-4aed-b405-4811c908adec", "value": "3a1590da13adc35094c271978472100d22bd7c23890b0f1f9b7a9b5f2cb8b559.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff557c6-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353894, "uuid": "df8ee215-6c93-4cd1-b58a-50120875475b", "comment": "Malware payload", "value": "d7bff3d2fc27ac935ab12268cc80bd57", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353894, "uuid": "5d315bb2-c67c-44d6-8dc7-1c7e266f4b85", "comment": "Malware payload", "value": "3a8e30685e2bb20158b2a5442a9f59ef452fcf4d43ca7edb3204e44a57e67e40", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353894, "uuid": "106a5117-0e72-4e97-8379-c093da1382ce", "comment": "Malware payload", "value": "3d4fb3d1b2de61affa86c23b9512b39b1b3f505f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353894, "uuid": "614a5d3d-abf1-4842-93f2-dfbc602c7d21", "comment": "Malware payload", "value": "5c7d6fd43a52bfc6f81ff8cc03943f80fddea64e2a6031ba2acf6916447002458d5166e7af560d39a79f86a07fc67139", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353894, "uuid": "03aed60b-9f18-47bb-b5a2-979f4dd78c8c", "value": "T111462331AA545C26D5804779703F7E201D7DB1038ACDB9D369AC8283378BEC6A63FAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353894, "uuid": "c2fc6f26-6d5b-4ffa-8d83-7ed86b782732", "value": "49152:CR3qHC9d8B9ZxKkEWPg51lAQGfKlj8eboCgcjmDmzHUbcI4Y7jLJmHwpaOGKmOIe:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353894, "uuid": "77d679b9-9222-4c8c-b7d4-5b9e3aee927d", "value": 5556224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353894, "uuid": "24349c52-55cf-4363-b7ed-67346db75b35", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353894, "uuid": "3f846a6c-ab04-4bde-a313-9eeb8a3b6cf9", "value": "Slct189074NVPBTXYB32QP_65061czcily.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c892af-0c51-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771367968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367968, "uuid": "acf15c98-db1d-41f1-8594-3d5303c09241", "comment": "Malware payload", "value": "54ff30f4345aff2b74bab0c91ac09469", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367968, "uuid": "c007f76c-c25d-4260-b15d-a8ba1695b3f6", "comment": "Malware payload", "value": "3af64c28e0cedf48abc217049af66c23149fdb1384f5e64bee2f72ea13a9ac60", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367968, "uuid": "9f16e9bb-c2e5-41e0-936e-28b58f5d2b5a", "comment": "Malware payload", "value": "7c01a548d26842dae99eaece65a519b3a5ff3e15", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367968, "uuid": "abd5d9ac-2fea-4c5d-95be-9f9e687a917b", "comment": "Malware payload", "value": "ffd470b022bb3f51c90de381b75867bd093efd091f6cf5c5ee8d7be0b32da3069d1e62658d233793b592b420eac636e6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367968, "uuid": "65b86b6d-9475-4b55-a6f9-cdc72dfbb3e5", "value": "T13175335E2A431DBBFAC802FFDD8523BBB538E9C53157B6261111D1BE580328EB6B8D11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367968, "uuid": "6f4c4bbe-d1f4-4744-adba-e1854a9d8828", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367968, "uuid": "c3df19b9-1103-4a95-a3cd-af1cfe89608f", "value": "24576:CC9J6XKtxknszR8gGGih0jKywQzlhvWZ+KThtgAUZLDydAwQKcOnt2LPwb1TtuWC:9J6ann8wbR9YbgRZLDyoPqTgfeaTS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771367968, "uuid": "739e748f-3acf-494f-a6b2-7eaba83ff4aa", "value": 1667072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771367968, "uuid": "da9ca36f-772b-4e3b-9fa2-52c72f252090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367968, "uuid": "d0b4c2f6-85bf-447b-a3c3-0daf09719ad8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c839d73d-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352619, "uuid": "403a7a9e-458c-40a4-839c-b995cdece929", "comment": "Malware payload", "value": "dc04771270248e9436b8c41a56d08650", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352619, "uuid": "6a1b1bc3-5498-420f-b3c9-fce4b2746fb8", "comment": "Malware payload", "value": "3b7fccf77a1da8b2101395307c83863e79b69092bf4fba98405e48e7343b1ab1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352619, "uuid": "8f9491aa-d61b-41d4-acbc-8c983025e6f3", "comment": "Malware payload", "value": "2bad0a233df8de397d33d330f48645b74260438e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352619, "uuid": "bb3db47a-5dc9-4ef7-921f-66152a9d7510", "comment": "Malware payload", "value": "3149df9ed2f2cbbb319ff8ab50fa22175ca8760a91eace1c12e3147e3f2433f6b239a066b70350d911a7d35c4f86edeb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352619, "uuid": "ce4b9027-da8f-424e-aee3-fb0d576b99f0", "value": "T112562334BE441D45C5A04375B93E7E352FBE62130ECEA1D66CDDC203B64AAC7A23E485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352619, "uuid": "2939fe04-864f-4d1a-b47a-2bb447328338", "value": "49152:0HC8COHs+F8DyDwVeNQ3SjgSI50//QXyhQ5symzavo656tn1D9mlllX/lzkPco5A:di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352619, "uuid": "757b591c-723f-425c-8e91-853fa40a349d", "value": 6180864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352619, "uuid": "2d487004-5716-42d3-b4dd-1eccb2455c36", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352619, "uuid": "61cf5fee-11b5-4b14-aaee-df8e9bfe4303", "value": "TmprDLZFIJ5288-JP59U.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ee8154-0c38-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771357197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771357197, "uuid": "641f59c0-b6fe-4a62-a573-b74dec04a3d8", "comment": "Malware payload (Mirai)", "value": "0ee89a7d315a8ea652c3fda8d2d3634d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771357197, "uuid": "c6af4bfc-9379-41b2-8efe-e09d0ba23d26", "comment": "Malware payload (Mirai)", "value": "3b8fabc3e2093ee2f50b5558ea732ba4bdd675cef2a92e9f4b697a44335c9547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771357197, "uuid": "19535378-1cd0-481b-a869-63c0ed529441", "comment": "Malware payload (Mirai)", "value": "ade2b434bf7de9e930aeafb328296145c196ca07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771357197, "uuid": "8a328e74-98de-4a44-9476-aa616695cca5", "comment": "Malware payload (Mirai)", "value": "78d38466c1d269834fc76e8ab7c85ef5bf5ca309e5f8663d845c034b3362053091a1f7961ffbed30bc800934d3acb1d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771357197, "uuid": "dc9b92a9-f2df-455b-a313-5acf9ce87f8c", "value": "T1373319D6B5019DBCF95BEBBA8413460AF531B7561083063763BBFC53AC362A48E23D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771357197, "uuid": "ffc73322-5e14-469e-8162-841eee7c24d0", "value": "1536:BoG7IMHSWSgciVCnXEgc8eh1gBUxCWQ1v7d:4DgcisnXxGu5W+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771357197, "uuid": "698171ab-3bf6-4320-a4eb-01715ea85c24", "value": 53024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771357197, "uuid": "8882946f-002f-452b-aa72-1872333a65b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771357197, "uuid": "b07dca73-6134-488d-b380-5c1f072f16a9", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a213e-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341768, "uuid": "c1f31546-e548-400b-b6a3-e6a1438120a1", "comment": "Malware payload (Grandoreiro)", "value": "0a72562a82480808bf9a69f32dd2754c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341768, "uuid": "529ba976-1c4f-4e69-a94f-663511ff91eb", "comment": "Malware payload (Grandoreiro)", "value": "3bf873e25833aa467f5e8750695ead31cf207dbb408668af4458abd1cff45b83", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341768, "uuid": "bbdb0662-2b27-42a4-b93e-322b79f34076", "comment": "Malware payload (Grandoreiro)", "value": "404b4846a5fe2e049ca5c4462fd249faf28e8763", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341768, "uuid": "1223b201-10b1-42c5-89f7-d7c95e568829", "comment": "Malware payload (Grandoreiro)", "value": "41f62c3d4899dfdee8899f09a1467bbab1e26029d99700439c4c9121e3647af10d7222634d3a0fd084711f4d97dd9ff5", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341768, "uuid": "9943943b-f996-4643-b473-887823d3b19e", "value": "T1B9863331AE990D6FCA508379702F2E256FFD3953424EE5C6348CC5873F49BC18A6E869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341768, "uuid": "90a51790-a3f9-4796-9077-0460aabaacec", "value": "49152:2uFMkrVipzVKN9FzFR4bKYzBEv0vY/JlmnF9dQZR2y8z4T7bl8uk4bnVDDk3wxJ0:8fUXkGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341768, "uuid": "d618993d-0bb4-46c3-b2aa-2726b8179310", "value": 8609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341768, "uuid": "de680da4-8602-481f-b78b-388f14882286", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341768, "uuid": "03da45ee-b22b-4052-ad5f-b78b15b191f0", "value": "Jrnl33156FEAZA-XAO671438.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9494940-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313188, "uuid": "441c29e6-3461-428d-a49e-9d13ab9f2082", "comment": "Malware payload (ChromElevator)", "value": "dcf5fd9248767734106b0f1936ef85e3", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313188, "uuid": "dda52eda-0b41-415c-950c-2352b048f1c2", "comment": "Malware payload (ChromElevator)", "value": "3c03ca8fb96c8e1c61e58a5c65d9eeda0f5bbe5c2faf4c021e7b704fe5917f29", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313188, "uuid": "48bedcf5-59d0-4191-8c73-98b8f309fd13", "comment": "Malware payload (ChromElevator)", "value": "a1c0b159dcc1b8b4f4703af7c9f350b3667db182", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313188, "uuid": "b0b07288-7b35-43cb-8a72-99f3bb34922e", "comment": "Malware payload (ChromElevator)", "value": "afd3b4d65826a0c58e9cb0957bf4492de398b78f926ef1731db7d1768339e754f332a010ead5e1ae83cd51815a4107ea", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313188, "uuid": "0a789661-58f5-4168-b7ed-e0a02eab65a5", "value": "T11A96D75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313188, "uuid": "24870b13-c0a4-4834-8565-4098f473f5f7", "value": "49152:TeoxLNF2gS2a5/j4pgedbUJvEY7U0n/40MmA1IE1Ygsn73iTH2XP1Km/soyMmBT:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313188, "uuid": "72574fd4-5958-444f-ad80-ca2e015ff894", "value": 8684709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313188, "uuid": "d6d068ec-8467-47eb-9f53-a1fac1eca2c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313188, "uuid": "816f63f1-a393-4ce8-b9b2-00c68a62443b", "value": "nouveau_curriculum_vitae (17).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06284a8-0ba4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771293765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293765, "uuid": "b1efdc5b-c378-442c-8ecc-7ce48f84edbb", "comment": "Malware payload (Mirai)", "value": "813f2bf4069f3bdd1b5d665d3be83ee5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293765, "uuid": "a0012177-6e4a-493e-9f11-379d58d46d51", "comment": "Malware payload (Mirai)", "value": "3c1b4008dbad8a03e6a5e1d273023a6b117e97f51e72b2e8da8f89143f1b1cae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293765, "uuid": "9230b8c6-0450-4ecb-920d-233ed9a11edf", "comment": "Malware payload (Mirai)", "value": "237e001a75dde37f65a7f5f1a0c40178a9f92faf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293765, "uuid": "510a50a1-f04b-4bf1-a956-1bb4b843f71f", "comment": "Malware payload (Mirai)", "value": "8ed188bc0937348633531b6ccdebfa3ef75d8851eca75e9ca12b505ff62735c5edb15ba70b87e41f1bd8d91a68d54aff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293765, "uuid": "8a35b352-5c92-4d6c-8961-a8d046c42219", "value": "T177434DD6B800DE7CF947EB7A80164A09FA35722154A30F27A267FD93AC721564C2FD4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293765, "uuid": "38a2e43f-0b67-4d02-961f-97f64ac89a0a", "value": "1536:bqgor9Y1asetA1PcG5eYzCktnSygjVWstg8e:JGssA1Te8LJuWqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771293765, "uuid": "f006acdf-da84-4070-becb-418d535df17d", "value": 59716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771293765, "uuid": "0e654849-5a91-466b-ae6a-0c7f56fae7f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293765, "uuid": "8f7bc06d-c0fd-48c1-9551-e8a21884446e", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b075fe2-0bd2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771313379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313379, "uuid": "ffcb246d-79f2-40f3-95ee-570fe3d59416", "comment": "Malware payload", "value": "bfcbf3cd4acf51e6780f1885d55d848f", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313379, "uuid": "357bbc18-3f3f-44e2-a6c5-03a42f1c3c1e", "comment": "Malware payload", "value": "3c68e3d7a1eaf38cf4b4de68444cc005e03cba7ee86a76209f87efcf952d8211", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313379, "uuid": "3872926e-c70c-4702-8637-bd47a81e941b", "comment": "Malware payload", "value": "a049ebfb4cae3067fe67d83c059dd5f90e2d7d8e", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313379, "uuid": "85a2558d-8125-4718-b9e7-71a0be18077c", "comment": "Malware payload", "value": "ea40147aec053fa2bb62c46d8f2562312caa629ab6924701d9d15cabe7ba6802e556553bdf3f7c3e94bbfa7a5d6bcf58", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313379, "uuid": "ac286fe3-77a7-407c-ab1b-20f7b002a3f7", "value": "T1B6443C5BE3C0022914F23316EA8DA4AAFB15C57C53139224BEAD9618375E479A33F5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313379, "uuid": "e0e08a2b-3a10-4081-897b-9e6036e495c9", "value": "6144:PWuRivhnzKPG/cqicqYmR2gAn2O5ZZsAYm:EOqinh2gAn2OryAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313379, "uuid": "a1c83e89-8c4a-43b7-bf10-965ebc950f95", "value": 266321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313379, "uuid": "03d6baf7-2400-4357-8c30-84bde2270aac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313379, "uuid": "3b207e64-1e61-46ba-9bb5-94643d9c9c4a", "value": "3c68e3d7a1eaf38cf4b4de68444cc005e03cba7ee86a76209f87efcf952d8211.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ff3405-0c02-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771334172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334172, "uuid": "39518d05-b79a-4783-8e1e-135f0493dc29", "comment": "Malware payload (Mirai)", "value": "c2a76f69b508c488420941f0bb9460f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334172, "uuid": "915bcbe0-3843-4a6e-a712-f0e94e32e47a", "comment": "Malware payload (Mirai)", "value": "3cbaec0997d87e1ec3ce721af23ae6d3f02135af8966f9c5f6c807108c8cfd34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334172, "uuid": "03b389c0-9dea-4e06-b63a-ad89724744e6", "comment": "Malware payload (Mirai)", "value": "95862234fc38c13d1ba90105de004c4285350b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334172, "uuid": "a2433853-8dcb-4a6c-9a5c-f17869e8d37b", "comment": "Malware payload (Mirai)", "value": "b2dd2f63460c89214db9542ab68df9f4ec6ac8aa8903e74d5adb6b7fee67d67b6051aa3aa9a80a64ac980090824e34bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334172, "uuid": "a68bf547-4fd8-4f38-b5dd-fd81e32423fc", "value": "T17EB3E91E2E25CFADF369C23587B78A21975833C62AD1C685E27CE6011F6034D245FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334172, "uuid": "c8d24fd3-d624-4b96-a048-4c45ec146f00", "value": "1536:jb18dXJDiic2g1HSLBKNYSxKqxKT9KcizsqrxTqRhg9nIeC2+yEW9gyCoQ:n1O5iic2NBbmsqrxTqM9nT+yEwbCoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771334172, "uuid": "5d6c0648-eccc-487e-90bf-91f3fbb07db3", "value": 110420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771334172, "uuid": "6462eead-d1f1-4e2e-9425-434df6792333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334172, "uuid": "0e14bdd6-cbcc-4bcc-94b4-ea5d652fb27a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5becb7e-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343112, "uuid": "ba44fdad-2860-4494-be45-ae6d33db75aa", "comment": "Malware payload (Grandoreiro)", "value": "a91dfd976d2ab1b640294d2c77109370", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343112, "uuid": "d2f79f25-0457-404e-b73e-5b107dba41a8", "comment": "Malware payload (Grandoreiro)", "value": "3d18af14b991648914df5d5c571d258739070b1793b2922e06d25ac23ef4b0df", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343112, "uuid": "ca8bceda-4ccc-4916-8541-d72bac39250f", "comment": "Malware payload (Grandoreiro)", "value": "69fda101ec5ac3770963476c10f915d426e63a0d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343112, "uuid": "c8c55748-38ad-44d9-b112-71c3bf60a360", "comment": "Malware payload (Grandoreiro)", "value": "f83dcaed356699e6898d3f3ee51a21a3530cc4320b7bc156deecd55b6a093076feb3f4ee4f74b4f51f3c45e138b62ec9", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343112, "uuid": "4b3da899-f44d-4b40-9256-a24cbdc457ca", "value": "T152462332AD511C6EC5940376772E3B266F7CA63307CB89C76CDCA6062B46DC1A93E84D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343112, "uuid": "ba26b03b-df7f-401f-b6e3-732d0044d686", "value": "49152:EXESdocIiOt9qQBJ7Tmau8wcXBVg4v/et3mNJhzX0ZnBFdwyFLc/xIEg7uyJQf+j:8yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343112, "uuid": "c03bb1a8-c778-44f8-87a8-952bfa58b44f", "value": 5744640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343112, "uuid": "e657d809-0798-4b94-baeb-9bdb320895c8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343112, "uuid": "c1e5b69c-a006-422b-9beb-94866770c58d", "value": "Bal-AnJ88B63ZLYT7530_31614P.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98547fac-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341801, "uuid": "047b632d-fddd-4bb8-aa50-46a1e30d7058", "comment": "Malware payload (Grandoreiro)", "value": "141c6e34f0f5cd63f4dd3f89ed55774c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341801, "uuid": "f37ebce1-8d42-4a99-ab54-f166aec9060e", "comment": "Malware payload (Grandoreiro)", "value": "3dc7caa81fe3c4979e85192914c522a87c38a664331f0d8bdf6d1bd73fe20f4d", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341801, "uuid": "ab8aff5b-b61c-441d-8e11-82b3b14ca496", "comment": "Malware payload (Grandoreiro)", "value": "257d17dfd9bd5eb9c62287e54ec7e1ae27204894", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341801, "uuid": "fea5f20f-f3ee-4aca-99ef-265338202767", "comment": "Malware payload (Grandoreiro)", "value": "22e6ccf95f32c409cd75603f14c5a6c5d935b3b6e6b78806b5018abc34fb3f3b8d1aca2c596779b8651749f50aaccc4d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341801, "uuid": "c17929b2-d549-48c6-92d2-4d49485e97ea", "value": "T125362332FA80995EC5018F72B13D3B315EBDB21786C859C275DCD2927347EDA6A7E880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341801, "uuid": "8889c82d-eb2a-48e1-9fda-32a1f3a685c0", "value": "49152:ik3mBczHwmUjhzRrI/fHymGXF3oE4mBbfQAHOcFL+t+Dv9Bt2oqE:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341801, "uuid": "c5e2c77d-5693-4c6c-ae52-243a4799f9d9", "value": 5269504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341801, "uuid": "60e570d7-81c3-4d50-a1bd-f9607307d212", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341801, "uuid": "e14b5890-cdc7-4389-83e9-485b7366ef71", "value": "MFEASYX6X5I_Ct-919982YE56LY.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4d8c98-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771344009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344009, "uuid": "27d5444a-b3fe-4cac-a1c5-fc53fa9826a8", "comment": "Malware payload (Grandoreiro)", "value": "29669a64341688a04eadc03c1fddca37", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344009, "uuid": "fdd0c8e9-833a-4f90-881f-f8044d364844", "comment": "Malware payload (Grandoreiro)", "value": "3df59cbc31ecb11454202fb9fbbcc1841e0145a1552ad5a91159b4b1ffd7d127", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344009, "uuid": "3682cc26-64b5-42e1-b7dc-df42200e3c66", "comment": "Malware payload (Grandoreiro)", "value": "fb8ca5d72d8296e1bd60865798518cfa994ce08b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344009, "uuid": "669fce05-c3a3-4d68-ae34-a3ee82b81582", "comment": "Malware payload (Grandoreiro)", "value": "fa739982e66aa51a116dac5067e5f4f23362fc058495cf91e284ac39e3072f3eba37422ffbdd9fae9d4f65a18bbc25c1", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344009, "uuid": "53d6527e-a430-47f6-aaab-4b728d1fee1e", "value": "T1C6662331FE011D97D9908374706F2E365E3DBB038E8DA2E774DCA2463B46AC6863E465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344009, "uuid": "1ffa51dc-9db2-4c76-9928-3001573386f1", "value": "49152:txRxvVPCNFft4HE1u+DrSzrEKHFkr7ZLHQAFhCHvkrEfWYt8q0XRFSotl/T0fRXh:ZvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771344009, "uuid": "d01fd973-73ad-4edd-8738-4cdd5a1624b6", "value": 6920192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771344009, "uuid": "9197133f-5143-49aa-b7c3-10c63cdfa660", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344009, "uuid": "414b096a-9bf8-49d3-b462-b541ba3d0736", "value": "Prdc1H823A_152160QNTKJGZO2Myzksz.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f43ee2-0bcf-11f1-a129-42010a9c0007", "comment": "Malware payload (ArkanixStealer)", "timestamp": 1771312318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312318, "uuid": "e6b2e29d-1174-4985-8799-74b7dc5c2dd7", "comment": "Malware payload (ArkanixStealer)", "value": "1db33d629bbe34f766bbb09c5fb4e82a", "object_relation": "md5", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312318, "uuid": "42f498d6-287a-4f10-b3e4-b6f0350d25fb", "comment": "Malware payload (ArkanixStealer)", "value": "3e4d3879fe64dd0b825a9359e91918184cfaead050f1e60a3c837b4d33c3bf5d", "object_relation": "sha256", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312318, "uuid": "43d6cdab-27e8-4180-a934-ae38edba3523", "comment": "Malware payload (ArkanixStealer)", "value": "9de0bf21b98f0a80e41e871cee18eb3e50d448ac", "object_relation": "sha1", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312318, "uuid": "aa995663-e2d3-4754-b47f-ec5a439e19b9", "comment": "Malware payload (ArkanixStealer)", "value": "f4d5156372b123f64e2851bd72832650dd5d530bca260c4a2b03fce42e1da2472509b1af4ed435e30ac95a45aa4bff7c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312318, "uuid": "07bd4eb4-6755-4f00-ab8d-7e3c90bb1557", "value": "T1E56733A993AC1D32B834AD37180A14B1435274D99D39F08F6945AB0D9EEE2DF9C41AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312318, "uuid": "3d1bac2f-2bc0-4637-82a2-36c9e8fd0cca", "value": "786432:HvczsvKsNISPr5XVIr9qNZOyCu1Lwf7GHNGHWId4TLOhj8UexV7b69:PczsvKWISPrlC0ZOyr1UzANAWg4Ta8UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312318, "uuid": "7cb3f174-fd53-4d18-89f0-dec2a9cb1b84", "value": 32085471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312318, "uuid": "81ea575a-5967-4cd1-ad17-cedb4b1db77c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312318, "uuid": "cdea0789-a4aa-4fe6-ae3c-777f10ddab7f", "value": "f6f1636a2ec7cca4bde454be4f43986f70723ccbde3bbd80c14c8f8b8432c21d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5390358a-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342116, "uuid": "2bd92a22-3b90-44c5-8d00-24db76e9f89a", "comment": "Malware payload (Grandoreiro)", "value": "8f20c701ee3260bc4c4c2571a2cbd7b0", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342116, "uuid": "385044a0-c3aa-44c3-8307-3db675057899", "comment": "Malware payload (Grandoreiro)", "value": "3e58d11dbe79bbf4dfd856244233ea82339f84aa744461d3bdd1b8ed72573761", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342116, "uuid": "7d235d10-97f0-4b62-9081-2a4cd5670327", "comment": "Malware payload (Grandoreiro)", "value": "cb30dc8c9ca20421836980e5a5915a0a747c812a", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342116, "uuid": "d8b6e99b-e1a8-4f75-a319-3eafcd348cf3", "comment": "Malware payload (Grandoreiro)", "value": "2533488f53bc11139e50e0c88ce411de6371bb32d9d3fe4aba0f010f336b8cf04a7471288dbeadebc546884984e325ad", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342116, "uuid": "dcf170ed-0ccd-45d3-9751-3134fc39f192", "value": "T1A0462335FF461CADC1614371B52E3922BF7EA2238448A6E6BCED81477346EC1C56F0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342116, "uuid": "9f1bf80b-92df-4fae-a8c2-f1a81c62e967", "value": "49152:9Q+NmZ7QW2ZCjWHjycXlSscPNm+Qi8IJZA0R0Fq5qhNpX0qh8iHl1zX/g9w8eMnv:2uim3Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342116, "uuid": "a2467455-a1a9-4717-a07e-1895054a43a1", "value": 5865472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342116, "uuid": "c150b715-f0fd-43c1-9ccb-539d9f4e519d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342116, "uuid": "0c78b55a-4587-4147-849a-3d7199fce639", "value": "3495Pag-82G3OIRAARynzvv_Trm03359JJ1E.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075576d9-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343276, "uuid": "582979a0-984f-46e7-8664-0b3417b0dcb1", "comment": "Malware payload (Grandoreiro)", "value": "0cdb2587c47d7571643c06266f6e9748", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343276, "uuid": "16311d66-7aa7-491f-adab-6adadf6f3252", "comment": "Malware payload (Grandoreiro)", "value": "3eb4f7553fb78a00eda63a05e50ccda8cb7d7716568f282716924f9c80079ac1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343276, "uuid": "1d7bed7e-8eb0-4800-8cad-7329e5c082fa", "comment": "Malware payload (Grandoreiro)", "value": "85d4a257c5e0e270bfe95bf0700b9504f57d468e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343276, "uuid": "006fb367-d7b4-4a07-8455-6b80d0b1dc6d", "comment": "Malware payload (Grandoreiro)", "value": "01f728dfc0a26953f85852e1b660f520af8365699d5a23c88f6d1b09e3b595a7d263b3a8dacc1dd832daf3c5019886bc", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343276, "uuid": "aa7e3302-a05e-4d5c-8701-b72160771eee", "value": "T1A6563332AF601C1FCAA48336B09E2F259F7DBA539749D6D674DCA0863B46FC0452F858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343276, "uuid": "88b3da43-72dc-406a-bd7b-4cc1be47f72c", "value": "49152:cvPi7L7Z79NL8Awp46UG+EWmXapv8nd1FLmfdjj8cqhZMrdbtroFAC4TByH0TryN:nyWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343276, "uuid": "412d5990-56b4-40dc-b2dd-3e35d23f3307", "value": 6313984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343276, "uuid": "d6fbb182-6b4c-4ecf-9915-889138c36646", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343276, "uuid": "d835e480-72f3-4280-ba51-db447d39d034", "value": "Not-Ar06964S810SFFURI63626.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb17691b-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342370, "uuid": "3ec8e0bf-1c5f-4b9a-83b1-92c9d2d3f3dc", "comment": "Malware payload", "value": "742e9943cb2dcdd480ac4636c48b113f", "object_relation": "md5", "Tag": [ { "name": "187-102-244-45", "colour": "#AA88CD", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342370, "uuid": "e9581478-9369-447b-b2f1-8befafda939d", "comment": "Malware payload", "value": "3ebc325fc4fad8bf9112c8922bd8781ceb61acb1b13a033cf73e62887d9a2fde", "object_relation": "sha256", "Tag": [ { "name": "187-102-244-45", "colour": "#AA88CD", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342370, "uuid": "eadc4e3f-b9b7-446d-bbba-7d250b6591ab", "comment": "Malware payload", "value": "fa6387130c73918332e34923ee1751d14a7c9c65", "object_relation": "sha1", "Tag": [ { "name": "187-102-244-45", "colour": "#AA88CD", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342370, "uuid": "d5449da4-8762-4eab-a40a-396243190ed2", "comment": "Malware payload", "value": "c4833f22a882f74cf2c21bb52909d02ed4864eb5c7dee507d35909244f23bd94f4ea3ae3c0b6fab682f2905587ac9fc3", "object_relation": "sha3-384", "Tag": [ { "name": "187-102-244-45", "colour": "#AA88CD", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342370, "uuid": "0c77ebf3-a616-48d5-827b-0e25a428b6ef", "value": "T175C612D7F7D9992FC87750B2896E56B2514B4C13CA438F43AD28720C28B75E42F4ABD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342370, "uuid": "c04edeb6-46c6-4387-b1a2-95259bef9bca", "value": "196608:iuCMDUpmP7v1AVtSiSZ7dCkQ2NWvRpWE0vcej7djo9y9NBnzh55DAHs:icUpo7v1AbDYBCkdNWvU0eFoyJljDAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342370, "uuid": "464672b1-b256-44b5-b4df-f7652c12e2ff", "value": 11890031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342370, "uuid": "dd017cfb-070f-4465-9db0-742a389fb978", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342370, "uuid": "8224cd6d-0dfa-4ec9-87fb-1f453d6dd499", "value": "Protec\u0327a\u0303oCard.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d96fd42-0bcf-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771312068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312068, "uuid": "df0786e7-fa65-45cb-ad1f-5dc1a4da191c", "comment": "Malware payload (RemcosRAT)", "value": "84207bd8e2f9e9075051a7d1333d20a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312068, "uuid": "c14f5a22-35f7-4775-b2d9-4f52737d5918", "comment": "Malware payload (RemcosRAT)", "value": "3ed1a8c4ec7d25272e0640c39c924848ffbc57856cde779a9a6af6e6058b57af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312068, "uuid": "d186b4d4-2dd6-40cb-9015-1728831e24b0", "comment": "Malware payload (RemcosRAT)", "value": "97a67b129ee14399632199249dea8ae0f90d23f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312068, "uuid": "c92dd97b-cc8d-4ac6-bf03-d7a8355b4a49", "comment": "Malware payload (RemcosRAT)", "value": "26b253945ee97fa845fe1789047e6d84628c32860ca30ad00bb2060835a210d1b5942962cca2a062710e7d3cfff713e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312068, "uuid": "29e59a90-c080-457d-b495-c9072eb9eacd", "value": "T1C57613330853B4B627E405655921DE4EF741B0C6F3A65B2E72A3C2FF49E4E29816CE1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312068, "uuid": "4c2008e1-10c6-4c75-acce-0efab511fa21", "value": "384:S7LOp8+40GJG3fFZSJSvSQtDSoZLa/aduUft:S7LOp8+40GJG3fFZSJSvSQtDSoZLHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312068, "uuid": "3427b01e-5f35-44ba-9c0e-a1da9764f17c", "value": 7264816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312068, "uuid": "455049a8-90fb-420e-8f6c-f5c66e7d5b3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312068, "uuid": "6ab1a222-d137-492b-b5c6-8b1483bb4daf", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24826fe-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352609, "uuid": "18906c62-e336-48a9-9ddc-1532b15edac6", "comment": "Malware payload", "value": "c6990b24e51c7c6da291a72751e32832", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352609, "uuid": "40e60a0f-3dee-4686-9453-38b89e16f9d2", "comment": "Malware payload", "value": "3f28cfe503de2cece534fe4bd011c56ce617d9fec645201863136bc8de7e2cfa", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352609, "uuid": "6c5d310d-3748-4f21-be1f-aed92ea83d39", "comment": "Malware payload", "value": "4361708cee87e49c5d4d7f710bf8dd4af7c22a25", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352609, "uuid": "fa9b3768-48a6-4a34-b2ad-f758793a81bf", "comment": "Malware payload", "value": "3170b0d7b0c23a957f4d6c287eb95e42b8ff0739197d87a09a2ec5082ad195fcc522c616b202750487001a8bb11ce1fb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352609, "uuid": "62375132-149d-40f8-915b-d7a7d4689135", "value": "T10F362332BA91696BCA5043B5B12F2E322E3D3253474CE1D2688DC1D23747EE79B7E950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352609, "uuid": "12114a1a-8f80-4563-9cca-90eaa1518b54", "value": "49152:L2AmNVd7DDpzJoSsTTt5uhnsMUL2bhpptW+wg8HT3oLRaKsVYA:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352609, "uuid": "521a24cf-2d2a-430c-a564-911d280119b2", "value": 5224448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352609, "uuid": "1ba97b16-e376-4a2d-b80c-6770858e81d1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352609, "uuid": "6859789c-c482-4fc3-b79d-6c51e5299bb2", "value": "T3PL2FQTNC_Acr60094-05E8.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5292a7bb-0ba1-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771292292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292292, "uuid": "5b192164-4011-448b-9466-2df0dde85054", "comment": "Malware payload (Mirai)", "value": "f00e3e3516e5907679a5f631d9301b62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292292, "uuid": "ce9d43fc-7948-4fa7-ace2-c6d2672d7f61", "comment": "Malware payload (Mirai)", "value": "3f8b336a91bbd34ea39e692a9f782466f4ee91a445455d6ec77d5cbdbbe3f44c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292292, "uuid": "a6159061-01b2-4142-af81-23648141ffb2", "comment": "Malware payload (Mirai)", "value": "f47177303ac77f9a9b38848b2af75814e4aeb6a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292292, "uuid": "6fd25710-dcb1-4c1a-89fc-556416fd2994", "comment": "Malware payload (Mirai)", "value": "f0d2aa7821104807618cad64cadfd0b3ee70518a4c5d652f29882b3333504c0a4f1169736263573a505e5ec4df5cb3a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292292, "uuid": "0e05e427-1a3f-494d-81d2-0d734a11cee3", "value": "T18CA31902B70D0F43D1632DF02B7B1BE1979AFDA119F4A580A51EFAC69271DF22142ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292292, "uuid": "d4de390c-5c34-4c72-862d-1a883a2bb5c4", "value": "1536:Zz2zw5g0WAnfK0Mc0Uq2QSuZMVkw2ZvlYUyodkJbeZ04sw8fv3hgpF1yJp5VxP:ZzQogP02KVktEZB54shf6+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771292292, "uuid": "3fdf00b4-e3ae-48da-a588-f7d04d61a286", "value": 103612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771292292, "uuid": "89e20a2f-db3b-432c-a55e-7ad937a2c19c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292292, "uuid": "70ef8d1d-9b06-47e2-876d-5b6bd72932e3", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e39a43-0be3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320672, "uuid": "5b0645b2-bfa9-4f7a-a398-e5934d6a142d", "comment": "Malware payload (AgentTesla)", "value": "bd3c18a162996c37a85c5ab03c81f270", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320672, "uuid": "b2b0672e-2768-41d9-90eb-44672fccaa40", "comment": "Malware payload (AgentTesla)", "value": "3fe475b0772828bc3c06bd6ab9a20f7eed4b51a1cdeef561dfca8d7b61de8be5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320672, "uuid": "fa774692-6b77-41f9-8850-98d905929111", "comment": "Malware payload (AgentTesla)", "value": "591e3074758ff88a04f9e758518e57e495dabfdc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320672, "uuid": "2fcba9ac-aa93-4d02-a59f-8f417addf33a", "comment": "Malware payload (AgentTesla)", "value": "89fded9a512dac12932939286242147ec5d34bced88ca2e999009c24179204307c6490548a14ac61535ca32f9614b654", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320672, "uuid": "71d2204d-aefc-4cda-808f-922c5cbd4a7a", "value": "T17C440E037E88EB11E1A93E3B82EF6D2413B2B4C71633D60B6F49AF6518516425C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320672, "uuid": "2445b9ed-9543-4d55-9e46-90b472f6e521", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320672, "uuid": "c6e55728-7a78-43eb-8144-dfc22f0a86af", "value": "3072:9Bz4yAumu2esPywzHvYs3h0P4SPEm5xrosS/Kb:aumu2esqwzHvYWI4SPEzskK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320672, "uuid": "af6a8d0a-a88b-4418-acad-a2abb718cb39", "value": 262156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320672, "uuid": "3edc10cd-23ec-4793-8c00-01a47d1ddd76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320672, "uuid": "8fc35cd1-3d3a-4483-85aa-d39d039bb8c8", "value": "3fe475b0772828bc3c06bd6ab9a20f7eed4b51a1cdeef561dfca8d7b61de8be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a835a9-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352664, "uuid": "27ae9b02-8ec1-4e23-a562-9809f27499f1", "comment": "Malware payload", "value": "6c393175f4aa3d8fb6c9d8073fe1cca3", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352664, "uuid": "c311b2a5-456b-4e79-81b8-c9180908966a", "comment": "Malware payload", "value": "41590f5f94a245ba7fe95bdc8b96d79c83866890e1690bf6f465e4d831833b52", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352664, "uuid": "a2278770-8269-4f2b-aa83-49aabcb88465", "comment": "Malware payload", "value": "6cf144e531bae62a63ba3603ecbeed8cec92425e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352664, "uuid": "11fb3952-3b13-4b8f-b8b9-73def462fe91", "comment": "Malware payload", "value": "d92e8de9747a25364b8657a247f6f28301f5ab0c54a6bb2f417df52a890d73466a94ebe2cb7a73f0319737fe8d70fe60", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352664, "uuid": "1d6d30a1-29d4-4608-aee2-67e4c91b4ce8", "value": "T1B66633726AD08C72C7980775B01EAE25BE3C76039848CA95B5ACD4C2378BFD0D52E5F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352664, "uuid": "12986bd6-d9e0-4f05-9032-aaed7c62e242", "value": "49152:PmG5It/rqvrMFoPV+H313xehGPMVJvkwsT4V/drNn0fFElNc24tYPrWEIc0Oznui:jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352664, "uuid": "901e7ed1-da93-42f9-a51c-873000c0f1e2", "value": 6479872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352664, "uuid": "8bbb4cfc-2c76-4f53-8348-93f99f5758b0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352664, "uuid": "e782c658-1a8f-4329-889e-5acc08cd36dd", "value": "Trsld93052MZBNU-3794.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c0fc03-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290813, "uuid": "b44eb8c8-30cb-460a-acbe-2768bda49d2a", "comment": "Malware payload (Mirai)", "value": "e50e06a664633fa1b167cb31b1c62024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290813, "uuid": "8666e995-537d-4c86-8627-3eb6778e0943", "comment": "Malware payload (Mirai)", "value": "4202cdd823b233ef6f344bdbadddd3092798ea16826a474a6f5422e9ecb316a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290813, "uuid": "d86273a7-113f-4323-9e8f-23db81b2fa90", "comment": "Malware payload (Mirai)", "value": "f143c26699369b2846640dd969a0852645a25c2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290813, "uuid": "10953cd1-6142-4328-abbd-8d818f5e55fc", "comment": "Malware payload (Mirai)", "value": "5d513870034386e9ba931624a3e814db45369b3351287c381cc7629ae9fa83e731ccfe1278bacec4647f7600a3bcb245", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290813, "uuid": "435b10e2-9ba4-4db0-bc1b-f6c4df12b824", "value": "T11AD47D5277218F64E361D67109F3CB619AA921A20AF284CA937CC6207B5176D3C6FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290813, "uuid": "78f559ba-a228-4f82-8995-d11bbdfa14fa", "value": "12288:a0Q0HecQ0xmi9nQdUjrm4hDGZVLU8wgpjyndtU:ThHec9xXFG4hDGZVg8ud+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290813, "uuid": "85e005bd-8482-483e-844c-b8631a6bc25b", "value": 597928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290813, "uuid": "1dadbb04-ff83-4ef4-a438-fc3544810cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290813, "uuid": "f1152fb2-956a-4c1f-9d78-edbc4cb127e5", "value": "miraint.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31c6daa-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771344021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344021, "uuid": "da4cef59-5137-4195-b127-c26d0313e332", "comment": "Malware payload (Grandoreiro)", "value": "89c0191cc5e9ee772b2700d59d7471d0", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344021, "uuid": "6736be91-1e3c-44f7-8591-6eee077e5998", "comment": "Malware payload (Grandoreiro)", "value": "427843aeae23849604b2edba7de6dc5b22dc1d98bbcd0f945f4669a4ab1d6aa7", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344021, "uuid": "073d2b45-106e-41a3-86b8-2977753a0e1c", "comment": "Malware payload (Grandoreiro)", "value": "f6843d78873d1a310b014ed203ae2976666317b5", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344021, "uuid": "14e0da1c-993e-4ca2-88c8-411f5ee95398", "comment": "Malware payload (Grandoreiro)", "value": "028cb74373da3df4c43fc0d53c920c32667e902a29a16cfe834e82c6ecf8af83d0373fa891557de8e8b0b3e65432d83a", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344021, "uuid": "92cc1c07-6f37-4391-a353-12e37eb65d4c", "value": "T1746623321ED9986FDA94833AB52F7F225EBD7613458990C23C5D8186374FF809A2F0E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344021, "uuid": "242e9f1e-479b-4b6d-a421-18aefbb3ca5d", "value": "49152:Ru79eshbUPaBztAOqT9YP4WFWr6UinF3XP7wLz9MtczWvtBdYOYmVDQmYNcD84wH:d2CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771344021, "uuid": "947fbc80-c4d2-4a9a-9d0d-03b3e4a9f38f", "value": 6496256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771344021, "uuid": "320d8861-b9dc-418e-802a-27c5574e377f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344021, "uuid": "2d81bdb8-d14c-41d3-ae26-5ef8c896dd3f", "value": "Prdc52P8C_7378FDSAFY88PE4cbcdtg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ac0482-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286949, "uuid": "bbfdbff4-c689-438a-8bc5-a499e663c81f", "comment": "Malware payload (Mirai)", "value": "26823d4587d1988887f4021776a938ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286949, "uuid": "68747431-3964-4e45-bb2e-c3e43a49ee0d", "comment": "Malware payload (Mirai)", "value": "42a838a30674fbe98000a59d99697ba6f874e07f422f0c957c832f64af8d3b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286949, "uuid": "007f38c3-5441-43ad-8891-5214e0c47b03", "comment": "Malware payload (Mirai)", "value": "d4cbcdfe9ad8039177ad25c1e17ad5c651ff379c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286949, "uuid": "8af99589-9649-4347-8bed-5a4c6e782f05", "comment": "Malware payload (Mirai)", "value": "4a9960d8541d3f4e437c3229ba402c45413cc8771b02264b60e6d8288e3de88cb5585c2c0f136f7580c8850d5817bd6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286949, "uuid": "38534938-6b59-4809-bb5b-02439c2660ee", "value": "T1E3331A56FB03CBB3C84301B102EBAE6A5D31FEBA5871DA85F3647DE4A6124D07502BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286949, "uuid": "e580884e-508e-4dd2-8b90-f198dc3190c8", "value": "1536:jITcfGPwnVjAWnpdzTk4S3um7qasEGWqejlE:kcfGPwnVjAWnplvS3um7hPzRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286949, "uuid": "1cb72927-c5ac-4ba5-af1f-c60c50652c42", "value": 54704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286949, "uuid": "0dc006fa-421d-4ad9-9a78-5efd4e54d2e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286949, "uuid": "c45c7058-7fc5-417a-9467-40482975f1f9", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4da37bf-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348399, "uuid": "797dbe42-9f60-4727-9d9f-8f5ecd88b197", "comment": "Malware payload (Mirai)", "value": "d9501c59308abc0b34444b78065bc640", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348399, "uuid": "5cc2aff1-f12a-42c6-9025-131f0b3b9c95", "comment": "Malware payload (Mirai)", "value": "440f3b1c953e07c851537c7d6871910e51d4deecf34b4a56ba9d19c0de39dfdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348399, "uuid": "d55c03af-3963-4289-b106-5f46568ed706", "comment": "Malware payload (Mirai)", "value": "760ac617e19aaf63503eea11ddc6ed249ef98c9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348399, "uuid": "22c6b2f9-1e4d-4f65-8e23-e42c0dc26734", "comment": "Malware payload (Mirai)", "value": "219798128d914b20e00d486c72fdc88061a2c2c8b728042deb8c1be53da0a4d059906df1a8a78f2f3f2708dd19754a08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348399, "uuid": "3eda5500-95fd-4f64-8599-d194929dbe91", "value": "T16494E149F64B3D42D9D7E535048AC681075EE4AB33F393092B47A4BB38693B24F29389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348399, "uuid": "5725b942-853e-435f-9935-c9a77769ce00", "value": "12288:n/H/ypxZaVtJc3ohj0J9U4CnWgp+4tz+:HyxZa630j0JwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348399, "uuid": "a5d6fe94-491c-4144-820d-4bcb9d25c308", "value": 443872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348399, "uuid": "6e2332bf-5194-49ee-82e6-b1f12d733b32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348399, "uuid": "f2d37279-3ca6-40dc-b17a-f289a4244a90", "value": "armhf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26b647a-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356502, "uuid": "c4063cc6-483c-40f8-8cf6-9539caeeef52", "comment": "Malware payload (Mirai)", "value": "9985a4ea8694d1a571867620a1e69267", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356502, "uuid": "375ca944-e5fd-4f26-a60d-9df5ad91665e", "comment": "Malware payload (Mirai)", "value": "44322d14d97328e30be54e88cd9d08d83b9d7d60166768dc26771ec152b01522", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356502, "uuid": "57e43837-72bd-406b-be4f-ecff1b70af09", "comment": "Malware payload (Mirai)", "value": "b9c9676547def54575a82bd7efbc3497c7621bd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356502, "uuid": "05fc789e-9143-42a7-b9be-ec82a9038cdf", "comment": "Malware payload (Mirai)", "value": "845d98d8adc7fb78f2204efe02f6a6ab9e31f9e6eaf8db6c1cba73e1b1967680a21a06f133e71269304fb5e3e8cc34e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356502, "uuid": "a08deda4-46f6-4b2d-bb72-69442775cb62", "value": "T1E7430795B9824667C1D022B6BA9E568D37B263F9C2DF7617D8200B607BC990F0D77F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356502, "uuid": "2bcded52-2669-4c10-8201-9a9a8526d0e6", "value": "768:hMoryOiIY6TmaWxgz3ujADLt6FInJl5nk+Lt6OkStjv9dsFYAmo1iiOwj:Pmoma8gL6F6Jl5nfZ60tj16pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356502, "uuid": "21ac673c-811f-473e-92d0-220aa79ffb6c", "value": 59148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356502, "uuid": "1db37e90-d58f-412d-a640-554784889332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356502, "uuid": "fbe544a4-aba3-4e5e-a6c4-18124e53baae", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490f224c-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771290558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290558, "uuid": "e2cd7dfb-584d-47bb-953d-6f1f24ca23f1", "comment": "Malware payload (SalatStealer)", "value": "c668f02850facd12315eb60db6dd3453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290558, "uuid": "621b5e64-bb2f-4aa0-99e6-8b3508296581", "comment": "Malware payload (SalatStealer)", "value": "444987e6fdd5e55de0ff4b4f868430786ea6fb363cb8254941c35ea6f2028e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290558, "uuid": "1187f321-8e84-4178-8e41-5317f87e16d0", "comment": "Malware payload (SalatStealer)", "value": "1af699242244a12570c124b1f0d6d3b299523d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290558, "uuid": "78f1261e-3b66-41bd-9e2a-6e2cd1ec3783", "comment": "Malware payload (SalatStealer)", "value": "d88108ce2a15bc3b71f9739790ddf31e84938f7d81e9ee9d8ab5258b4ebd91fb6fe220a71eecc7e464787ac91ff5d561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290558, "uuid": "19ec67d1-533c-4de4-855f-47e0b64e8528", "value": "T1A9C66C01F9CB96F5E9035831405BA23F63315D048B28DBABEB547A3AFC776832D76606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290558, "uuid": "c23319a8-0c6b-48ce-9666-8062f63c98db", "value": "98304:qzaoAfesvfX8IF8K6FMn9uC76aAZyAvIV:rxX8IF8KqtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290558, "uuid": "265f0bab-e487-4ed6-b362-7dc8eebe2061", "value": 12108800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290558, "uuid": "331ac872-7165-48ff-99a5-d5385e954692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290558, "uuid": "76d72ecd-3d0d-4800-8ccb-1c88e8c6f52f", "value": "9bmjwp9o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a383aa-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342122, "uuid": "77142481-841e-4ca4-86b7-56a00fe03f54", "comment": "Malware payload (Grandoreiro)", "value": "ba397132e22105d1959347f478ae30f7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342122, "uuid": "46f43fc9-dac0-451f-a205-92ac3b436a56", "comment": "Malware payload (Grandoreiro)", "value": "44b909794474331d95ef88dba47bd9bd43e68eeae197adef2438d07c488eb0ef", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342122, "uuid": "9d672554-2580-4bac-ab2f-4dec7a0b064b", "comment": "Malware payload (Grandoreiro)", "value": "b66ad5075d6a63f22521677b7d0f6c0e836028e6", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342122, "uuid": "fe74adcf-96c3-4dbb-bda8-9633fb3e642f", "comment": "Malware payload (Grandoreiro)", "value": "6fdb46a10d4afdef3b0f712fcf482bf4dd1fa5392f3b7ae8730d377071e59ccb993793fc1478a769b3f2d9b1219f5df9", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342122, "uuid": "ad0e0746-cb9c-4abd-9d0d-8b49d465d330", "value": "T16BA63332FE556C66CB548338B03F7B264F7CAA13028ED59639DCA1C36346ED2592F099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342122, "uuid": "d03c0df2-a100-4222-afe5-5e93dd4d654d", "value": "49152:9WAqthpPvWflyMj4/foFYAocerPmi341whWYYiqbcfh2DtIrVxC5BuEBn4xP1Z0e:gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342122, "uuid": "2dff3217-13a0-4315-82cf-bff4093783a6", "value": 9523200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342122, "uuid": "0d8ea39e-70ee-4b39-8ed3-b6229d47a95d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342122, "uuid": "b33b380f-d252-446c-aa82-14dbcabd96eb", "value": "37445VXNVFQ76Uojdydb_Cpd25067.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a12b7d-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351776, "uuid": "7705de16-e8ab-4763-8e80-1050a7340760", "comment": "Malware payload (Mirai)", "value": "1cc08ed79c40d631ea62bbb50922f827", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351776, "uuid": "aa762281-ecee-44e2-8b7a-635eb8a6d5fa", "comment": "Malware payload (Mirai)", "value": "44da2bbcdf5c9317bd357df44f62b93de9186499a59530c4d248dbdfb1d86e3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351776, "uuid": "596fec34-9000-41c5-ba4b-3a1dbdaa23f2", "comment": "Malware payload (Mirai)", "value": "8ec62f5cb4f5383ed76cee17725f65bb8aade220", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351776, "uuid": "5b3efcf8-4b76-495f-bdeb-328da8f4fcb4", "comment": "Malware payload (Mirai)", "value": "74c355b531abdd08f50d4426dee1903a9f3ba4b630db7b510738b60c093ca9c3d60058537891e3f385f4a4b6b01d7ecc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351776, "uuid": "25204699-e309-423f-b17b-8f6910bba01b", "value": "T1E4233BD9B801AD7CF95FEBBE8026490DB621335051930B2B63B7FD936C321A46E63D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351776, "uuid": "6c7605aa-4865-4210-818e-556b82ffcfad", "value": "768:yLeD1MYbZs5paE+IXEMK10+LxdbuzWenXpIWxJTqE2Lc85Z:GAaY+5peFR1lxdCzp5IWxJeE2w8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351776, "uuid": "fd9fc321-e669-4064-9bcc-1579eaccd37b", "value": 49804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351776, "uuid": "75a68b39-2529-40e4-8d7e-9c8a5cd9e327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351776, "uuid": "8003106a-1779-4f17-9e11-907796bc12a7", "value": "hoho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73282f21-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341739, "uuid": "f06a31c1-74bf-4913-b267-08619e581e25", "comment": "Malware payload (Grandoreiro)", "value": "5be560768014273c4e760099768805c2", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341739, "uuid": "35854703-955d-4291-a891-bc27e4d018fe", "comment": "Malware payload (Grandoreiro)", "value": "4515596cfc4834855541594a9a5256cf4247265b23b4178a582a384acbf4b64a", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341739, "uuid": "7739b510-bc71-4533-926c-e6598bc99407", "comment": "Malware payload (Grandoreiro)", "value": "fc142545a3246c1b9b4a02a9bd98bc3f8ca4b412", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341739, "uuid": "9ddc5601-2597-405f-a924-983216c9f9e6", "comment": "Malware payload (Grandoreiro)", "value": "705dfe38531672480c4a27e24163a83d2b1d4b9c9a00a79b8205632b4d912fad68dbbd5b5995c4d04d172dd3b041ca73", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341739, "uuid": "70834c37-a4fb-4b9a-bbe9-f62f39e23962", "value": "T15D663331BA455C5AC55043B5703F3F2A0EBDB313468CE5C2AAED61933B87EE1627B861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341739, "uuid": "810885bf-378f-4666-aa37-d367ff902b12", "value": "49152:XzAXBMeovRU8qb1dw8FXlfxrDtMlX7AwYv2DWITQeWQ9dBi8h0QKxSfYRuBOUjwZ:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341739, "uuid": "087eec51-9584-4d4b-8661-1375aeb5ce99", "value": 6883328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341739, "uuid": "a491d098-5f9d-402a-a215-3fbeafd449a9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341739, "uuid": "b8f08f65-cb30-4413-9e30-be292fa1ef8c", "value": "0SldMEF765BVXP-2316JRGECCHUsgmepo.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ab9720-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342169, "uuid": "d35e2a8e-8c61-443a-8df3-bb490c9b673e", "comment": "Malware payload (Grandoreiro)", "value": "c5241b1fe86e7391961a5552572e0657", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342169, "uuid": "e2997589-55ca-46c7-b7a0-88967969e9e0", "comment": "Malware payload (Grandoreiro)", "value": "4516929dfcb872214937ed5452011885d27c049478b59a18c09faf79c96b78e2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342169, "uuid": "ec17fc87-a443-43ab-85a5-ed44125ae2eb", "comment": "Malware payload (Grandoreiro)", "value": "649693f51efb141ac39ae4f741e53f3055eb5ee2", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342169, "uuid": "915d7506-6eb7-4dc6-9fae-1963aeb1ad26", "comment": "Malware payload (Grandoreiro)", "value": "db5b2eda1f688522bf53660c0f6595c04faa563ecbac4c710d10a8f44290a5a6e9b7ff4da00badba24957f6ca95e7a00", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342169, "uuid": "44cb7c5c-cd9d-4263-b4de-3e73160060d4", "value": "T115663331EE51591AC7908235B02F2F345E7C7A63824CEAD668ECD1473B8AFC6C53B865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342169, "uuid": "dc0d6715-f392-4095-a652-ec378788c96f", "value": "49152:Yje7X9B8ZLnNu2/TR+qR/yPwpfcS8+cpl0suXqdVS/siREo4dcoiLbSq22UKSPXG:FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342169, "uuid": "b67877d9-7e08-4913-837b-ae838ec7d039", "value": 7034880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342169, "uuid": "9422c97a-1929-4a2c-8a90-d705f814d889", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342169, "uuid": "099a18b9-4a75-4955-a6a6-a85f73b186ff", "value": "4VGO_Inf-Orm034883TYYKBQ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195699ba-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352326, "uuid": "5d4e7d6a-3da0-446a-811d-fbf5348cebbb", "comment": "Malware payload (Mirai)", "value": "eb95189fbbc7df433f67bbda56382e7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352326, "uuid": "0c394989-f781-4603-99c0-e053f730b970", "comment": "Malware payload (Mirai)", "value": "454c43282092e21f5471cf3aaedce6eeaef54216508a4104db773f058daa32fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352326, "uuid": "5617df63-50cd-4812-8087-97fa51d034bb", "comment": "Malware payload (Mirai)", "value": "db4dee129f95dd8501f169f8ad16428992a81fbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352326, "uuid": "9e3378ce-941b-4c86-89ba-91cedf0b0cea", "comment": "Malware payload (Mirai)", "value": "e1f08f8b6f8773cca46e6eec4640f74e91f6d10d464fea9f034bfb4485aa4249cf0de7fdb20a0e0fd254b4d3dfa51fa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352326, "uuid": "dacb169f-d9e1-4ca4-9316-85c64a9fc610", "value": "T1893318D6B401AE7CF95BEFBE80224909F531621151930B3B637BFD936C322A58D62D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352326, "uuid": "21ab97f1-ca95-46af-866a-0a6c31635bab", "value": "1536:pUrztlv7LlNvYOJAPz0CH7n2q/CVX5/9r8c:pU7lFYT0A7UX51n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352326, "uuid": "45adb3d0-f6ca-41fe-b182-a27a9f81e5f7", "value": 52500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352326, "uuid": "5c4ccea0-5e28-4f7d-acb9-091435ed0402", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352326, "uuid": "f8099b6a-96c4-40ae-b7b0-9db959098298", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df639a5-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342214, "uuid": "e69ccd3b-d5eb-458f-889f-e7393bef6b1f", "comment": "Malware payload (Grandoreiro)", "value": "40f1476117581a58c37672b4f5791844", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342214, "uuid": "40a98873-c35a-4dce-96ee-af7dc082f16d", "comment": "Malware payload (Grandoreiro)", "value": "454e43b0da0dd8c68a56086b487337aa6dd8952d098a4e1185e7dd2899beade1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342214, "uuid": "9a45af80-e2a7-42f0-9a37-bc2c9353441c", "comment": "Malware payload (Grandoreiro)", "value": "19e5e8196397177d6ed8592a9248d0782cb7a589", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342214, "uuid": "3452db11-ad11-445c-85dd-a399ec934733", "comment": "Malware payload (Grandoreiro)", "value": "5285e57639b7b9dfa81bd6a34b1675ce4997be08b779afb2771163ff312a569f6085529f38f2ffe7a1feaa89e1479785", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342214, "uuid": "6d284057-0332-45e0-b641-b9154c4d4565", "value": "T188662332BE601D7BC6908739B06F7B384E7D6A17878CD4CBB49CA8873B45AC1143B959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342214, "uuid": "7227259f-ad0b-4e7d-97fc-d30ace619d0e", "value": "49152:B0erO8LyodqwMwYS1M5rgdV+ER6+DZlm++ii4a+Z5by/yafj277INDbtQaA8gEAe:xWufxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342214, "uuid": "d298cdfa-d3ec-47cc-8c2c-d122217c3e66", "value": 6610944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342214, "uuid": "8d29fee1-4bea-4923-9ba2-5a4189d1cf8a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342214, "uuid": "4937bc3e-248a-413b-8f8e-cfd956e141fb", "value": "6MJKS0Extr_1274HLRLEPER0J2G.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbddfdcd-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352652, "uuid": "7a863a1a-b68d-4e33-ac2e-c8fd29a9f96f", "comment": "Malware payload", "value": "8f8f693d64f4ee95e1485b4cffe1c467", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352652, "uuid": "10f7bc1e-7529-4bcb-8fe0-0b0a365313f8", "comment": "Malware payload", "value": "45547cc519789ea71767caed2ba98938b621d8072ba3b91c3c3d8ed7abe93266", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352652, "uuid": "50f4883e-982a-48d0-821c-3f00ccd33538", "comment": "Malware payload", "value": "fbefbf95b7b052d978c5c24e81a84b9fffb67a44", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352652, "uuid": "6cd49a98-e618-469f-a136-8807b5632f9b", "comment": "Malware payload", "value": "7d3668e6424356d96a436f4925127e7b855a01e314649ba4a1a596e84454ff2906fdef1176678cf95aceaa8805564c42", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352652, "uuid": "cf206d58-047a-4619-b2d6-54e297af18a6", "value": "T1C7362336AF41D86EC68083B6756E3A294F2D727367C862C33CDC85462747AC5CA3F496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352652, "uuid": "5abd0e37-ed66-4b5f-a7b4-9c31f1e3692f", "value": "49152:mqrQWrtSP2c2AANQWD0oy4N6bCqg/OxPx1ofF4SPxzi17aJrjq3jqw:Mqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352652, "uuid": "5668ec24-532d-4d11-aa6e-c2284e5c6edb", "value": 4868096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352652, "uuid": "aa3dd577-1cbe-489f-90b5-46597d676e72", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352652, "uuid": "5138c330-8f4d-468d-9234-e58548531047", "value": "Trsld158436OVORF-R3N6.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8eed20e-0bcf-11f1-a129-42010a9c0007", "comment": "Malware payload (ArkanixStealer)", "timestamp": 1771312328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312328, "uuid": "a12a4e39-77c8-4f52-9348-4e6465a2031e", "comment": "Malware payload (ArkanixStealer)", "value": "5ca8a416e606e60dfcf9be973b4b5a6d", "object_relation": "md5", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312328, "uuid": "b6a8cce0-911f-43ca-a23c-d3e9f95ec438", "comment": "Malware payload (ArkanixStealer)", "value": "45eddd42646074db6ac073119c87df0d2a597666fa75f33580fa611724adadf2", "object_relation": "sha256", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312328, "uuid": "68b2f36d-b273-4a3a-bc01-e81abcf3c958", "comment": "Malware payload (ArkanixStealer)", "value": "84ffd0356b5cd0780535d2be4f787b902552bcd5", "object_relation": "sha1", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312328, "uuid": "585cf99c-4b33-4f5c-a47b-e2b232027efd", "comment": "Malware payload (ArkanixStealer)", "value": "367ad662db0fd490954f4bebb4a720042cdd2ae02250826c3cc89ec541120883f67942e94038fc1891e7829783066dc4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312328, "uuid": "9a6795fc-6468-4d90-a43a-b42b04cd6bca", "value": "T18965021AFBA405FDE1B7D274CD524902D7B2F84A0760E78B03E459961F37AA09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312328, "uuid": "eaa0e816-8cd4-4f70-9174-01719b4a9d19", "value": "422edbf2d9563fd3f808b3fcc877a248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312328, "uuid": "a1c68751-445a-4bec-a00e-abb4459bac18", "value": "24576:psDQfWex9NF3yWgT0rAhpkyJhkXxOMTLfdG8nAuuz5suusot:p9zxR3fPr6TgXxOSzdGiHuz5ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312328, "uuid": "93f5046d-7c02-440d-813b-c83c71d99d73", "value": 1451520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312328, "uuid": "45cf0b18-c365-4b22-9631-671f7a47f580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312328, "uuid": "41753b03-abb1-4ddf-9274-0439509db5b9", "value": "45eddd42646074db6ac073119c87df0d2a597666fa75f33580fa611724adadf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5180e9c0-0bfd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771331804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771331804, "uuid": "c95f9f25-5b12-4599-bd7b-dd2f6c00d1bc", "comment": "Malware payload", "value": "96582f898b54363c49889a0b18ab273c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771331804, "uuid": "d7c42e43-58e0-46b9-96fd-9af394050cc7", "comment": "Malware payload", "value": "4644d33f3c434fb4d8cacac6d8c302eff28b50453e539943d521d16a285a6031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771331804, "uuid": "c2b4bbb1-3e3c-4815-97cc-67e39f1f98c8", "comment": "Malware payload", "value": "f13bff8bff58393744bdbc6b769b0c871f8b1c77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771331804, "uuid": "6d0897c1-164d-4c4a-b4eb-abb4b370bbaf", "comment": "Malware payload", "value": "189af337fbc680ac79f9e482294f619f30e3a64fe79d1f886ae9ddfd4eb1632397ae205f9e4e47a7627f95ca0d42371b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771331804, "uuid": "ca2b6b5b-2127-4696-b2f0-9ef09c82a502", "value": "T10FD49DA6B3724F21D1892737D1CB8A4093A89755B1F3E34F718413E659023EEDE0B6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771331804, "uuid": "6738c98b-4131-4fb9-95e3-34834733c4da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771331804, "uuid": "01f9dbe2-703d-4c87-831d-499a8623383b", "value": "12288:e0DEUNgDkXXMf13Gl+V/EKkNpMSmLhY/047:ejsXMIlC/NkNpM1q/04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771331804, "uuid": "13fef432-69b5-49f4-95aa-da769b202d48", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771331804, "uuid": "83dee356-b7c4-45bc-9f7c-f0dfb30bd9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771331804, "uuid": "e4966c65-60e9-4c5c-866f-3604454f2742", "value": "Arajanlatkeres__2026.02.16.EKR.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bd538c-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342203, "uuid": "3926f60e-2dfe-4b44-a232-4ac192c61ac8", "comment": "Malware payload (Grandoreiro)", "value": "5bcb12569b6c8a6fec04dfd62cc3b925", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342203, "uuid": "d9056fca-7b32-4d07-9976-bbf7f412230b", "comment": "Malware payload (Grandoreiro)", "value": "46456f73393a318c2f72551c763796a57003c0595b0d0c0f59c1b0b340fcfa8a", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342203, "uuid": "3615dd57-464b-4297-aab0-890c0de827c2", "comment": "Malware payload (Grandoreiro)", "value": "7627ee5ee09eb5510424c609fdc4e833a18a74a7", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342203, "uuid": "7c77a28c-0139-493f-9c5f-6a10825142bf", "comment": "Malware payload (Grandoreiro)", "value": "b720761b24c03fe15627d2221c841a2e83583f4185ab416721abf900bed4f717c134d1e0c91da05663c6a4bec624adb6", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342203, "uuid": "6abfe973-9d84-4300-9373-6cfbc0ddace7", "value": "T1EE763332AA111CA6C940C738B17F6E252EBDB913438CAAD671ED45C23B46FD4893F469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342203, "uuid": "53ef51ec-41ae-4dbc-acc0-3a7f7ea9ce70", "value": "49152:oOWnM9hsw4anBiLX886g9Oj3hpullHceCJYRmAWCJrtxHSAJ2rRnD9nbQj2MhwrA:RlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342203, "uuid": "1d0b72ba-880f-4b54-bfcb-ab1f2f983d35", "value": 7249920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342203, "uuid": "e7321555-a53a-4098-bd3b-11a9a29c2ac5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342203, "uuid": "4d0e8075-ed39-4090-b27b-b34b72e98c77", "value": "6351ZVLVT_ArbiEZLD9-97970bsah.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2405be-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343147, "uuid": "8fe6ff04-03a4-4935-80e1-889d70868fd1", "comment": "Malware payload (Grandoreiro)", "value": "fba1febeb3d114b11b437a15e6512f8d", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343147, "uuid": "77d3ce14-f4b7-454c-ae18-ced901123d71", "comment": "Malware payload (Grandoreiro)", "value": "4650b3bece2424dbcc8e716015c5a6c86bf581475c5eae2e5edd800edbfd8cfb", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343147, "uuid": "84a75768-d4a6-4e13-8d0f-53d3daf71fc4", "comment": "Malware payload (Grandoreiro)", "value": "19d3ddda8eac98141633821d33260a9ee509248e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343147, "uuid": "ae70cc15-5217-4d96-a7e0-17acdcf254ab", "comment": "Malware payload (Grandoreiro)", "value": "7946854a130be1863f11225a09496b3a027cd78b71de2e1b09ef0161005907cda65890a0bf82f0f5fc67314da7e063e5", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343147, "uuid": "5a6b4769-2302-44be-be1f-98824ee91a7c", "value": "T164663332BF811CB5C6214731706E2A372F7FAA07844EEBD6A2EDE0477345AC1157E8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343147, "uuid": "ff2181f6-4a70-4de8-b4dc-8305d1396f9e", "value": "49152:c6SqwELA3uctbm7w53jbhCF+0tK+Lnz2dEDTx3Do40JBwMchAfaXIRDt/I/4JSp+:Quim3YJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343147, "uuid": "01dbe26d-6a44-4cda-bd4c-480a7b65f10f", "value": 7116800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343147, "uuid": "cf819d9d-e994-4504-be35-94db7ed60421", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343147, "uuid": "5891d950-9ec7-48c2-bf55-82e7afe5d1b9", "value": "Bnfc68716VGGAX-M3O6H6847gpvdce.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b853780-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771290589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290589, "uuid": "5468253e-7017-430f-a5fa-e371f72909a9", "comment": "Malware payload (SalatStealer)", "value": "43040756baa278cf5329cf02902c7c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290589, "uuid": "f8ba25c5-d8bd-4cb6-a6aa-fa416718eb9a", "comment": "Malware payload (SalatStealer)", "value": "466d5d9d2b9c1364fc5c4d34622295da0c6bd8dbeb2bb4bcc544ea9b87c1f828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290589, "uuid": "97e525a8-daf2-4620-ab36-6b33aea6d8fa", "comment": "Malware payload (SalatStealer)", "value": "fb9cc671ad038fbf27530367d02e798277be9e5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290589, "uuid": "8fd08e38-c5f0-4dde-bcb5-72639ebf2fcc", "comment": "Malware payload (SalatStealer)", "value": "232a2ceedd314adacdaa302f4996ed0b3b2eb060a1efba33a4b23a95dba2b697c2856282b9b0ef10d3dacd8d49297f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290589, "uuid": "9bfa0629-9f71-4b9f-a412-1c0fb40e77a0", "value": "T1D8C65B01FA8B98F5E9031835816BB23F63315D049B28DBDBFB547F6AFC7B6811926205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290589, "uuid": "2ba1076b-9f56-4add-8d7d-4855b6b6656e", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290589, "uuid": "f99647b1-6116-4620-b7c3-4f8c014f4757", "value": "49152:M4Eerqa6x8/sxqpbaRE0SVxB50VV8VXPtCm6v/qQ1vNLaBekKMRUQEpMpcAO8o8g:Fxrqakx8xWqQzaBPqwpgteDv6sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290589, "uuid": "431e9fab-c7f7-4571-9561-9d903d38ac01", "value": 11673088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290589, "uuid": "bb105080-222e-461d-aaec-08c647ad10f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290589, "uuid": "27981339-b911-464a-bc93-7f572775815e", "value": "x466d5d9d2b9c1364fc5c4d34622295da0c6bd8dbeb2bb4bcc544ea9b87c1f828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e9475a-0c33-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355033, "uuid": "e1620101-5beb-4ec3-a19f-f600cc0c1898", "comment": "Malware payload (Mirai)", "value": "603038ce3b27c05471b9f085370eb086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355033, "uuid": "3800aa47-8e71-406a-9589-dc4a299dd0f2", "comment": "Malware payload (Mirai)", "value": "46ae65277d7575676b07d7477078d9f85bc36b017992317e38de783e6866d3e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355033, "uuid": "0d167880-0f2e-40b0-b709-1356d64c7911", "comment": "Malware payload (Mirai)", "value": "9b1ae0624ad3985cc93dd2d5510470d84f8c4f99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355033, "uuid": "9ed97572-4b0c-494a-9b2a-a89f30feaf15", "comment": "Malware payload (Mirai)", "value": "878febff15bac965113a006cb3e6addcbb358e23effd61dc5f6dc1d5845f37c9467f164044e686b085eea27da3a432d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355033, "uuid": "836d0b9d-678f-4c56-ba1e-8c47ea2f2526", "value": "T1BCB3E816FBA10EF7D86FCD3742B9074528DC550A22E83B767974C528B14B24F8AE39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355033, "uuid": "6017a7fd-2479-4f0e-b844-077097eb9fa6", "value": "1536:SYyLIViIDh/qt20Ytd7TKiTbF7V2SunT/eu82XXgk3ZUtyZ4l9yEWJ:S7LIVDDRl3d7u20Wu8U3+3yEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355033, "uuid": "c347ffdf-ae94-4207-b4ee-1db33b1c88b8", "value": 114068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355033, "uuid": "931019e9-55d8-4ee2-b544-f0f3903b4d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355033, "uuid": "e096387a-1ec1-455e-996a-3297145366ad", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31651699-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349360, "uuid": "73b225ba-1a0a-4f1d-9edf-e93a91e6d162", "comment": "Malware payload (Gafgyt)", "value": "b5751ff8810fb16b6abe27d65a4b9d32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349360, "uuid": "7e1d358a-ac8b-4d40-a1c3-67dd9f6e0941", "comment": "Malware payload (Gafgyt)", "value": "472c532b18eef3e6eb9429f7da347d28fc89cb1447c84049cf459201a7d55cd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349360, "uuid": "a84f4d16-b03c-402e-90e4-9557a3cefdd0", "comment": "Malware payload (Gafgyt)", "value": "882c1e4a78d1789905bb67dd9093152e27c3887a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349360, "uuid": "c6517abb-858b-4cc1-b185-c7f4baf4aec8", "comment": "Malware payload (Gafgyt)", "value": "35846dcde0a47387ef62abadffff18a03beb18c16abb6cb32f116354b4dab6f9edf88147164953e78293205bc07c9c56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349360, "uuid": "b2af786d-4d96-4c55-9805-ef9859926415", "value": "T12CF33B04EA804B57C5E227B9F68B424D33239B64A3DB33155938EFF43FC2B995E26521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349360, "uuid": "d866242c-e801-413d-b30d-5beff4341ba0", "value": "3072:4dX8JtadqhjT2H6wugMcrSaXnpQEM/9yMZCmpwfFRQfVE:kXmtadqhjaHScrHXnpzM/91ZCmpwfFau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349360, "uuid": "c8d8d258-9816-42ea-9ef4-6be7648a26d0", "value": 164970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349360, "uuid": "47afa1ca-9af5-4326-930c-7ca42623c8d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349360, "uuid": "807e3f1e-bc37-4a66-9500-963b274feee9", "value": "armv5l.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f298ab0a-0c06-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771335940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335940, "uuid": "d12a0334-d695-43ee-884e-55cf8d09b5ec", "comment": "Malware payload (Mirai)", "value": "8baf99f821fe0aa410157e3d6a1781f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335940, "uuid": "f6b57a92-7537-4a28-ada1-d899bee835f5", "comment": "Malware payload (Mirai)", "value": "474bb1cd8812f6ea28f51f6d6f01e506ef543a1975fad440bc841622b5a23195", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335940, "uuid": "bf000a1f-ca24-494b-ba10-61e5de6462ff", "comment": "Malware payload (Mirai)", "value": "3a862342f46a8b667ff19a6697fbdd4943fc8c70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335940, "uuid": "60fa9e83-3afe-423e-ad5a-9db401c1a42f", "comment": "Malware payload (Mirai)", "value": "7df32719389f8f60d00c1b2925cbe2ed7047fc6423fc6fe85a6c48726dc6bf6c5433592d0e4f141275e1d7817dd19b47", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335940, "uuid": "28e36b23-290b-4711-9f4f-0c853c79b83c", "value": "T137F012EA61B6A9A7C2748E0470E14875E019D7CC7CF7DF8CD4AD0CAA4847B107214F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335940, "uuid": "6b35fc32-f149-4d4d-b329-fd0bd1216c09", "value": "6:b8Slc5kSlcxIbWrSlcckSlccd0WrSlctSlc1WiGrSlcPkSlcULhFWrSlcvH6Slck:bHIDbzFtdSpOithFzodLc0LK27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771335940, "uuid": "4cc0c707-e953-4a8b-9cda-b03d006c5be0", "value": 544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771335940, "uuid": "7cf303ae-38cb-4fd8-b92b-33e1b4c71e49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335940, "uuid": "9dac24a6-c6e3-4f4e-8093-7cc5a462fd0f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cef4cf3-0bc3-11f1-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1771307020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771307020, "uuid": "ac19d196-38d1-4e1a-928b-18ef1e3426bf", "comment": "Malware payload (CobaltStrike)", "value": "ea12cf548fcffac8790f31a614adca57", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771307020, "uuid": "08fcf74e-80ff-4e38-b6e2-d39bc3c375a9", "comment": "Malware payload (CobaltStrike)", "value": "478c33a64d55fcce7c037d5c351412857a0714c086e6e142f01efb05c4797361", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771307020, "uuid": "afc2071e-4fa5-4478-ba3f-044dddd9865b", "comment": "Malware payload (CobaltStrike)", "value": "98c4153b615f56bbea475423cdfdef81e18722d6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771307020, "uuid": "f46b9bb7-5142-4470-9b75-1210cc300a2f", "comment": "Malware payload (CobaltStrike)", "value": "f6e857f1e423c649854ba734d22f74a53bef1aa47d39153763e57e1af66beed740e7309efb0da5d0b887fbfdc1ea148e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Wacapew", "colour": "#8847C5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771307020, "uuid": "a94844b6-5ae6-4a02-b2b7-39d412c8db31", "value": "T10D5633964E9132E51DB1188DD8EE7E2FF2AEB3D3D82209CFBD59783C9931119DA1140B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771307020, "uuid": "991fecfc-f4a2-4a0e-b251-de51fcbb1464", "value": "98304:l0A9KhqMQ5woLi5zZiChqjbaQrLjUz3o+izJJyvUAZIjCWhZbDQ:l0A9Kh66RNHEeQrC4HFAZwCsbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771307020, "uuid": "c7f409a8-3400-43e2-84d2-7015bf0812ed", "value": 6033486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771307020, "uuid": "9af49619-d5f8-4545-87f8-1fcebff35cc3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771307020, "uuid": "2f244104-bb18-4bb5-9b4a-6cf42d6a8912", "value": "RunCode.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb63e600-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352625, "uuid": "5e2fa173-0444-4a58-88ab-056bf0516d50", "comment": "Malware payload", "value": "d8a704736a0614ea2db9aa7620bc1c41", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352625, "uuid": "948bc904-f545-4221-ba43-3e6c4be711f5", "comment": "Malware payload", "value": "48351709cd6c5029afbbfeea007cce20069f81926cef1a4d199899d56b880ae7", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352625, "uuid": "a0ae8419-691e-4137-a7cd-f04709f215e1", "comment": "Malware payload", "value": "2b2b24fcf2392297c9af943e1aa1d43f0ef7ed66", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352625, "uuid": "95d1200a-5590-44f6-812c-72a6423a013e", "comment": "Malware payload", "value": "e256ce3f542a3f32672182d598fcfcc2e11040a13a20c9e511feffad6b93194ec03ba1d389cf14a2526436a536ee1236", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352625, "uuid": "327da5e7-eb5c-4bed-b054-1b7c40370176", "value": "T12DB63331AE616D7BC7A04378706F3F384EBD2D438888D5C962A97187265EFD0852F49E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352625, "uuid": "b677ea43-1f27-4892-a657-5fcb5ea77b71", "value": "49152:GbHdz0H8gMlikOp/+dB8rbzd4MuVR5mxVR5WqtzCm/jnH9NQPt3dkKn4CNKhCtEz:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352625, "uuid": "9d9adf2f-806a-466f-9cf8-2dec9cc308db", "value": 10899456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352625, "uuid": "dc1f26cc-aec4-4e19-89aa-376c875ccc6c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352625, "uuid": "1be7c994-9d36-4d4e-b8b4-32fc1e7d523c", "value": "TmprHCRMK88952-1O907S.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381a621e-0c0d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771338634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338634, "uuid": "446ac17f-d2de-441c-80d6-604eaf60e3cc", "comment": "Malware payload (Mirai)", "value": "1a72d04ac44192434c53f05010715ba6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338634, "uuid": "eb57a893-b879-4fd9-aad1-fbdaef0ac7ba", "comment": "Malware payload (Mirai)", "value": "486d9f2b09b4925ae89f595e53c8cbcb32dfd3248d33dc3cea6b6f6067c6f310", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338634, "uuid": "124654d2-cc70-44a5-bfe1-3a6a72539427", "comment": "Malware payload (Mirai)", "value": "cb25dea2f322f33749acd7bc510f3831b04120b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338634, "uuid": "28f98c82-7279-4ac6-a28c-7095778cb653", "comment": "Malware payload (Mirai)", "value": "87ee5ba8c3c85045e224d1b5947dad913bc5cbefa0ce56a36c07c9c3b94f14769a0313280b3f779bdd4fc67615420354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338634, "uuid": "1239a014-1f3a-42b3-94e3-2329c9d6f348", "value": "T14963B71E3E318FBDFBAC863457B75A259358239A37E1C5C5D26CE6012E7024E241FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338634, "uuid": "eba2dbf4-28ed-46e5-9d5d-b67784e6a9f0", "value": "768:+7kbHlkkvs6zIi+z7pcKHt006+X4AtHo8ucyNG8uwA+UHJUQBnlaiXJHmwC:+7kx9s6ELZHt9X4YlwA+UHDzHmwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771338634, "uuid": "06fd13c9-df9e-49ea-844e-31a23297bde7", "value": 67988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771338634, "uuid": "33caea78-cbe2-4232-a3f0-b5a79939ae01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338634, "uuid": "98c8026e-5f2d-4ce8-bb8d-d0f17e814364", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7cae9d-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348149, "uuid": "fda473d0-ad17-45f9-b9d8-342682b45110", "comment": "Malware payload", "value": "5f08587b71aca19ac438f8d533aa453f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348149, "uuid": "164002dd-849f-4a88-bff1-daea0ce1c021", "comment": "Malware payload", "value": "49b1dcb471a687de97ae4bfdcae4d0a77f19a21b8102ceff847077105efc058e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348149, "uuid": "de5881f6-2537-4ba8-b999-47c4590637bd", "comment": "Malware payload", "value": "442cabcc7d3541a468d459f595a273c9a01f4b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348149, "uuid": "934ce91b-839b-476e-95fe-00401c25bc8f", "comment": "Malware payload", "value": "5bf7dc5f1376d30929fc6f5323788eb67b853ce1fe6f4cf3ffa60931cdafbc6057e658f891f97d9e5d1e5a0c9c32e160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348149, "uuid": "8b2498ae-c57d-41cd-89a5-ea9ae34ade72", "value": "T17EE33957B2E530F9E0778239C9A21656FB76783107609BEF03A046762F272D19D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348149, "uuid": "f9492150-cd2a-42b3-8582-f83cb6e60a51", "value": "07de3b85c054c34a98de00e13f2682e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348149, "uuid": "c7467e7f-a922-45e4-a163-f2e46711552b", "value": "3072:OAZoeH5lBfxXmi7RA7urMY31AsEFDLDTmSVsuPNPZdsn:QE5lB5X0KrMYFALDsuPjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348149, "uuid": "c44ca3e0-86f0-453b-a35b-ab8da806c666", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348149, "uuid": "c40b077e-2699-4e33-b662-72c1c7d53be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348149, "uuid": "ca5aee75-cd8e-412d-88cf-44fbf2a543f2", "value": "dddd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c641e928-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343167, "uuid": "c52bb7a7-ac01-423d-a665-689d30c9e28d", "comment": "Malware payload (Grandoreiro)", "value": "c166ed87071d083add6824b9f1acb85b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343167, "uuid": "441ab186-c0d6-4948-83d3-d95c5a56ceaf", "comment": "Malware payload (Grandoreiro)", "value": "49cb3f02b7c82f939bbb1617765467c0b1884275b00a4a7ee9037338d5c004f1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343167, "uuid": "36f51154-1792-4a50-b829-ad554e3dd159", "comment": "Malware payload (Grandoreiro)", "value": "694c26cf5f59995679a044f8aa24b39aaf65f1d8", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343167, "uuid": "a3a532d5-e0d8-4f9e-8c86-9fc056c77150", "comment": "Malware payload (Grandoreiro)", "value": "1ff265c7b97b75d6d3381b46b7b92fb1b23444b8aea9897c625ae7d5063f76422e1922f7dbc4e04cd8f26d54ab2bc114", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343167, "uuid": "16c651ef-8999-41d4-9535-79095558f15f", "value": "T194663331AE855C6FC65083B5705F7E246F3C6B63428EE9CB289C55833B8BF90856F0A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343167, "uuid": "0bdadfdc-2d9c-49fa-aa29-5d88fb334403", "value": "49152:Gj1cq3/f2eaQfLq1pPHGozUisoqJ1fcjZMrmNwIFpUpbgury16eYId9UyzxGdDOT:0U7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343167, "uuid": "6cf75140-25df-40e3-8c00-345d1355d9c9", "value": 7118848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343167, "uuid": "330de976-e91a-4b30-a080-18a090128f46", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343167, "uuid": "a719973a-5346-46a2-b73a-d62319b8c08a", "value": "Bol9879KHGDIM9I25O-67765_Cita.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32281614-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342919, "uuid": "63ecba55-a38b-4b06-896a-742b7116fdd4", "comment": "Malware payload", "value": "73d42dfb7b3ed90ba122f671635d9ee6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342919, "uuid": "4ecc02c9-2927-4909-b4fd-5cc435369de8", "comment": "Malware payload", "value": "49ef1aed44ed587320da657ea08d5dc541e9af50cdf447f426d0e36af72dcf8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342919, "uuid": "9d5e5ef5-0a40-4e37-a9ff-8fca3e71855f", "comment": "Malware payload", "value": "c73f86c2161466e62c8759c2e4a658561feeb091", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342919, "uuid": "6f59e4bf-ba1c-44eb-9752-7e37b5f64678", "comment": "Malware payload", "value": "af1c10ac726b485dabe961ee66e0a8ef403a107c58f6635d071cd16b9516118ea1213135b3e469be0a6b6a02e92b2086", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342919, "uuid": "1cb8c598-cfd7-4f66-9966-d6b5b159272f", "value": "T12BC2EBC93EC6B1A6037154332D5BA556F26ECC89BC8CC4A9EAA55094FD64704CCB3AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342919, "uuid": "740a1c91-6ac2-436e-9d58-0aff363b3dc6", "value": "768:NdL1uxh3TqwbWPMF7hqs+R65SIR5FgBpVMqnSa:huxh3TbOc7hq3AkQOVTSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342919, "uuid": "b5050809-de20-4b5d-9f24-3b0dbc09e0c8", "value": 27378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342919, "uuid": "7e0dbd53-4d40-4079-b1f5-b3a41842f9e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342919, "uuid": "032a3b07-4fbb-4436-a666-9addc2c7f19c", "value": "6194002873.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ee176f-0bad-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771297631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771297631, "uuid": "8d0f8231-376c-42a8-b071-0981dd9bce04", "comment": "Malware payload (Vidar)", "value": "e0b3fcffe7cf02b37c21271117ee0ebe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771297631, "uuid": "daad059c-dea7-4878-a29d-194e164361dc", "comment": "Malware payload (Vidar)", "value": "49f0a3af3da1679c3bfd01579ee35e273e3907ed51486889d8dfe41e86301df7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771297631, "uuid": "cf131608-3733-460a-a735-9cc466ef900f", "comment": "Malware payload (Vidar)", "value": "7d4bd3c0af1c15322a914c72f38c9f58d2da4948", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771297631, "uuid": "5e664d94-178e-40bb-ab2f-248ff40a40e9", "comment": "Malware payload (Vidar)", "value": "0da7cb3e82d0284978079b08a57c1bc3c90bcb9fa506e56c276b8159faf18ea20e4965c619e0af48c99534acd30c9994", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771297631, "uuid": "9aa76cc4-59a0-48a0-bea3-7c992785bb98", "value": "T193C54A52BC90A861D5DAE036943191A177347C490B3377C3AE62FABA1D3BBC41EF6358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771297631, "uuid": "5ed2fc2d-f733-49a9-b032-c8a4244756ee", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771297631, "uuid": "80ff9210-5749-40e5-9878-54668127cafd", "value": "49152:shFo3My5owOUscTUWdBKZSAxyVaLkDajP0+5n2gJFX6K1:rMy5owOU7TUsBKZSAxyVaLkOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771297631, "uuid": "6725591c-1cea-4b1e-a612-ff5bb9abda5c", "value": 2678272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771297631, "uuid": "1cd89705-c633-4756-85bd-9c2cc7b365ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771297631, "uuid": "da1a8cd2-b317-495e-9d3b-1a171f4c66e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b997595d-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353883, "uuid": "a7b61f11-904e-4005-bc19-cf01f2a2db68", "comment": "Malware payload", "value": "dee9515ae4e5a87075400da096def294", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353883, "uuid": "9392c41b-5d90-4ac1-bb34-eb08110b41c0", "comment": "Malware payload", "value": "4a44f5bb80a56b37e0e3db06f2c64dab744313fbaf039a0ca36191182be9195b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353883, "uuid": "4199ffe0-a170-49e7-8f38-263da02dfb09", "comment": "Malware payload", "value": "ec368ac7556818445b1c4edb6fde24bb03366862", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353883, "uuid": "83a41517-aa27-4b30-93e1-2a6002315f4d", "comment": "Malware payload", "value": "7dcc0fbf38c7c2def93c5c8ce07e38dd7b9f39313a4f7dae2a0db9d9147a5911f0d7e1594dab9b825bc9769d6390a826", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353883, "uuid": "0248f226-4cce-4676-9876-d9eb4250a43d", "value": "T127763331DF441D2BC2808379705F6E265F3CA96382CCE6DA659C74A63BDEB51CA1F068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353883, "uuid": "2ea35346-1357-423e-b1f8-467c571fa2e9", "value": "49152:d3U+Xp7yNmNbhgI7rWndMp/STbZ9+M1ftr5YMb9j1TjoJmz+w12naM9VeE+U3YNQ:X+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353883, "uuid": "465a03cc-2cc6-4817-bafa-3b4775f69d94", "value": 7192576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353883, "uuid": "22bcb2f7-505e-49e7-a0bf-3b215b3318d9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353883, "uuid": "eb70b3c5-bd48-41a9-88be-433ee769f7de", "value": "RsptNIHLMY62598HO72.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db994b5-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342159, "uuid": "1931bddd-ebdd-4a34-a0d8-6a5880a69c2a", "comment": "Malware payload (Grandoreiro)", "value": "0306bf981c6dbd08029522c0998517e9", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342159, "uuid": "3762597c-baf1-4ab9-98c5-ddda23fee176", "comment": "Malware payload (Grandoreiro)", "value": "4a86c9a5ddb4e68d674fcd045f16b3424d22176c762ffc10434e73beebb55af6", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342159, "uuid": "07d0c454-dc97-4970-8292-323e7d91ea8c", "comment": "Malware payload (Grandoreiro)", "value": "5067e64ced8e71a0a4f4248a071ae92528ac7b89", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342159, "uuid": "bc24d90a-c3e3-4561-af6b-fcf89853fa15", "comment": "Malware payload (Grandoreiro)", "value": "fc7fdd316671170dedb3f8789986eceadefdcc3318a9bc6839a218fa2034e24ffd3c83af2e33d938975f865f99becb02", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342159, "uuid": "3597fcf6-a968-4fc4-860a-958ead0f78d5", "value": "T1AA762331FE045DAAC3444378742F2F342F7D6A078F8892C7659D61CB2756EE28A3E856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342159, "uuid": "e0e86f1d-2391-4a0f-857e-b84478877207", "value": "49152:PrYV5OqzN7UvxX4yFexSB9WRqZ/Y+z4sGo6u96WpWqY0AFGDvvtuEASSGik8DZr6:CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342159, "uuid": "d25c5b61-ce08-430a-a803-4729ece48c8a", "value": 7585792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342159, "uuid": "56d48afd-ffd2-4ba8-a7a0-57e6c809dab0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342159, "uuid": "5cd8a514-7f53-431c-b106-efc149f14c88", "value": "4911Ptr-VOOTH5E1X5086858FNUK.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7516c096-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341742, "uuid": "0ec5926e-ad13-4b52-a11d-72d3b6ad3175", "comment": "Malware payload (Grandoreiro)", "value": "79369f21ada2f568afe91d744f041d8e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341742, "uuid": "c57e62f5-4f50-42c9-838f-f432b4e768a2", "comment": "Malware payload (Grandoreiro)", "value": "4b9a1eeb6cc30761a08a59375c011eef790fe8096c109727cf28b39af53e3640", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341742, "uuid": "f44a88f0-5700-4948-aa89-17f63827c748", "comment": "Malware payload (Grandoreiro)", "value": "d8c72fd9352648c4c62621cb035ff688ce0709dd", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341742, "uuid": "fd435468-8abb-48b1-a682-86b7f00b40b9", "comment": "Malware payload (Grandoreiro)", "value": "04ebfec45ed68ddd486a4264d673ceae69db94b67a149fb3eb2ecc81e37c2baea6f50f92019f78e4f2528a1687fc8564", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341742, "uuid": "b00adadb-6cc3-4a92-93b6-db3c340927d4", "value": "T117763332BF412D6ACA4043B4752F2F361E3D670744899AD2799C8483B75BED2962F4EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341742, "uuid": "72cc0930-f6bb-40af-91bf-02e227e3c96e", "value": "49152:mJKysvqbtXQ4XTIhor6CDaYI/IrRZoUfPt01xH6ESmP77/TG7mUbTsfiKC1GfdIY:5uim3Y+U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341742, "uuid": "24dcfa33-e0b3-4652-9f9d-9a877588f2e0", "value": 7202816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341742, "uuid": "3de477d1-6d7a-41ae-a519-275ee2f0b35e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341742, "uuid": "362dfee0-c0f6-465c-a22a-02a55308c696", "value": "0SldTEMMUUAJJSB-719835OZY7Z1SBZMcocm.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae481821-0bca-11f1-a129-42010a9c0007", "comment": "Malware payload (ResolverRAT)", "timestamp": 1771310056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310056, "uuid": "c2b348fb-974b-40ff-b148-8141a1f0cd9e", "comment": "Malware payload (ResolverRAT)", "value": "c637c8099ea4d8a508b04e7d3aafba56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310056, "uuid": "b5f22fab-e68e-4afc-b858-a3ce1dc6e635", "comment": "Malware payload (ResolverRAT)", "value": "4be7720447cb8a7c760757a7a799d564b1dcc87ae3cedae7d6c41e95607e5bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310056, "uuid": "c7230df9-65f0-46a7-a172-ed51e4a52bf6", "comment": "Malware payload (ResolverRAT)", "value": "c35ebba608d3b70be8b363782931e6532a6e2fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310056, "uuid": "660642fd-08e6-4b9c-8b2f-29945623bf6a", "comment": "Malware payload (ResolverRAT)", "value": "9b51c81b01077a9a5c3a8ef9c383b823994be30e6278367f232573dadb35ba032814ad4212cf5658eba617dd2396a2c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310056, "uuid": "a06a1f0b-9515-4f75-b11f-1991641e8909", "value": "T13655383439EA502AB173EFA98BE479DADA2FB7733B07645D109103864723981DEC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310056, "uuid": "95c2d579-8786-4024-81a3-172066fd9ae8", "value": "12288:Vk0MRVel8qcqJ6vxz0PhCo5UMs2XMPDd3CYn5Tr0AsUmmycVyqWGRieu9+RGoKIa:A0bbUZRw7UEzGnyWDsYFr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310056, "uuid": "a273cf70-2bd1-45fc-a6c8-b62daa727a87", "value": 1348096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310056, "uuid": "d4edf5af-9516-4629-9d92-64234c790ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310056, "uuid": "d9f4da41-5517-4442-94e5-c1359181d109", "value": "RuntimeBroker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c54cb4f-0c0c-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771338345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338345, "uuid": "b6a438ea-7648-4209-aaec-f641d8048c96", "comment": "Malware payload (PhantomStealer)", "value": "1934fa88548e883dfa8e1ad2a018833c", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338345, "uuid": "227075a2-7ae7-49fd-aa30-1786e3aa7f1f", "comment": "Malware payload (PhantomStealer)", "value": "4c2e4f0ae5c8154986d82e78b00b5ce07af125c43f450d6fd40362dd90a3ec67", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338345, "uuid": "a9e26c50-d9ad-4991-b975-7d0b1ea60220", "comment": "Malware payload (PhantomStealer)", "value": "3d01b8b5ad7b41ad95e128ce0b31e5de52f8eee8", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338345, "uuid": "790b4b9a-61c5-413b-8213-ee250b0913dc", "comment": "Malware payload (PhantomStealer)", "value": "08926c20046a8da688f314b0fb1fe73629efa0050c071db285cf9ff069633086195bd11b1791ea9d7c6bfeb9aeb5610b", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338345, "uuid": "7e027954-b3e9-4d00-af40-10a3ad7a6649", "value": "T1C5837374290C45EB2493EAB4B084A7E3FE6C0A5C9FFD664F515447DA1A3EA8734C39C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338345, "uuid": "f36504ab-ee02-49d4-81cb-26b23b126ba6", "value": "768:PePBgOLzOC0LzKaCTD1GWQuWuBefEZZ3XicCiguUEE0hCI9oM8eY8:4gOvOCgzJxuTXcuUEE0hP9o5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771338345, "uuid": "9b31690f-8560-4087-88be-66d1f70905f5", "value": 86454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771338345, "uuid": "5e87e475-c34a-4d0f-aa60-cb4a141fef18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338345, "uuid": "a47b531b-85d4-4334-b6e6-f15b3c37bf88", "value": "PaymentAdviseSwift0285.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b695e72-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352302, "uuid": "106f91b2-24a1-4209-823a-35f8af849945", "comment": "Malware payload (Mirai)", "value": "ace386756ea124d4706b2849fcbdb028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352302, "uuid": "c3d8dbb6-a5d5-482d-a191-07db45591df3", "comment": "Malware payload (Mirai)", "value": "4c852983ef16df7169b74911b36d64c329573a97fecf1a2b65c97bac09fc101e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352302, "uuid": "ad90c8c8-ec28-4cb3-83e7-530615f722d4", "comment": "Malware payload (Mirai)", "value": "d3dc5ba0722d47c4e314fa2d55013b5cf332273f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352302, "uuid": "456b569e-6122-4514-a3d0-f935e57e714c", "comment": "Malware payload (Mirai)", "value": "40a1f5de33fcc198fcc765e7e36ae512b36f04def9387aeab4361f43a5446f55fcd8d9c76f203e545d2461f06cdba601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352302, "uuid": "3e81a068-ba14-4501-8452-fe69f77378ac", "value": "T145231892BC928A56CAD42376FA6E118D332173E9D1DF3267CC105B013AC991F4D77B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352302, "uuid": "7a4de9d3-1f5a-4aac-b39d-ca35c74f7867", "value": "768:dbjVOAsT0V8//IIsIMTUExYFrLiwXtQPVdNIeTBlieoE734woBNjyEtQ:BwAsT0wXXMmLiStQddNIeTbicZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352302, "uuid": "230bd81c-60d9-44fc-8126-30d27904f360", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352302, "uuid": "d52fa916-b3e6-4463-ad1f-188394bbfd54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352302, "uuid": "9b95e05a-7e95-4a1a-a960-742e24c49f6b", "value": "miraint.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171e5f7a-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312808, "uuid": "f8e1cb6d-b86e-44ea-af5c-deca9244a7e1", "comment": "Malware payload", "value": "b3c780ac1efc97f5f695657c208e063f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312808, "uuid": "6b33a96c-396e-4849-9398-aa1fa2aa8d7e", "comment": "Malware payload", "value": "4cb943ab070b916a6b369c7c11ab61f0932169b445446439ce1b2f1936d23112", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312808, "uuid": "12f94564-a69f-49ea-8e71-c3afae2889cc", "comment": "Malware payload", "value": "3bbeb84a4070902f448768f51d2e1c126436d97d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312808, "uuid": "160577cc-7c33-43fe-8ba8-855a0811404a", "comment": "Malware payload", "value": "062e9d3def1fee1ec22df75fe204b066ecd35a6e8797fd85ded5cd70edbb1f58cab34fb4cdda6cb547d0ecf3aac1c9ec", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312808, "uuid": "3b9486e2-8194-400b-89cb-5a9c5d87628b", "value": "T10E763371AFA92C7702748329701F2F287E7D5A87814EE3C945BAB0D3259BBD1C43E865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312808, "uuid": "05643427-2a90-411e-8c7f-6bdda2a26eb5", "value": "49152:QEbcgIfGRRkPnnaM0qy7UZcC8ole5u+SGj40qiuq3QTfJsyhEuwBYgrBgv8nauAs:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312808, "uuid": "f3e53f7e-68f4-4908-babb-3f6c7795cc02", "value": 7269013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312808, "uuid": "86332d48-0146-4a0b-ac1f-4fc7742687e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312808, "uuid": "004188d3-2df7-4f7d-848f-9b781792325d", "value": "192393Emision_LXFOJ04NBatfj4765MDIJMYG72GYD.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39109296-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342071, "uuid": "592f5a02-0ff7-46a2-bdcf-0708b4627294", "comment": "Malware payload (Grandoreiro)", "value": "df8129f348eff62b74f9f5fa4c4760bc", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342071, "uuid": "5a7bef61-8da5-413d-8e3c-01f79d277741", "comment": "Malware payload (Grandoreiro)", "value": "4d171636baf126b1f87c441e532d485875870d644f08867e91d0828de67f224b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342071, "uuid": "818ec97b-524c-4096-823d-ebf3cb8dd89c", "comment": "Malware payload (Grandoreiro)", "value": "01b883a2626dd91d05e324674f9ef35adcd7fe21", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342071, "uuid": "20bf6134-34a9-4486-9179-8d54c875170d", "comment": "Malware payload (Grandoreiro)", "value": "c0ee6398f91b7774932817ea8e813853bd61a430797f9fcd2b746d003c7688ba32019c76650f395b600f4e510b2e13de", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342071, "uuid": "fa109f59-1bee-46e3-aca8-31855e4eef8e", "value": "T1E9963330ADA61C7EC9858375701E7E251E3C7623CACCFDC756AC91A6734EF90522B868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342071, "uuid": "9f48af91-8555-4e5b-b255-bff201e3d230", "value": "49152:P4wRmsBbSzZxNTswrx6D3Hk/LCBqzdhP74QGNf0hAcBtUHjntaSEPtHmj0DZdC5y:wuim3YZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342071, "uuid": "98fb61d4-94ab-4a9e-87e5-2728db79f294", "value": 8665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342071, "uuid": "4bd95fa2-693a-46a8-8603-fa5dd09a0bec", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342071, "uuid": "eb244fa2-5715-4b85-a780-d1415f18f0b9", "value": "14025UPNF_MdtJRBSOP-204917.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d4ff77-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343054, "uuid": "bf36551b-5f74-47b3-9cc7-af0290149af2", "comment": "Malware payload (Grandoreiro)", "value": "1d8bc6ebf0e381ff2d97aa7473c3c12b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343054, "uuid": "1bf76fff-72b7-4217-b170-dffc38d922bf", "comment": "Malware payload (Grandoreiro)", "value": "4dad39f84da8c97d7fbfbe5fa080c58f9cb78987c6afaebb43200d15c9cbbf27", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343054, "uuid": "94c802f9-c48f-4ae2-ab88-eb065e53728a", "comment": "Malware payload (Grandoreiro)", "value": "d3152eb653fd8b1c1ff3f0ca2cde87f18d7ffdec", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343054, "uuid": "60fb0202-47d0-4605-80bc-fcdce6e5dbeb", "comment": "Malware payload (Grandoreiro)", "value": "a59bf3ca5fe78ed0f8e55645a0eb3a12b5df814638042d640b95066d8903544e354fa5f4ab4deb8dc4fc4ad6ec3e008c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343054, "uuid": "e0ebcfd8-46d2-4044-a236-848c53c8bf57", "value": "T1035633327E140D26C65087B1F13E2B362E7DA50B064DE5D639ECA157230FEE2A93F4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343054, "uuid": "98357add-6550-4f4a-a3e0-81b7c973f903", "value": "49152:Q7D2RqSVoivOKIujMc8ozMxcufSbq1iUXPBDHeEq781cly/aBQ813hRwSYO/SwAl:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343054, "uuid": "b0025dcc-8500-47b9-a94d-9fd573e285e9", "value": 6340608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343054, "uuid": "1f0d4882-ae85-4b3d-ab86-f455c17195ff", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343054, "uuid": "f214c107-29cb-458e-a8f4-71eedce7b4a8", "value": "9804JCNSH0_CmbDJTB-88146.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9841a4c7-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343090, "uuid": "512f34bf-9bb7-4d4d-b06b-cc10ebb04e81", "comment": "Malware payload (Grandoreiro)", "value": "0c789a2705ff8ca95a84a39a2749e6da", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343090, "uuid": "6235ab69-1626-4e51-b1b7-4034944613ac", "comment": "Malware payload (Grandoreiro)", "value": "4e253722b0f0f42ba9b6d4873ed33c84671200ec16183da823b2077125706c7c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343090, "uuid": "f69429ba-a55b-4ab4-bf07-156cc918cf95", "comment": "Malware payload (Grandoreiro)", "value": "8ba0f60dc1cdade66e763317ceb2280f09dd2d0f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343090, "uuid": "ee0dab53-2309-4225-bacb-c19ccec07a05", "comment": "Malware payload (Grandoreiro)", "value": "8ac17c80023305f8914337ab1b33c8b308c0bf7ef0b1df89e72465fad61d267f7fd24ec79e817a1526e0a6ead2bbd1fd", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343090, "uuid": "f8752b91-ca10-415e-a979-cf8e4f993f87", "value": "T1A5362333AF884D96C4A04730B42B3E393F3EB61345CC67D6655EC5863F0AAC6593A4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343090, "uuid": "76b0006a-43e2-4a2a-bae1-f763940c0a44", "value": "49152:sDKR/ANG2JlAsjw1DGbANXBYKr+Kl0CXFgWnoymKI2LRndEBj3s1r6SJTypR:Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343090, "uuid": "d24211e4-9b4f-4d23-9f9c-e563ce6950c5", "value": 4880384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343090, "uuid": "10a38c1b-4916-44d9-a5de-335b91052769", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343090, "uuid": "68885f24-989f-402d-9d36-4d203cba51ce", "value": "Aut3DG5RVAI-4752523E9Bgalo_Em.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd5e679-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342077, "uuid": "5a061037-1914-4129-bfe1-c2ca13ab3ac7", "comment": "Malware payload (Grandoreiro)", "value": "d75a83d60645bedb536daa81c2be9f51", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342077, "uuid": "9cd4b893-d343-4772-b5b3-17014adb5542", "comment": "Malware payload (Grandoreiro)", "value": "4e2ac17c3f01f90e6e3b02a00651fa584a4d594535f3aa0315be5bf8466870a6", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342077, "uuid": "0b393aaa-1b95-4309-871e-00c7bd011139", "comment": "Malware payload (Grandoreiro)", "value": "23f1429f3c36954d41beb44138a81df0a512835e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342077, "uuid": "96110578-50ad-494b-a0a6-40188b339c25", "comment": "Malware payload (Grandoreiro)", "value": "677cba8de2ae5f611209df034221858a14e8a39c37741af25db9acd4fc34ead99d4cbcb504f4d08b4f972569702ec651", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342077, "uuid": "c9a19031-4b1d-403a-9e4b-16f956bfdef5", "value": "T166562331AA051D2BCA404376B53F3E35AF7D7223468C52C268DD92837787ED7E62B885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342077, "uuid": "f7652929-530e-4803-8553-b808ba34342d", "value": "49152:BlayKjavRXRgDRwk8Oz2rX4aRAdof57vW5qJmI/tYenLWC0/wopFxMHrlDlV:Plb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342077, "uuid": "ef991c30-199f-4f09-b0e9-0a749f105681", "value": 6389760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342077, "uuid": "372df9fe-0aeb-468d-a27b-1dfccc284325", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342077, "uuid": "34a94767-a89e-455b-bd62-519e6587bd96", "value": "18445UORV_Acr542075-CPOA2.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6b4a83-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343151, "uuid": "21013e0e-83c4-4564-9549-1f88ba9b3646", "comment": "Malware payload (Grandoreiro)", "value": "76cdd1d106bb058ca7561d49198e5722", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343151, "uuid": "e30d8510-84dc-4db0-aa89-10daa7da4a39", "comment": "Malware payload (Grandoreiro)", "value": "4e34618c772e1f16388f5b9eaeffe3b8965611bc61d63b7ce16cb9bbea22659a", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343151, "uuid": "8358e769-c2f8-454f-9e7e-e08b8dc3a4b1", "comment": "Malware payload (Grandoreiro)", "value": "d586e5d90662bdeab21bb1151dea94c710525578", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343151, "uuid": "0257d12f-6be8-4fb0-931d-a5cb4ea6c8ef", "comment": "Malware payload (Grandoreiro)", "value": "08f22320a8e8cfff35ed8f827f94f4ce550391846dc38402329df4132764b098971fe003699469b87820145bc5e898d8", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343151, "uuid": "3ab71ea5-0aa4-4b5c-8cc9-50197031a95f", "value": "T1BB563332ED862D2BC6904734B52B3E202E3C7947C9CEF1E5359CA1473787ED1966D82A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343151, "uuid": "a457584d-e33a-419f-bf65-022a78f85f5f", "value": "49152:JM/x0cM70SrzDBC/ud+LbvxcvgxcPufuXmhRlu/YKVCvbOX5BsOXi5Ut0dMq7L+y:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343151, "uuid": "569ce708-3bf6-4a1c-b6c9-a19851747797", "value": 6311936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343151, "uuid": "a7e2a2b1-1586-4a21-9f21-2c3898fcfcb7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343151, "uuid": "484b0957-4105-4676-a188-ef0f0dd10c05", "value": "Bol1661XTSQRGPX4-898639_Cita.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead85fce-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348382, "uuid": "7f06497c-50f0-4d1c-be40-7252b611cf59", "comment": "Malware payload (Mirai)", "value": "6b80f8343aca910469d7154f9265f353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348382, "uuid": "70a33a22-b0e3-46c9-ad61-bef11557edeb", "comment": "Malware payload (Mirai)", "value": "4f46e14d2fa3a969092d82695ff2795bb0da86abfa28415c66df9c41336dc16f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348382, "uuid": "9da92df9-f45c-43d3-a5a1-38e34b6f55c4", "comment": "Malware payload (Mirai)", "value": "f7e913900ea5ce7861309f29270d249c1f2172ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348382, "uuid": "02c1b935-b2cb-4e1a-9650-15daa5103856", "comment": "Malware payload (Mirai)", "value": "7d286efe541faf357eefebbbcce4807c60c87901a676618193977d009a041bc00ceec8ab28ff95384f381aa179d4b227", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348382, "uuid": "76ee11b9-a38f-4866-ab9e-fe7652078281", "value": "T10DD4BF41730D3EB6E376743E80920B266F18AF4095832F6761F4B61A69B35AB1F3C587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348382, "uuid": "f9b679e9-0cb7-4e77-8f78-d635d34f3cde", "value": "12288:ID8ViqXUnGXbOkyUr1IgKKN+TE0EhVHHYjB1KX:VVT1kQgTUVHHYKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348382, "uuid": "f36aa630-adaf-4652-a23d-567cf583a2a7", "value": 600076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348382, "uuid": "8d53df29-f9a8-4521-ae3a-2b49a458e9fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348382, "uuid": "20d8f2ea-1a9e-4842-990c-3b0b22be16ef", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3589b9a-0bff-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771332827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332827, "uuid": "0a0a6a44-72b4-40e6-b773-aecb23119104", "comment": "Malware payload (Grandoreiro)", "value": "5dd75fbeae7c95bf26a66484063a7c08", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332827, "uuid": "3d42568c-f3f6-4122-907c-7f93fac53ec5", "comment": "Malware payload (Grandoreiro)", "value": "4f8989d2e3281743e8d594c845dc73e1400e5aa3eb4aec36ec7d41a98a5559a5", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332827, "uuid": "81e738d9-d677-461b-bf94-41f31b02aee3", "comment": "Malware payload (Grandoreiro)", "value": "dadf27239cfa88210402bf16dd4ffd451ca28789", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332827, "uuid": "bb2c2410-87fb-4598-a259-68c29c8c0e44", "comment": "Malware payload (Grandoreiro)", "value": "fe915e1e532f45062375a3b1d08b06ba236e80535ac06fcb5957384c679ba93b55d281ba081e47392ce46def5a4da646", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332827, "uuid": "0c904de1-d057-4598-8136-6795e3d106a5", "value": "T12B7633335E6A5C6BC9848374B41B3E251F2DA70B87C8B0E794AC55862797FC1A43F09B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332827, "uuid": "9522666d-a1ec-43bf-8aa9-de1c2ebe4fba", "value": "49152:nvtAJIVpsS2Sql/kSdHJzskG96M2xQDrOocPh/Rk0I9SRLj6A1Y4WNtOjDOx4xhp:EbDvAdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771332827, "uuid": "8b49c2b8-5966-4b8b-acfe-a666056401b9", "value": 7483392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771332827, "uuid": "37fd876f-df5f-4030-a06b-6a090d6ed8e0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332827, "uuid": "34949d4c-6700-45aa-a87c-5fe673aa6663", "value": "Jrnl99802PREZN-5UN2N35875.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc72ef4-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342156, "uuid": "586339ff-8699-4a01-b568-48b3fae6e948", "comment": "Malware payload (Grandoreiro)", "value": "62be130e20bb8149f6df4e3f368400ee", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342156, "uuid": "0cc82a0e-2e6e-43fb-8869-2779b44ad8b8", "comment": "Malware payload (Grandoreiro)", "value": "4f8e60396fd858a4b38c4d642160a916ae7e8f430f3f63d888e54f5886235832", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342156, "uuid": "40820f81-9d83-4aa4-b4fe-18d84023fd9b", "comment": "Malware payload (Grandoreiro)", "value": "d05de2496cee47e03bcf9c20b4d5e33bcc21a65d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342156, "uuid": "727d2c1f-be75-4c5c-a88a-5ed42e8dc715", "comment": "Malware payload (Grandoreiro)", "value": "70fe89159faf04a32e8547bdeb436c7646b98a186617fe88debed057a29c3343b5ae619ac36a4947749793d9145b007e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342156, "uuid": "dec035ca-d0a4-4442-880d-6e556cd42c60", "value": "T16A963330AE59ACBBC6904371B0BF2E355F3D1B138588E1D6299DA4832A47FD0D93F469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342156, "uuid": "e80a5ded-9630-421c-88d4-aec096a4fd2c", "value": "49152:KKqtTFVN2utdwlGYpCMFtXHA6R/rSIg+5Z5978S3Gg+RcjuMwRndMz5MYWOJ0HdG:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342156, "uuid": "6fe535e4-12bc-4aa3-b1f0-1054cc8378b0", "value": 8683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342156, "uuid": "c1afecab-70b9-4780-8693-40caeb94b395", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342156, "uuid": "623ca272-b795-4334-89c3-5bf0d47a3f09", "value": "46038Y900RProc_OSRBAM64569JAD5gfrpk.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de456d90-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348361, "uuid": "b7fa954e-f930-42d0-beea-0987c29862f0", "comment": "Malware payload", "value": "82b44600367e23f2554de4a2d5d7709a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348361, "uuid": "9ce953cc-100a-46dd-bf1f-467017be95b7", "comment": "Malware payload", "value": "5072556c254ee9e46e00da8a2ece41f12f23e612b101e8c6f19c5ab8d70b4c9c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348361, "uuid": "3c02605c-40ca-4796-9178-7ea5c48bd456", "comment": "Malware payload", "value": "a340b6088200200ffe79166de108f88d0c09255f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348361, "uuid": "94827842-b9dc-4cbe-b9cf-63f8d1e08ab4", "comment": "Malware payload", "value": "44081fc012f1defac9e91197f6b219a643cbc4e24052a1d088c95ee22632d879bc2b27bd8c8019b0d612fe2f503286ab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348361, "uuid": "6e5dd3ac-c43a-4921-93d5-55e562f77612", "value": "T155012DCE2B94B1554C4C9D40F16A862C7944ABD031B40E9D6B9CB4B2A9CCD28F9A5F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348361, "uuid": "71d8b12e-3a54-4e2e-b5bf-5f1f1b25d503", "value": "12:U1eLqU0cjU0iNIl5zAU0P0LKjU0uOsU0iCU0c/U06cSEU0otaKAU0K/iAU0KtfAy:D7xglNI75tKgtixDT8LcEhtBlb/abh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348361, "uuid": "482574b1-92cc-4c5c-9e74-584c3581bd46", "value": 797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348361, "uuid": "e7b78b50-2fb6-4312-be9c-2a16f45c8316", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348361, "uuid": "6611f656-c42a-4535-a149-6cb6503603f6", "value": "abc3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f547afb2-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771313181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313181, "uuid": "57f75d57-0019-4f5c-978e-4bada99767ef", "comment": "Malware payload", "value": "8cd5ae5bd69530718fddde98fe8a0380", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313181, "uuid": "18619878-1c73-40ca-989a-47f99d979378", "comment": "Malware payload", "value": "510787a35677cd572e559c6db9bc3af2144ec505c29c871ffd54baf51e7b1668", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313181, "uuid": "dd7761f3-1b56-4644-878e-de6fc84b9637", "comment": "Malware payload", "value": "ed3f46b1f8357ed2581614c417643bdef2171d7c", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313181, "uuid": "13b004c1-a491-4d60-b96f-0887fb24d669", "comment": "Malware payload", "value": "43d1b54e9bbe0f59b2fee62d002bc290b4b7c288dca6b154161bd2889ba20637fc78ded7cca543e27881b7931f655a7d", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313181, "uuid": "707fed7b-3654-4739-b0b6-815698d73f1f", "value": "T1E696D75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313181, "uuid": "1a0a20ce-2d57-40f9-83fa-b77dd1656841", "value": "49152:d+mE2CLNlEJe8PhUh4Iq4lvyKeMTvg/c30ech94Ocl9RefG3HpJuZBbn9gQTBpyu:6D94H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313181, "uuid": "8547990d-1683-49ea-ba02-d238f00b4d4a", "value": 8653303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313181, "uuid": "f1752471-eaed-4806-905a-12b82a4b17d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313181, "uuid": "40f806c7-9d65-4a4a-8134-3ba4b71c096c", "value": "nouveau_curriculum_vitae (16).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bf9cf9-0b9e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771291229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291229, "uuid": "53d6121c-0c7f-4142-bbfe-47cb25d81dab", "comment": "Malware payload (Mirai)", "value": "2441a1ddba7803ce5d028685e57286f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291229, "uuid": "277ccc5e-17e3-483b-9eec-528f7ec15801", "comment": "Malware payload (Mirai)", "value": "511bb4e107503f30756a68761440513e1c2683f5cf065b0ad2f4242a30242462", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291229, "uuid": "4f01892c-fd21-4a09-a239-de4c1a84efd9", "comment": "Malware payload (Mirai)", "value": "253fa73509f3f9364dc9cf9aa4da9838c648d447", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291229, "uuid": "ea0ca292-5a03-4318-94a1-0c6b900ce2a4", "comment": "Malware payload (Mirai)", "value": "fcf6c78fc950854a737c021ff9ab3a61a0bcd25b69f2e515e78e9d5a960ea4b782e9282693833bc6d7480e2cd26b33ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291229, "uuid": "7a2a02b6-8e02-4ffd-9461-521ffdc738b8", "value": "T184436A02331C0A47E1525FF4393F27E083EEE9A121F4F589664FDA464276E37158AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291229, "uuid": "9826614f-1a84-459b-bda1-0376df1cfdeb", "value": "768:set1QnQmyYvb2qbR0ZCRf1lwPl7F2mWbqbsSYLCuNyT6Z3rY3TfRt5AIs4shJpu5:sDySbR046PRFxeSSzq6Z3rIpTsPpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771291229, "uuid": "544180db-66ee-4edc-922c-09955312aef0", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771291229, "uuid": "df373ba2-7014-4de1-a4f5-d778d72f2c95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291229, "uuid": "84413afe-55e0-4025-9607-d1565adafb13", "value": "mirai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f01277b-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341732, "uuid": "ffbc48a2-e42c-40cc-acc9-8ea277b37372", "comment": "Malware payload (Grandoreiro)", "value": "afcd99198dddfd2f8c813a5302e982b3", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341732, "uuid": "3756e983-0c50-42a8-bda4-eeba1755eae5", "comment": "Malware payload (Grandoreiro)", "value": "51269e0578d89da5867e0bf05aaceafbf9b16bd0492698e1e1311cb863e8eab2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341732, "uuid": "6faa9618-fb23-42a7-bde7-1d3fedeb5ea3", "comment": "Malware payload (Grandoreiro)", "value": "e383d0c3be37f651bb35d7ffeaba762e3e64822c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341732, "uuid": "ce7e5b82-5192-4814-9180-9ccd571dec9c", "comment": "Malware payload (Grandoreiro)", "value": "d1ba243bdbd4a85daa0c100e9ee1ec094c5cdcc258aaf402a46a075a5e29d4c90a40cff1193698170091111d984e0962", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341732, "uuid": "367abfdf-501a-4d03-a8c6-e0339806b011", "value": "T174262331F645586ECA804371F63A39312FBE73232A88A6C17D9DD24737829D6D63F891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341732, "uuid": "ed560a5b-7f3f-450a-8aad-68097a2a5995", "value": "49152:diMJgYq3jXhssUxTMBU/ZyA+cTp4vNmwVw0ghCwbN5NIX83vHo/eGjJuIJhOV:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341732, "uuid": "d456ab10-47ed-41f6-8b13-8e7a97aa69c0", "value": 4839424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341732, "uuid": "83837012-b1c8-4266-ae73-d6c21620e740", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341732, "uuid": "7cfe010b-9750-486f-ba87-b46b2dfd63c4", "value": "0Sld3136KBLQGPH-83243053UN8HHEFIQoqtm.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a02d99-0b9e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290974, "uuid": "8631d628-d649-4951-adb7-d56aff2287d7", "comment": "Malware payload (Mirai)", "value": "827fefe4b9f4b568a953e635fe3f651c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290974, "uuid": "2bed972d-d307-49c9-99a0-293e89aa2e0a", "comment": "Malware payload (Mirai)", "value": "516ac5ca316aaab121bd1786abe5c790e275f84c07191769bd7c49110fde2428", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290974, "uuid": "10bfc066-9744-4e12-856c-7abe9247c6eb", "comment": "Malware payload (Mirai)", "value": "66831022657bedd0a5e2b5cbfc693ecf5925d83a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290974, "uuid": "37682118-a708-4de2-93cb-086186ad38ef", "comment": "Malware payload (Mirai)", "value": "8b5c458ac1a3814d7729f23da66b2f3b1bf0ddf5021201a460c3987e5a9f1410f57b5a7798263438710fee9942f5870d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290974, "uuid": "ff5f90b9-b779-4030-b180-0417e5a09b97", "value": "T16BA4C023F6609ED1C8224AB45CFAE2340705E6A113827681F2FACD553C4F97ABD8E775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290974, "uuid": "0348158a-5d17-432f-9c7e-0da95678af51", "value": "12288:lUNO5sobNcEq/s4/qZI2WqQDuTbHDxQpjy7B:NjbCTwYq/vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290974, "uuid": "7a60e061-6422-42c8-8a1f-6c8ca17a04ed", "value": 463092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290974, "uuid": "58eb5e98-2462-4f90-bcdb-64a365d60fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290974, "uuid": "8ce9a714-7635-443e-8f13-6be579948366", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2051e99-0c0c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771338382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338382, "uuid": "57c80bea-e4ff-4db1-846b-63665dd97721", "comment": "Malware payload (Mirai)", "value": "f187bbb0b7a919d68cbd604b1c0518fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338382, "uuid": "99e31c3b-6765-41c0-bbaf-467ae5aff374", "comment": "Malware payload (Mirai)", "value": "518620f5eb7f8ed9902a0dc4873ee58b4c99812921a794aadf5023ecad453e1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338382, "uuid": "0fbf0682-2bb6-4bd2-bcdf-1800ea88d0ac", "comment": "Malware payload (Mirai)", "value": "e632855b3489f9bd8cf15715e9920cb678324da2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338382, "uuid": "9a24facd-5556-4dc3-8fad-5dc74572b2f7", "comment": "Malware payload (Mirai)", "value": "72a480b0d9c3cbe50d25f08cab08a9a0be55101956a97ab1e616faea341458ebe36ea4b047e0584ee5ad4665d118129d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338382, "uuid": "5b4ce348-bc1e-4ce4-8efb-0a8de8f9a87d", "value": "T180335B02775C0E43C02A6EB4253F23D9D3EFEAE120E4F189650E9A46D175E33468AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338382, "uuid": "a40fa927-188a-405b-87b3-86b5949e85d7", "value": "768:+LI6ppREif6YeCTsTDr2aIwU5AoF2hftkSGsv6H1ILt6q:j6plf3TsHr/bRfTS1Ip6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771338382, "uuid": "58576435-10f1-4855-8623-050c9a79b098", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771338382, "uuid": "d646fd6b-269f-4150-91d0-db5f4e207249", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338382, "uuid": "e879c49e-1435-4b96-99c6-c65f9ac669d7", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27d6503-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356502, "uuid": "2080255f-b6fc-4a28-b68a-a69beb969e54", "comment": "Malware payload (Mirai)", "value": "8a94991acaa8a3c214bce50e22dc41ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356502, "uuid": "1163b8d7-6c88-40b6-bab7-1b7ccc2ea555", "comment": "Malware payload (Mirai)", "value": "51ba28d3ae1463a1e81e745d5c74cec485f3ed72bac4dd5c2dbcce2745cd8f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356502, "uuid": "bff5cc56-8f49-4f23-bfac-9ca33f69936b", "comment": "Malware payload (Mirai)", "value": "78bea6088d8b92e5ba62c57677887ac1190df0c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356502, "uuid": "f4a8a578-303e-43f4-98aa-b8d6f2f36a88", "comment": "Malware payload (Mirai)", "value": "25d11f298ceab90322f17e2e3900c803f178dd7d5a2083aaffa5ced5130f897e2b51bf9aa3b9d7a38bdcce53000ac095", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356502, "uuid": "aec44813-bf5b-4330-b6e7-1de8b97ab829", "value": "T1016301A1C16B2C593712F63BE21AE847BB2687FCD612BC770198972934DA00249F19DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356502, "uuid": "a25276b1-f1e6-4201-8707-1e23e13e6508", "value": "1536:YRPv4wUQC65jgLpDlA/IIkRIOTuk/GGHLvmrV5Hzwx:ODU/GgVDlA/IIkRIJpGHLvmXHzwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356502, "uuid": "cd368eb7-e626-45ea-81f9-6db15bd34d96", "value": 69468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356502, "uuid": "3f950d4c-2ef3-410e-8666-f217fcca9ddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356502, "uuid": "c39cf5d7-b1d8-430a-8cd4-f0adfaf9cabe", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd8fb57-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342210, "uuid": "04d4d5e3-76a2-4ce5-bcc6-3ea843038b39", "comment": "Malware payload (Grandoreiro)", "value": "12d76d792b5da180e36f1cf1239ed310", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342210, "uuid": "0c693c24-67f8-4219-a758-69a3c01264ad", "comment": "Malware payload (Grandoreiro)", "value": "5203dc256a10cc23ed61c04bf6f1985e76d8c27526603198577b139d1e28cead", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342210, "uuid": "4bf616f6-5ca0-4ea9-a987-35e31510e485", "comment": "Malware payload (Grandoreiro)", "value": "103f4ddedd108fb63513da7adbc4f047f2c13dda", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342210, "uuid": "70aa9529-037a-482a-85cc-ebbfaaaacb04", "comment": "Malware payload (Grandoreiro)", "value": "ad1f23869e11295f4fbdd26894a47d2513baa41bda806d7be8fe6af7eefd5aaf1d43ae185af4e5fea8228f25e4cbc577", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342210, "uuid": "11ede1de-b61a-4187-a73c-8aea409ff8b4", "value": "T17546333ABF02589AC5A44375B97E1A355E3D320357CC95E375ACA2873385EC3AE3E481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342210, "uuid": "377d359e-d6ab-4c8e-b9ee-8b4bf2a474c8", "value": "49152:EC9L6c2ZZhja3aln4qk4LYfJ1wFcKnklB7hmnRUheYThtEzQro9wWZvLj3SUvjnd:m3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342210, "uuid": "6d9d3ff7-c8f6-4955-bf4c-767e1e761c43", "value": 5869568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342210, "uuid": "ad27154b-34ea-4ac3-8995-3c06ccf7903f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342210, "uuid": "048fe372-4b96-4aa7-a42d-f2274cf6e4c4", "value": "6KVYVi-6554JDZMIaarrxr_PlnVEB5S.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79eda62a-0bcf-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771312115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312115, "uuid": "d5615bcc-0f92-4148-8921-6644513d7fb5", "comment": "Malware payload (AsyncRAT)", "value": "2117ffb82d562e834c5850de5b3055fc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312115, "uuid": "1375136e-d25e-4488-863f-3861c239af0c", "comment": "Malware payload (AsyncRAT)", "value": "524603744cb5c25d48d0cf240b4f2aef43cd74904e6433098fce796e51f8837d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312115, "uuid": "7f452e86-aea2-4a78-9c5e-8e1dc8452c66", "comment": "Malware payload (AsyncRAT)", "value": "db58250dc7989fdc70b8f49adb372bfcbca4c9c7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312115, "uuid": "511590de-d6b8-4353-b59b-b7aa1e240539", "comment": "Malware payload (AsyncRAT)", "value": "72d593d755675394fbd72c0ea626c501036e7de65dc6993137d98df59724341e5b8b3722918d5953cd5eefa7d376ff2d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312115, "uuid": "b24e30bc-3c76-41b0-a749-c582e7540cc4", "value": "T1E47613B694100DE6411D4E3BD1381FE47EA8C3873B327929E716CFDBF246819A63B925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312115, "uuid": "c0d729f0-59da-4312-a7a9-ba33ee0a4553", "value": "192:UZxa0RSUC9OMhZIE4QIGUpjU9jHFTGUaKzMxUS8UMtBb9Ih+vIOMZJq7nz77K4F:U7akS7DOR4haPjUC4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312115, "uuid": "d4e7a56e-9844-43b6-9a01-83148ce99608", "value": 7161684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312115, "uuid": "9dba1367-536b-46d9-9503-46ac5a5da6ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312115, "uuid": "154be10d-6514-4b37-9b1c-c952a971239f", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c419948-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343097, "uuid": "76bd64fc-e2df-413c-9cee-995a5c5a1262", "comment": "Malware payload (Grandoreiro)", "value": "5a6a057f7e08b744878e8a5bde9f0f3a", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343097, "uuid": "c1becb3b-7b79-4408-9f0e-c9002f93ae36", "comment": "Malware payload (Grandoreiro)", "value": "525ae25c1e68ead0bd873ed29e9a5e728893480437b58f8b936189aa7b84c413", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343097, "uuid": "96592528-c9ed-4733-9d89-d1c160caa505", "comment": "Malware payload (Grandoreiro)", "value": "09e29a67f8f657b7a6905cd9c5a993e7ad8943d9", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343097, "uuid": "d856d15d-2b81-474a-8a1a-5930d420a4ba", "comment": "Malware payload (Grandoreiro)", "value": "cf43ee21250683218954139d6e5be82ef501400432a0894bdc9cdbe5c5de197faac5ad184be2ff918d9b33f05d66c001", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343097, "uuid": "15480ff2-f57a-45a9-83ed-b996bf80b01d", "value": "T110662332BA529C6AC98043B1705B3F351E3CB3174A48E9E738AC98877747ED5993F099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343097, "uuid": "de60cee5-29e9-41f0-8f12-532499fd0c86", "value": "49152:gMqpSowVJb3x2nZE/YmORKEdfcGsYWDlpEcdS+2BBXqfGyLn8uFWrPCVUSX1Gg84:L4uim3YpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343097, "uuid": "35cb9188-f2e4-4892-b61d-27299fabfcf9", "value": 6547456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343097, "uuid": "8d642cf5-389d-4bc0-b34e-5c97f0597aef", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343097, "uuid": "2e6842fa-4516-47f6-a84f-c037d2914b64", "value": "AutFKG2CJAQBYP-4354PSM0ylffhu_Em.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd597a40-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351769, "uuid": "c751b311-0308-4b71-88e4-90225ae364d4", "comment": "Malware payload (Mirai)", "value": "77c75d148e4ab8bdd24e8fe901be8875", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351769, "uuid": "d44c31a9-dc6f-45bf-acc2-556dde802d5d", "comment": "Malware payload (Mirai)", "value": "52a8200534cad16c28e4ab524916a2a36a5006e821e8c4b2d09b2e15630f7167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351769, "uuid": "da90ec48-8c62-44b8-bc4c-23b3b90994ee", "comment": "Malware payload (Mirai)", "value": "b906bd37b09e4e74cb3899546c08b918da9958f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351769, "uuid": "4d5da6b1-1ef7-49c2-924b-f3bc530a806b", "comment": "Malware payload (Mirai)", "value": "8c1b7a352f3905fe51caec858d0526b96d1510eb82c688c965eb01ed7d850dc2acd400b0cfc2e7ef47433eb1328da243", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351769, "uuid": "0769047f-cfa9-473d-a530-c54ef3d1d5b4", "value": "T11D53960A7E21CFBCFBAC863547B74E309658339626E1C584E15CEA015E7070E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351769, "uuid": "af071208-a520-4629-a05f-55879e5c6ac5", "value": "1536:uRRNZTbDuTm/O25BVZdLNCSZqBaCK9xIqgQFez:+RNZHDOyzFNCbjK9xIq3Fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351769, "uuid": "487cca4d-10a6-4545-a032-fcc645d389d6", "value": 64028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351769, "uuid": "765e5e47-9dd4-43c3-9443-631672abbcd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351769, "uuid": "7ea30f1d-6639-4f2f-a10c-39d0eaf0fca0", "value": "hoho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d60f2e0-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341703, "uuid": "0c06d4b3-8f93-4440-a6db-3c5b717d316c", "comment": "Malware payload (Grandoreiro)", "value": "a595e58d6e081c486fa12554f2669a35", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341703, "uuid": "9a01af07-671c-41ca-975e-124963517d4f", "comment": "Malware payload (Grandoreiro)", "value": "52ee0a1b10af4134d2c53e4f8fdc91fe43a270253602bbec6116180d19eef0bf", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341703, "uuid": "46d1f838-aec2-4903-add0-8057d4fda7e3", "comment": "Malware payload (Grandoreiro)", "value": "862ff35a4b4ff71cd03e1cf08c22f88385d31e4e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341703, "uuid": "4c6a80f0-c797-4e18-bdfa-1ba7c01b2ecf", "comment": "Malware payload (Grandoreiro)", "value": "a25380a4223bc8c61e04ef3de10c7a6747812f80ad6785ec2ae194de8494240fca3581a8c435d25b996113822612efda", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341703, "uuid": "ce5eb07d-0f07-43cd-9c95-ecbb8b2836e9", "value": "T1C3862332EA421C3AC5804779395FBE351F3DBF534BCCE9D564AC59827B49E80882E47A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341703, "uuid": "8557ee55-e0c2-49ad-be82-9b4b735fdbc4", "value": "49152:g4Yw4x8dMaPwzSpiG0leaUEoB9mosWIuOWtUuKaueL5pz5rD2hLoyGjH5Ny7TLKq:SxUXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341703, "uuid": "bbc3f77c-5865-4862-a2e5-b83b3ffc9d6b", "value": 8173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341703, "uuid": "d519b13e-85b3-4a90-824f-7d70b27286f7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341703, "uuid": "26c50270-a882-4e97-8ad8-0ee0e7419a57", "value": "0Ofc60779MXUNQUJDJ-396220.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3743a56-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343135, "uuid": "fd3033cb-0d2b-4026-831c-7d3405fc8715", "comment": "Malware payload (Grandoreiro)", "value": "d8b66fc8cfcee060ed7de795e3e50a46", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343135, "uuid": "9d084f47-d098-4e07-ab7e-1b3314126673", "comment": "Malware payload (Grandoreiro)", "value": "5319bcb94f439444e935626084fd734d5451808b268e5c1aa8ff624448d237c1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343135, "uuid": "e8e6f566-be98-4c6a-ab18-12876f55cd17", "comment": "Malware payload (Grandoreiro)", "value": "72cd56e7f3dbae72059740de571ab9051dad252b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343135, "uuid": "f26608d5-3216-47df-b0cf-ebdd169e8d12", "comment": "Malware payload (Grandoreiro)", "value": "7ff13f6af79abf965b554af63b150415c292ee0b893e69f3ae2618e0aa3fea5a0f5b47ac5c4bd5fe30cce2828f1ffccd", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343135, "uuid": "f822493f-f2e1-47a9-8c32-e58249c0e440", "value": "T108462334FA09E965C5B48371B93E3A352E7E2343418D46C2689EC307AF46ED7A73E845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343135, "uuid": "9db6f76f-f52f-4af7-92c7-9b3b531481f7", "value": "49152:zII1zAPB4KUhBWmRpHJJm6WJA8ziQx228FMrnhILuoPhfL0H43dM0GP1qr:U4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343135, "uuid": "63806a44-204c-4704-8dc5-87d0e16d5895", "value": 5416960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343135, "uuid": "73d0981d-2069-4fa8-8ba0-3f5bdf8f090a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343135, "uuid": "1e6d8db7-94de-4ffa-be89-54ce015709bc", "value": "Bnfc450721UPMJ-YA7C6470vqre.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851f6b8a-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342199, "uuid": "f1628745-512b-49bc-965d-fd39e8a37f82", "comment": "Malware payload (Grandoreiro)", "value": "376f9b7359ae62bf30391d2ac544f561", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342199, "uuid": "b2b293ec-a485-4391-9720-19595b836fe0", "comment": "Malware payload (Grandoreiro)", "value": "53c01799e8f782f72be34c979ed9b1823cca5e03fe2937dba96d92e12279830c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342199, "uuid": "312ad078-008e-453b-958d-11d24da93637", "comment": "Malware payload (Grandoreiro)", "value": "cb96dea887b07250791d4022682e4732126d410b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342199, "uuid": "5282efb2-c761-41b2-88ed-8e68c60bfe45", "comment": "Malware payload (Grandoreiro)", "value": "408505b2f23cc9abda41d21e42442a7488977745729d98d63c88f47d2b58b74794f845ccc5375227c98f9b81457e43cb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342199, "uuid": "904751a7-f19b-4838-83c8-f11fadc27081", "value": "T10D763330AD692C2BC6914235B01F2E254F3C1A63874DA6D7B5EC60C7234AFD2D93F8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342199, "uuid": "e46f0620-a625-4d83-b01e-f48bb7d48528", "value": "49152:+v8eztTdS4PuPxjInT7x2Zir8uVhy1z9OmMBuo2/n6Muw77oPDOp/Y9OCbSPlVdU:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342199, "uuid": "f3a9f181-b092-47f3-93a9-fce5171287f3", "value": 7440384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342199, "uuid": "886f4dcf-a37c-48b8-accb-acbf748db45f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342199, "uuid": "b7849aae-a228-4c8a-84ec-30b92d7de92e", "value": "6199So_Escr78VQ5LGGNE-85258AG8L43.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e959f27-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1771311640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311640, "uuid": "8271ba8c-8796-46c7-8cc2-95901c524d63", "comment": "Malware payload (DonutLoader)", "value": "3d78cabf9f4e0e9f873763cbd89a7406", "object_relation": "md5", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311640, "uuid": "ac2900e4-3c9c-4291-ad9d-edccd85c2717", "comment": "Malware payload (DonutLoader)", "value": "53dcab17b20faf653c8cbb31e6c4be0621b3af9006d431cada42cde533cdde08", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311640, "uuid": "ee15309f-5245-466c-a488-6d5115939471", "comment": "Malware payload (DonutLoader)", "value": "3ff29bcbd9d07a0f3778813b91b2757502533713", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311640, "uuid": "c01b188b-eda9-4fd5-8cf8-7536b578a15d", "comment": "Malware payload (DonutLoader)", "value": "b8759c706c42cef0e4c72c31e6a9fb787df59d1f9a526db5f63862ab5cc070d2367daae666f5c117788b07da61a2229e", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311640, "uuid": "bb82e4de-03ae-4e2a-a2cb-ae5ea40a6423", "value": "T162214F4262EA0248B5F31E6C593EA9350AB77829CD39C74C018C649D5FF3950E871FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311640, "uuid": "d09c8d45-c3e7-4e0a-a3f9-afeabe4babe8", "value": "24:QLZ0pa+eodNbNGshdD3rnf2ZkWJoSr6eNTsGhZkWo5oUCVJakWj2ZkWvkWfkkWf/:W0qodNbNBhdD3D2ZRoSr6eDhZNVkL2Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311640, "uuid": "8dbd6323-c724-4212-b49a-7fc1742136d2", "value": 1340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311640, "uuid": "37522eee-88fe-496a-a768-a48819fb54f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311640, "uuid": "b623c095-6bec-4c5c-8c7a-1f0bf6ed090e", "value": "53dcab17b20faf653c8cbb31e6c4be0621b3af9006d431cada42cde533cdde08.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc35428-0b9a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289249, "uuid": "a4b434c3-8ee1-4f0a-9fda-6f3d2f3ced19", "comment": "Malware payload (Mirai)", "value": "9c605d0b0db5679af7aa82edadf17bdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289249, "uuid": "6e09c425-7140-401b-be7b-c70cee287f8c", "comment": "Malware payload (Mirai)", "value": "53fb40ef825c64abde9062adf6d31f604f9d1bfc1d08c51ff401c442d90e58d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289249, "uuid": "f4eddf99-9cf1-4463-8c64-4b839e021a40", "comment": "Malware payload (Mirai)", "value": "d46dab773e240d48b5724a4e3c13dd3e5c8bc992", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289249, "uuid": "3d497614-218a-4e53-924d-67c0cdc7d65c", "comment": "Malware payload (Mirai)", "value": "ac08764707eb634d478f0bebd4441b4ce7fc056b44508f576f2411fdc1da8ee9e0a86322cf999ea2799198c361db3f1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289249, "uuid": "d1266596-faa4-4db1-8856-3fb9a9425645", "value": "T1853318D6B401AE7DF95BEFBAC0224909FA31620151930B3B23BBFD936C322658D52D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289249, "uuid": "dfda49fd-269b-4bfa-8a8c-be18283162bb", "value": "1536:Wlrztlv7LlNvi2hoHDrECHTnJ1/iVB539j82:q7lFizrEATMB5tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289249, "uuid": "58269c76-17ff-4509-b8bc-67e11a4fdc08", "value": 52492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289249, "uuid": "0bfb969e-e1e7-4e55-9637-23a60685e2fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289249, "uuid": "c8a75e89-0514-4ef5-8efb-59ce8611d7d2", "value": "miraint.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6127dd-0c49-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771364707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364707, "uuid": "0cb8091c-5948-4a78-be26-7b220ecde37a", "comment": "Malware payload", "value": "635c804db9bd198eb601f0c36db4f149", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364707, "uuid": "16df9335-c2bf-432c-a5cd-78a2e3ff84e9", "comment": "Malware payload", "value": "541282ca90ef948f9af4ad2db421c25b5231553cfc4f70dab18074c628442845", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364707, "uuid": "db388718-aa88-4e8c-be3c-9bf04f198276", "comment": "Malware payload", "value": "cf38590941c4fc4155f0b4ae62f8e92d55b71d92", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364707, "uuid": "c71583a3-2419-4b73-9421-3cca312bfe9c", "comment": "Malware payload", "value": "215c63d5325e545fde64d6c7ffd04d81d01854bc3d76de2574e2ebfc5a0616a93e0037b9847d26bb862b49bcaae9ff07", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364707, "uuid": "1bdfa8ce-5730-4f68-a1ec-8aea4f0cd0c3", "value": "T1D1C633751B68B90E2C2E275CB867D50D18B3572903CEB097C215F230676C629DB7F2AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364707, "uuid": "39b1ed08-f71d-4fb5-8b90-dfa8d3079011", "value": "196608:A1EcHjfgCtnN1eg+MDzQyGiXWle0piGFpI5zorkc8t/qy3KzpGgvKDpj7:KzgqNxTQyGiXWMiiz6nu76zTvKDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771364707, "uuid": "0445c092-0263-4ab1-b8bf-b023910f85d7", "value": 12302855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771364707, "uuid": "d07048f6-23ab-4791-b899-a891b13b91ce", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364707, "uuid": "bbc34214-63e1-4ae1-a101-85d51c694f65", "value": "shellcode.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0dae34c-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771344017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344017, "uuid": "ac2ed989-2998-46c3-83f6-9af618f50f19", "comment": "Malware payload (Grandoreiro)", "value": "2d8a1a948cb5d8a987a8deba8dfda29f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344017, "uuid": "6adb9c1d-c21b-429d-a968-323a82f0a732", "comment": "Malware payload (Grandoreiro)", "value": "5444ee821c04a036d286e3314d5e9d1966bd2225047865bbd2f54beb19f91a34", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344017, "uuid": "198efb7f-773d-48e1-ba16-2e7fc20bee0a", "comment": "Malware payload (Grandoreiro)", "value": "790dfb3b2df321c6bdcef0260cb6541785e09976", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344017, "uuid": "5b94ceca-a809-4678-bb70-b92068e3fe87", "comment": "Malware payload (Grandoreiro)", "value": "98406cec1b37d335cc5b30347e8d4eee5ee5b804d59611c84a2d4702a67ec97976607fd125032137d88ffe4b7582d40b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344017, "uuid": "55656666-6477-4eea-a327-8cb4f788cb68", "value": "T15DA633306F542D1DC6A88374B12F3E266F7D6D535A88D1E678ECA1C7234EFC1811B86A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344017, "uuid": "ccc0e926-bf08-4707-b3af-4cb024ce72be", "value": "49152:CO+qabkDvTj0CWQFkgMw6tV1B+IFg4Chzq8yymeXwE3TRGhiddAvB5Biua3h7y8r:3qf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771344017, "uuid": "2a0adec8-adcf-4144-a31a-01b79d945c24", "value": 9478144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771344017, "uuid": "59ea8c7f-cb35-4d93-a560-67d9756fae00", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344017, "uuid": "b9e7c8a5-df70-4522-a091-45b5db0a90f6", "value": "Prdc322I82_750776CUTGK9TI01Sjsuese.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9dbafd-0b9c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290408, "uuid": "a7255423-debe-42b6-8f04-ac91a40ff0b5", "comment": "Malware payload (Mirai)", "value": "c4f0797ce4d288d1c175f751807711ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290408, "uuid": "b91268e4-40a1-4e33-aa28-3526da9e445a", "comment": "Malware payload (Mirai)", "value": "548a2a822a816c76ecc593289fe8cf0dc76ccd555360722986cb161c31703e53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290408, "uuid": "8f166df3-5dd1-41ab-90a5-c76682b45e75", "comment": "Malware payload (Mirai)", "value": "851cba9b44e828b9a4e6122c05651c9c706c4336", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290408, "uuid": "b0da0f37-1627-4f39-82db-3de469de785e", "comment": "Malware payload (Mirai)", "value": "6751b9860fea684c4810f9c3d028ae54017c8f0d9839167a235835fb2126dbe9b2566111e1e0e3255eb3cf43ceb829f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290408, "uuid": "ec694bc5-a86d-4fdb-8504-f15829d315c2", "value": "T12F331895BCD29A6AC5D423B6FA6E519E3321A3E8D1CB3217CC204B1437CA51F0DB3B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290408, "uuid": "b2797caa-1700-4b8c-9ad3-1b2758596399", "value": "1536:bATmE7OY0qBsCiHRT+6g/r6rL2yBCNt5sQUB:bATmE6Y0vckvkbsQUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290408, "uuid": "b97cf1cd-93aa-48ed-93ae-9ca1920e7d2d", "value": 53344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290408, "uuid": "0efbaf37-dcff-4ed7-9cf1-04840d7992a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290408, "uuid": "616630c9-bbec-4a36-815f-e2834cbad7c9", "value": "mirai.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac4e446-0be2-11f1-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1771320492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320492, "uuid": "f7013b14-7b1f-4215-9473-595812d84552", "comment": "Malware payload (GuLoader)", "value": "1d132842eb3cfcc28a9c1c05a083435f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320492, "uuid": "2a302d35-45ad-480d-9e3a-bee4524eeb1f", "comment": "Malware payload (GuLoader)", "value": "54a6a8534a00d3b362bab5695a5a08db7785a533e30e23482c737fd029d96da5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320492, "uuid": "3b584b67-f024-450c-bc0b-421157071d3d", "comment": "Malware payload (GuLoader)", "value": "162edc507846dc901cd8b840a9443556981fe8b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320492, "uuid": "69209546-761b-4920-b668-8ea0852fd117", "comment": "Malware payload (GuLoader)", "value": "57aeddf181a06078b27e93170b725747f0754c37aedac8bda8a74e34cdbb3ca53235dfcd4e2f03331927e3be14355bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320492, "uuid": "c1cf39e4-7ae7-4c96-8855-efa0ff29992b", "value": "T11B25122226E4E19FEDAA653659BDE123B9D74E10AB0429831B0F7EED5A70E00341D1DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320492, "uuid": "15d1ea3a-9f18-4340-862e-9ce0678d092a", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320492, "uuid": "a812210c-10f2-482d-bc34-49e253f4b027", "value": "24576:SwqxteEa4D32MAI7DqkDI319PFmL63tId3oC:QaUTqWIwWtM3oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320492, "uuid": "3f87f0c8-85eb-45a5-aa5e-818adf35d34f", "value": 964088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320492, "uuid": "b021d982-e3a3-4e71-b05f-cacd55ed6c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320492, "uuid": "7dc7f545-7c4c-4092-b8c6-4d076e06c8bd", "value": "54a6a8534a00d3b362bab5695a5a08db7785a533e30e23482c737fd029d96da5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532b08d8-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309044, "uuid": "d55ccbdf-b69c-4247-97df-b1b61ec31a6e", "comment": "Malware payload (Mirai)", "value": "910ca0d16f7d294481666507e0057d70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309044, "uuid": "7164e446-1474-4d03-aaa9-3888f1b165bc", "comment": "Malware payload (Mirai)", "value": "54d94c3061311bd11c8287ad28105de690a5e4f08b73e46644131ebf324af2a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309044, "uuid": "802322f1-2051-45a5-9a3f-a3968b511005", "comment": "Malware payload (Mirai)", "value": "c6c9ecaf59c9aaecc53f889680e9c6f49bea4411", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309044, "uuid": "a615a64c-a746-4925-9ae4-ca3895f6b721", "comment": "Malware payload (Mirai)", "value": "5ae87fbeac79e2ebda3ce6ec20a5abe9868d866b5c65d6496824ac6c4de32ad912b08a4f2ba890d0b2a8ea69c863de0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309044, "uuid": "7531d399-43c4-4f59-9780-4c5152b3c441", "value": "T140132986BC818D2EC6C0177AF66F218D3362B3A9D2CB3203DE545F11778561E4E7AE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309044, "uuid": "211e28d1-b30e-49ef-8b23-42c725a66cd1", "value": "768:RG1zWSCZMNyR2y3mmu45gDdZNOdnpBqdKA2sDci0GAO1qrPPi4wmHEuRNts:5ZWyUwu+gDdZNOdnpYzl6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309044, "uuid": "2f548080-20db-44f4-90ad-833175585afa", "value": 43348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309044, "uuid": "0dab0c10-aaa0-4b18-a209-d213567b4bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309044, "uuid": "0b2f36af-998d-453c-bdd6-602626137ae3", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284cd33f-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343332, "uuid": "874d38ed-206f-4b0b-84f6-5821456b5dac", "comment": "Malware payload (Grandoreiro)", "value": "3c81d66fe0adfcabebeb858ab2282e97", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343332, "uuid": "6951d5c0-07d1-4faa-a01a-e426c75fca74", "comment": "Malware payload (Grandoreiro)", "value": "54e9415a736058571861780caa2acec3b575af5383be20cfb1f59053474166b5", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343332, "uuid": "9d971280-8a75-4a95-a29b-1d853be3eb46", "comment": "Malware payload (Grandoreiro)", "value": "1ced63a0a76766bafe9eaa46a035f287d3c52c2d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343332, "uuid": "968b9ce3-1917-40a2-b2a6-5527f442b6f1", "comment": "Malware payload (Grandoreiro)", "value": "117b155e8feb5c4f5835e9db37ff2d5a156ac8016bf574c32c79e707a683ee330d7050292b319ff545e83b6041cb1e27", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343332, "uuid": "cde7b93d-53f7-47a4-b72d-8e88c8353c24", "value": "T109863332BE445C67CA94833AB52F3E280E7C7E0385C8A9D664DC55827B4AFD6172B079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343332, "uuid": "84146fc2-e099-4e4d-aeed-4184abe0d405", "value": "49152:0f63w8JaCpm3mmuqSrTdEr3lqgRSUOoi/Ko/PkfZFXCxstT6SOtMfynsfSNT0hZq:yU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343332, "uuid": "480165a1-1b92-4d51-80f7-0d123a3d5074", "value": 7839744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343332, "uuid": "50858cbd-5bcd-4ff9-ba25-79b7ed130a71", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343332, "uuid": "5b88e6b7-a45a-478d-b4d7-a33f90aed0e9", "value": "O9I8_Inf-Orm02413CTCN.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f78e0e-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343272, "uuid": "4f8860c9-1f8c-4392-9601-51a7ff1aeecb", "comment": "Malware payload (Grandoreiro)", "value": "ca2347aef854b87100c7bfae137493f8", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343272, "uuid": "75f29e55-bb82-4407-abc3-953820f01357", "comment": "Malware payload (Grandoreiro)", "value": "55d08b53859044da12a2c58907f6743792da094430ae94b6b5c96c8d3ddda728", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343272, "uuid": "db933dcd-7470-47d9-827c-8065cd2a2004", "comment": "Malware payload (Grandoreiro)", "value": "63553326a57492f07e9d96ba85f12134ae5f1663", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343272, "uuid": "a0736cc6-40b5-4a04-8a69-4a8f5ef2bcf1", "comment": "Malware payload (Grandoreiro)", "value": "55b448969d0fcafda0c1400e93be9ec62788a9ff36b3d911674febb6771d00712049a6e621a82a9737b511386a725f93", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343272, "uuid": "940a7e50-d006-4363-bf11-dfd2a9fd5766", "value": "T183762331BE44282EC45143B5B13A3E322F3DB31388CCA6927C9D938B6746ED6562F497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343272, "uuid": "7b6b6cc2-74aa-4209-9b4b-a260bf07c378", "value": "49152:w2NIL4CN+jaOyZ0fCQXpS3GKstaQdn5t1hhh2Xn/tEyF0timoW3t2QK8zhVXOGWa:rUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343272, "uuid": "e6cc81cb-038d-4200-9bce-dbc37481e4fa", "value": 7387136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343272, "uuid": "672a09fb-92e4-4467-98d6-ee876e7266fa", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343272, "uuid": "7e682166-9cf0-4eb8-9566-dfea10323091", "value": "NmclO6O9R035880_BFTB.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becd9993-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343155, "uuid": "3d20fd33-f19c-4975-9b3c-6d4e01436fab", "comment": "Malware payload (Grandoreiro)", "value": "ae9e741027a7e62a6d0d60504cf9da6e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343155, "uuid": "bbc14a7d-1556-47d0-b193-f9b37f2d8c29", "comment": "Malware payload (Grandoreiro)", "value": "55ef81fe0bc43b04ea094aea4a17855ab5a0d018f0880596a3bbafcb0d871df9", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343155, "uuid": "183612c8-1b42-46f2-b806-42a4f6d23c6d", "comment": "Malware payload (Grandoreiro)", "value": "da200155d1043c0d451fa5ae7678f8e9b493f20d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343155, "uuid": "97341d6e-cb2c-4684-9aeb-e2307e81a454", "comment": "Malware payload (Grandoreiro)", "value": "b2c9345decff947d216ccb0d95dd3fa6441f6adf27a2b93b847acd71e910db259020cab9786a792c6af0a59d2ea0b7ae", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343155, "uuid": "a21cdefd-0987-4955-bf53-e53b5cdcf8fe", "value": "T12D863331BEA15CAEC7A48330306F6D396E2D961389CCE1D6B5EC90871B4BED5463F099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343155, "uuid": "1c54a946-9b05-49c4-bc7c-c75e8bc18c30", "value": "49152:f8hyjpdKI9J7T8oUfNnFe5+fdrHuZBWvy/pRCeZlBj6jXY+wxSmQx6ZIFxeyDJbz:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343155, "uuid": "6b286693-85ff-48d6-95e0-970c14cd8ff8", "value": 8409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343155, "uuid": "501284f7-8133-4e35-a7b2-ad9fe199f6b2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343155, "uuid": "e3c82ce3-99c9-4b1d-a0a9-4b8f0a298caa", "value": "Bol257380ADIXUBDO-5579_Cita.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9deeef27-0bf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1771329355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329355, "uuid": "97ec3013-6a29-4194-84ff-16883d17dfa0", "comment": "Malware payload (Meterpreter)", "value": "ceb1f2415bb1eceaaddcd511444abfc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329355, "uuid": "72c55cf4-5462-4b32-89d4-e5f482a59259", "comment": "Malware payload (Meterpreter)", "value": "560f80c23c1243b33d5c28d1378f0f9cf1ccd44a293869dd2a33c91f5607e677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329355, "uuid": "39e1aa05-bea3-417f-9420-e58b539880b5", "comment": "Malware payload (Meterpreter)", "value": "72c8d5faf8e546e27479ea626042e8ab1a9c29f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329355, "uuid": "830dc712-e365-4f67-9933-6257c531984f", "comment": "Malware payload (Meterpreter)", "value": "2331bf90c8e84fe23d1e54034411d5e95bfbe8c2c3ce232872d1c2e126d25b2ea7d061e507868e17a12fa0bef37c7105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329355, "uuid": "5f526d39-4e68-4a63-af8b-42df6f9440d7", "value": "T1EFF168C773156CB2FE790BFF8643CFD692FC7B35539707590224012A615152A7561F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329355, "uuid": "568f20e7-60d4-420b-8c10-45977812ef2c", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329355, "uuid": "4a45ceea-1f41-4d3a-8457-d594a2e25563", "value": "24:eFGSGlSmpFaknehtht6dp5RG1Y+hKZqQeNDMSCvObp:iGlxfnehthEdsq+h+SD9C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329355, "uuid": "d057870d-0031-4575-9848-eb5abee855bb", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329355, "uuid": "b7db4753-65b1-4db8-be06-15ea03144915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329355, "uuid": "c88190bc-7570-4ee8-977d-a5d5617f12b6", "value": "svc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe4c832-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1771311239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311239, "uuid": "165a3fd5-7ce1-4093-b8b7-ef6cc7b07805", "comment": "Malware payload (Stealc)", "value": "b4f8e719b702b2b168a4a2e3f138fe02", "object_relation": "md5", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311239, "uuid": "96fcc9b7-9550-453c-b848-3cf60e536786", "comment": "Malware payload (Stealc)", "value": "56d1ba3e7725f963bd7d1897198adc6eeb8645e6e80052fdf6ba734c1575bde2", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311239, "uuid": "681e8ecc-7d46-47f7-bc4e-ebe0d63d6653", "comment": "Malware payload (Stealc)", "value": "a983e2d3119a32d4f549fefd7159a20a4c93c89b", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311239, "uuid": "081cd0ad-ff07-4f2e-b078-f44b349062fc", "comment": "Malware payload (Stealc)", "value": "1477e255ee1b98b2a3c477dcc3581b11ee882d9a3d22785299853f49c5a05e8cd885ca39bd0a37f612681f1b5f00d0eb", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311239, "uuid": "dea4e6a4-79fa-489f-becf-e6eebd82039e", "value": "T1FB058D5EE7A502F8D0B7C178CE424556EBB278065370A78F03E15AAA1F376905F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311239, "uuid": "3ea91295-a590-47c7-afe9-9a366a86ba00", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311239, "uuid": "df42c1ed-4b22-4fff-9d0d-c175d82d7305", "value": "12288:/VFR6dYKVC9eym65QBZ8C89iIdw5Hmv3YZtF15kjHKA:vREC9eym65EKCwi6KHK3UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311239, "uuid": "236484b6-3d2a-4826-b151-96deaceea77f", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311239, "uuid": "c1645d66-4105-49d4-83b1-274d5c70c338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311239, "uuid": "6c19649f-57ef-4d41-bc6a-f58de0578c80", "value": "56d1ba3e7725f963bd7d1897198adc6eeb8645e6e80052fdf6ba734c1575bde2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4729788-0c04-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771334950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334950, "uuid": "ce3011f2-b76a-4d19-a857-a71fee85def5", "comment": "Malware payload", "value": "be3df677153ef39bd7c55f753ab013df", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334950, "uuid": "9b413a8a-20f1-4bf6-bd70-e13caa2bca57", "comment": "Malware payload", "value": "5910d29e7ebc1fa13b06b43db74ccfcc17e23d74abd5555f52c22f0958aeef03", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334950, "uuid": "209de3a9-c992-4cf1-bd53-afe0e1a15112", "comment": "Malware payload", "value": "7dd7dc773e800857653e28dbc7d967c000eebe2a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334950, "uuid": "d4af009e-86c7-46a7-953c-c39c2e7d5176", "comment": "Malware payload", "value": "a97eb0d623bbfd0877263722c214b0e9d2c6a9fa86a5e0a3b38f42b6bdcc390f04a930de38be6c8d97d3168d989488f9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334950, "uuid": "e69e5833-7d25-4947-be29-f0b923860ec6", "value": "T1B5573356B49A432FE8770535E229D919C3923EC166468E176020F31FA6F37DBE5FB202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334950, "uuid": "cfe46e03-9e0a-453c-975c-8e7abd869755", "value": "786432:QfZeypEEnQFp/lZhT+XF2oyR/FG0X1XEvUsL34:wZHpEEMpDhTaFFyw02csc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771334950, "uuid": "4f95a305-ac9f-4310-98e4-0984e03b9c5c", "value": 29601792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771334950, "uuid": "b6dfc655-67c6-4a31-ad81-961b59803144", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334950, "uuid": "599701d9-4085-4e76-86cb-50b70c29d075", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26475b0e-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349341, "uuid": "c67c0aa7-9048-4f4e-ac64-1491604fa7b0", "comment": "Malware payload (Gafgyt)", "value": "7b6c96f01d2a4c4b00c7f4156b6027af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349341, "uuid": "a9c6715a-a250-4aca-a2ee-c434b9abb222", "comment": "Malware payload (Gafgyt)", "value": "591ad765828cdd07698140e0ab7ba968ae6d2377d8ec112fd7949fb8e5458009", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349341, "uuid": "48f5d645-e203-4424-af58-a25f60e5f4a9", "comment": "Malware payload (Gafgyt)", "value": "8efd7b26eeac8ed6c70778c259cd319fa5c266a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349341, "uuid": "b3bfb67e-6381-4881-b4f8-eb85bc7956c4", "comment": "Malware payload (Gafgyt)", "value": "05b158450c725c778415d142bbda08b8bdbd483300c72ee1bbfd66871117774a5eef8b8848f3768408c00bfb3396293c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349341, "uuid": "8e2755bc-10b3-41ba-8125-1a291ef05df3", "value": "T191C32905E8918767C2E217BAB79E425D33332B6893CB33255938AFB41BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349341, "uuid": "8eb6c477-3818-4fec-8a2a-f6c87462d70e", "value": "3072:Fdce4ah2KVXPi4jvIx+2wD8JH5ZmTQOIsXAqE:/N4ah2KtO+2wDmZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349341, "uuid": "27eea491-0925-477c-9e1f-2ba5b2806925", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349341, "uuid": "0ec12c6b-e8ef-4ec0-9b57-582b7768ba50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349341, "uuid": "ba69c608-e2d6-4421-b4f3-60c07f4df755", "value": "armv4l.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fcce1a-0c1e-11f1-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1771346111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346111, "uuid": "5638c5cb-9ee1-4b7b-9863-84c320901d6a", "comment": "Malware payload (AsyncRAT)", "value": "135436087e5a9f4742d79a65b83b8ddd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346111, "uuid": "6a3ddce0-096f-446e-af94-3a7b13f77d43", "comment": "Malware payload (AsyncRAT)", "value": "594403b943ccccb6926833e355d3ca3d8af15251499bb36426d1f17bd7e5ec5d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346111, "uuid": "12abce27-0acc-4320-a927-f6b6c066fdf1", "comment": "Malware payload (AsyncRAT)", "value": "92ea260f98f719e3a73d0027f6aaae8f6ea02143", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346111, "uuid": "89c9f199-7243-4aef-883e-58324ecac2a6", "comment": "Malware payload (AsyncRAT)", "value": "2532804178cb6cb5fbbbf3fe26e48e502bcb30f09235c0a2f7296edff588aa8383a630c2f19f5f9fa5d05d00663c97e4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346111, "uuid": "5c8e70f5-6e44-4327-b9fe-cff4bedd5442", "value": "T109046B5837D80A15F3BE5FB8F4B012118B71B477AA1AE75F08E920EE0D62351E911FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346111, "uuid": "a798cc15-d147-4eca-bbe9-bdc50f9f6625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346111, "uuid": "85ec76ee-ea01-42e2-9029-b91aeeda81f9", "value": "3072:le8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTlwARE+WpCc:p6ewwIwQJ6vKX0c5MlYZ0b2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771346111, "uuid": "3516a17d-6f00-4527-9790-07a69196ed19", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771346111, "uuid": "dc06da52-1c26-47ce-b795-17794895196f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346111, "uuid": "75449b8c-aa89-424d-a87c-446aebd58286", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6875dd-0be3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320652, "uuid": "447ace36-af34-424b-a74a-b781e6313926", "comment": "Malware payload (AgentTesla)", "value": "106d93be6bea5855a33564e8a3ee1ff7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320652, "uuid": "468b1428-62c3-45ed-bf22-f294f4a8e5c6", "comment": "Malware payload (AgentTesla)", "value": "5a66f37709c5fadfd3c7504c683e18219c9b0ab4df2833e7236c8a7406ee6ad4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320652, "uuid": "8b50d961-aeea-4a7c-a16f-490a6ca18c45", "comment": "Malware payload (AgentTesla)", "value": "a5a4d164de2690db2388467504226f0d3f7b6375", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320652, "uuid": "7f229c2c-9cb5-49e0-af85-b355972ee0c7", "comment": "Malware payload (AgentTesla)", "value": "e5790b3e5ce1d4eb7ea46e1e6dcd6b5af119a90b98fc57ecab48431392ab9d05cda98042da4a291556a57dc3615ad7f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320652, "uuid": "2364cc60-476a-4ee5-9b51-48aea25f3292", "value": "T11A3400027F88E715E1A93E3782EF6C2453B2B4C71733C60BAF49AB5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320652, "uuid": "54c28d3e-a254-4426-aa0c-adc17d47d340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320652, "uuid": "3d507c9b-0be7-46ef-932a-30d11ec91dad", "value": "3072:mYbqayiqH2zSyo+AskmTHo9rG8KaG5jnThJSYufzz:bqayiqWm1Isq8KaWT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320652, "uuid": "5020bd35-fcfb-487a-b0c5-dae1ddf29c6b", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320652, "uuid": "93876304-9512-4338-9670-ea4a92eb54d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320652, "uuid": "673ba0cb-dff9-4426-9696-cb7d5a79e473", "value": "5a66f37709c5fadfd3c7504c683e18219c9b0ab4df2833e7236c8a7406ee6ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bfab84-0c49-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771364512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364512, "uuid": "8cff7234-c35a-44ca-85d2-ce7e82743e3d", "comment": "Malware payload", "value": "9e9e998cbc39334bb8681e91ebc180c9", "object_relation": "md5", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "aplicativos-br-com", "colour": "#2FACF5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364512, "uuid": "cd8ac89a-da12-4f0e-b138-90a597aacb24", "comment": "Malware payload", "value": "5a8d4eabd009a75ecc04f3f06489d393f082f963b406d0d3e8acbea568281c5f", "object_relation": "sha256", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "aplicativos-br-com", "colour": "#2FACF5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364512, "uuid": "5ec6f3de-c8b0-4f18-85dd-9ae2b3fbef1b", "comment": "Malware payload", "value": "5c9a836f888265f9b048b13d33b87aafd9266f72", "object_relation": "sha1", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "aplicativos-br-com", "colour": "#2FACF5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364512, "uuid": "ec25ae8c-920b-4dfb-a474-ea7db2a44b54", "comment": "Malware payload", "value": "7fda154c29b8ebf8eed303407b19e9a8f5a884074661d27e32f2f9226606e273e5bfd5f79b2800f372e8d6871be61db6", "object_relation": "sha3-384", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "aplicativos-br-com", "colour": "#2FACF5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364512, "uuid": "fd940334-d3cb-4790-9dfb-59919c8cff33", "value": "T1E7962246BBE89E1FCC3380364F5A523252499E2BC753C343D964361C387B6E54E897EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364512, "uuid": "e724cf55-b386-47a9-864a-824576647e51", "value": "196608:ocvhbp1qgj9mL7XrqEww/iihowYPeozPlAV4ypYFZk1O+L13la:bNfRj0HbqEww/FhvYPO+yGktR3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771364512, "uuid": "f7e1697c-34ac-4b35-b538-8ed7b10c9661", "value": 8885510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771364512, "uuid": "8e732be8-e44c-488b-b55e-2dee47d14bd3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364512, "uuid": "4909f19f-c540-4ec4-8654-5b749c7abea2", "value": "PaniniCollectors.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7af63fe-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351759, "uuid": "0c3b9acd-13f6-4b3d-8dfb-4d800a9965c8", "comment": "Malware payload (Mirai)", "value": "c6a1e984cd11af49923254f060c3e9cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351759, "uuid": "acf77deb-9b7f-4214-8eb4-2ec73eedec3d", "comment": "Malware payload (Mirai)", "value": "5a8f8f29cada2ee39c5c32ff905e7e1ae21c468ea6d12edb4203276f984f6392", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351759, "uuid": "0a3c849f-fe5d-42f1-8021-d0d54bd7a347", "comment": "Malware payload (Mirai)", "value": "98f37e1996e5dfd0a006641c3eca7ef075707db0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351759, "uuid": "97507037-dba8-40cf-9d98-08973478f3c3", "comment": "Malware payload (Mirai)", "value": "0c20e708a20e4deb7f0f19df1b41eaf63758b78a4e7963a4ab83a437025c21bc15bafc10e5d181df7771f4f7a19ff4da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351759, "uuid": "80203c45-f385-465b-b465-c63184de4636", "value": "T1C8138EA2C06DAFD8C1488674B8284F781B53E445C7536FF99AE945A68047EECF60C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351759, "uuid": "85ed76d1-5b2c-4c0f-9b34-f76cc50ff92b", "value": "768:NanapGwtbGbh/EEZYePDznRVrgrq7OhGdv/qzCvoBJbCb:Na4Gwtq6ECrq0Gp/qzLLbCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351759, "uuid": "303f8d6d-2c33-4e56-ac0c-63343ff713f7", "value": 44348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351759, "uuid": "ac3e489b-c8e3-49b3-ba0c-2d68ff9975c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351759, "uuid": "f2eb95e5-96d6-443d-82fc-33df23f2faea", "value": "hoho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9882c53c-0c00-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771333212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333212, "uuid": "572b4749-7aeb-4fb2-86bc-ff42126d1336", "comment": "Malware payload (Grandoreiro)", "value": "95f597ba1ebf72275c5a1c0982c167fe", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333212, "uuid": "6ff4fc56-21de-4ad5-89fe-7cf62d2e172b", "comment": "Malware payload (Grandoreiro)", "value": "5a98f4182c3e3ed9b2f1604b6371330653079e7143d0fdbcbc6c9abc448b72e7", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333212, "uuid": "e9c2276b-ce38-4012-b890-ad84adecc877", "comment": "Malware payload (Grandoreiro)", "value": "cf9e1e56a12083ef15ed274107d878d864076b97", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333212, "uuid": "21899a57-3ce5-4291-be25-ecc770fd380d", "comment": "Malware payload (Grandoreiro)", "value": "c7f7c6e9fee157e624232724b2f474904bd66149497fe5ef4f210df8c8ff2e80ce92ad7d3a62b59a25a40bc91f0209db", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333212, "uuid": "8369d004-89d1-4730-afc5-0c2b84b9af5c", "value": "T1CB662332E6151C6EC6608374793B2A352F7DB54786CCA9C574EE82873782BD58B3F884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333212, "uuid": "cbd9924d-0642-4557-9d29-6d505d9f290f", "value": "49152:zXkcxH2ldlw7tNrpVg4ESeKr1zk/Ccf3V+tAnr9C19fOF1Gincrvj7EYnqrIt7K3:5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771333212, "uuid": "3a7bfe34-e1b9-49a1-babd-b1ee2de78332", "value": 6479872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771333212, "uuid": "daec3057-8d8b-4309-8128-82eb7cfad36d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333212, "uuid": "4ecb4ce1-f565-4fac-9b61-aa44460f5d7a", "value": "IAGFLY0375_Hm-4T99H902707nignh.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60112a67-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342137, "uuid": "4c377fbe-1e2a-4f62-aebd-5ed0d678f4ab", "comment": "Malware payload (Grandoreiro)", "value": "00d4a7d8df0b1ced201785b841cb838c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342137, "uuid": "1e70fb1d-1212-45f6-9d0b-ca41b9992ac2", "comment": "Malware payload (Grandoreiro)", "value": "5afaf6482444e20fa604276063b81509f6115659cb5eba53e873a3ac79a2badc", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342137, "uuid": "582d6d56-e0ca-415c-bd83-8562a7c583df", "comment": "Malware payload (Grandoreiro)", "value": "7db48d35eb38983397ce5016e2a56ccc950ef832", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342137, "uuid": "9b5f30ce-acde-4a78-b849-c9e4e20a4f56", "comment": "Malware payload (Grandoreiro)", "value": "bd6c90ab8f90ab7de7fb083c24dea68118161d81b45eb8d236e385431987f01cf8cab803f98e6489465117965d41a151", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342137, "uuid": "097e3a66-0464-45d9-9628-afd458c730b5", "value": "T1BB362336BE006D72C1504371762E3A357E3DA703478AA5C37C9DE24B6747ED2A63E889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342137, "uuid": "20b2937f-d978-4587-83cf-0be22a673121", "value": "49152:wuuVXAG+dh08YayATgxRulQ22KbMqWHKqRC250uEDX+qcR2zEi+yX4ge/H4:OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342137, "uuid": "b8df7fe5-b7b1-4a9b-9e9a-6405b690a52c", "value": 5300224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342137, "uuid": "c42da848-546b-4324-91cf-00563b332d8e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342137, "uuid": "7b7f46b8-66d3-4298-bf43-35c047a59fb8", "value": "413144So_EscrBBVXBEFT-2483756B9IT.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8237d18e-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311270, "uuid": "b5d48fc9-73ae-497e-ae54-5c77247d4123", "comment": "Malware payload", "value": "c85fec39496b41e5f61aa724dfdc12d5", "object_relation": "md5", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311270, "uuid": "575031a4-a9f3-47d6-b927-1082099df913", "comment": "Malware payload", "value": "5b005fbeb63d8bc0fd3090898aafc87d33f4b4032f9a9379e2b519307616e8c5", "object_relation": "sha256", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311270, "uuid": "11e65d00-d977-4ae7-8d39-1020b62d00b9", "comment": "Malware payload", "value": "b85a24f7298fd7d0df336f92d2404798b1c3c970", "object_relation": "sha1", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311270, "uuid": "175b382f-f526-4c83-a2b1-cec7241d16fe", "comment": "Malware payload", "value": "fcd2a04c6ad92174c6f5bddf9cd5046593abae6be32484606f98b85bbf320ed3566c2347c81ee8abf8a5f21516b353be", "object_relation": "sha3-384", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311270, "uuid": "1890b6fc-8852-4cef-b290-690d5407f60e", "value": "T1BC150ABDAC60E336F60C90BEE286D3539E217C410236AA9319BE93241245973DB577FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311270, "uuid": "347fc70d-07e5-4e48-a88b-8122f5827185", "value": "25937b9c00b38fc241bab3275f8d6d7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311270, "uuid": "ad5cd342-7ab3-4c4e-9a39-958336c0e1d9", "value": "12288:QdwejsJEr1pyO4bjyWgev0Pbj4lpwXvjeuyHT0QQz8n5s:YwgsJEr1pyRjynI0juGLeuyHTx4w5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311270, "uuid": "7dc804fc-8e86-4db4-a44f-666f28e71b69", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311270, "uuid": "16b71a3c-43f2-4d61-b445-04085640a7de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311270, "uuid": "8079f030-8597-4ae2-8288-fb98a3b75ebf", "value": "5b005fbeb63d8bc0fd3090898aafc87d33f4b4032f9a9379e2b519307616e8c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a7813f-0bff-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771332650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332650, "uuid": "afe4545f-969a-4a24-9f7d-5c32df95ee16", "comment": "Malware payload (Grandoreiro)", "value": "f72e95416e22b8dca190c2cd28ae763e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332650, "uuid": "ba646d24-0f42-4446-83e3-5e331c24eb6a", "comment": "Malware payload (Grandoreiro)", "value": "5b1d642d721e4b1d448db9491a4ef3ff5337eab2017e388df4364f116f2d8de9", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332650, "uuid": "e8f21bc0-b22f-42de-b78c-baad4aa0812b", "comment": "Malware payload (Grandoreiro)", "value": "b2adcec452c122c42695f655a2eb49963b563102", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332650, "uuid": "64f805df-ce79-467a-80e8-9e8206723053", "comment": "Malware payload (Grandoreiro)", "value": "5649a93ed4484baec263df326818ebd32233bcf152a196b3668a6b88052a9ef2e4449762e5b36190dfb95b1466ddb984", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332650, "uuid": "f886a2f5-1d55-4c4b-8f94-43b2dbb1d76b", "value": "T199A633317E81AC36C5948776316F2B352E3C2727478CD9E7B55CA286274BFD16A3E880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332650, "uuid": "51dac73c-be46-4ec5-a883-2bffea353ecc", "value": "49152:X0EnOgPh0WX47IZvAgm8SszlA8dBPB5N6IEDs5dL0mZn/ZFyldrSEGBu8RpNhhVR:A02L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771332650, "uuid": "7731151a-22c4-4711-91a6-83b49c8feacd", "value": 9504768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771332650, "uuid": "30eb44be-c013-4c86-bd00-9de6687b4dc4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332650, "uuid": "8f1de1d4-1288-4138-9a75-05afb728c9a7", "value": "NmclA82H32053_JIFQU.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c918b5-0c0a-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771337393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337393, "uuid": "6d6992a7-351d-4d5d-8dbf-d1878b2f9c50", "comment": "Malware payload", "value": "bb7774148564840e4227e642abb44f75", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337393, "uuid": "1974c9be-cda6-45b6-9ff9-068b3baec212", "comment": "Malware payload", "value": "5b79ad41c1b291d442227c4b658174f35296d0789a661a4bc334f31e6db8d2fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337393, "uuid": "acc0f15f-0920-40a1-8391-6bca0c925cab", "comment": "Malware payload", "value": "d9f44f193a8945737837a91d5ef1ec23d4c08d3e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337393, "uuid": "54b5c41a-49be-487b-a5a8-516e5578ee8e", "comment": "Malware payload", "value": "2b34b3d16ab9b418224e2497245ddbbf1432c8f9139df82e99c8133bd5f34d21d22215452fff386de60e9da5c28b73c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337393, "uuid": "b5e12250-fa91-41e0-a826-76f9601b5782", "value": "T1EDF01DAC3FF26E7785705D69B02606A6E21BB08C4CA78A98A42E542E8677B40F310905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337393, "uuid": "e08001d2-7fc4-41a6-a487-eed0fb2969a7", "value": "12:bi8T75T7eb7IQIodKPoBwhF7mCBmna0LK27:b3T9TKb7PfdKPoBwhRmKmBK27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771337393, "uuid": "13045686-4061-4660-8751-5fe488354e1a", "value": 544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771337393, "uuid": "98d5d643-2606-4fc9-8a91-db8e0ac96cd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337393, "uuid": "6262b7f4-08c8-4221-b943-d1d7d1e95bb1", "value": "ftpget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62dfe3b-0bd4-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771314337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771314337, "uuid": "54a49aa3-821c-471f-949c-014ac78964be", "comment": "Malware payload (Mirai)", "value": "239f43a841cefe60abf87585bcbd3081", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771314337, "uuid": "d8222974-d8c3-483d-b43e-b088a7bd328a", "comment": "Malware payload (Mirai)", "value": "5bb7ac86b01c0f2dd4aa56b7c0a1a66d65cd0745d9760c533edb7024f45eacc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771314337, "uuid": "43e364d5-d135-48ed-afc0-8f7ec9b31fc9", "comment": "Malware payload (Mirai)", "value": "82d281c3eb5296754b54ae4274f83e28744f1b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771314337, "uuid": "25a3d4d6-9b96-4c94-808e-40fee33a81cb", "comment": "Malware payload (Mirai)", "value": "2a1d1e800730e32e3de61dcc09e04a83f1e28028ec8f973b0e0c2f97bbe426c93744e8abba6a1bbe34fe95f252679f83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771314337, "uuid": "1ddc6d6d-4726-43f9-8b66-d50435229c7f", "value": "T12AF31946EB414B13C0D623B9F6DF42553323ABA4A7EB730695246FB43E8279F0F12A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771314337, "uuid": "d43ca498-f352-4426-b61c-e4604343442e", "value": "3072:7IeEn1EQ9nhgDxDCS0aeAdSc87RlgWfLoU3rJnowM/R8:0eEnWQfgDlf0aeAdSc8FhLoU31owM/R8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771314337, "uuid": "22c9ccf0-5062-44b0-aec4-6a1f0b2fb3c2", "value": 160752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771314337, "uuid": "a235e5a5-50b2-48f0-8cf2-33646acdfea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771314337, "uuid": "31a55cfe-1bd8-4745-b1b4-c43ac570db6a", "value": "odin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fc1294-0bf8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771329795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329795, "uuid": "2d120b98-e707-4cbd-8d96-196c7e133663", "comment": "Malware payload", "value": "53df7f44a150f2618a42c10f3bf859f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329795, "uuid": "3d46f588-dac5-4c9f-aced-1e02288b6e72", "comment": "Malware payload", "value": "5c585314d204cb363fff857ebc6215d29fb74c21d4f085b42e0bf824253a3302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329795, "uuid": "64e4db77-a023-4fd8-9c71-968bb282b2ec", "comment": "Malware payload", "value": "7f1c5b5c2efc2961889b2697838eb0138388cd1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329795, "uuid": "53947e2c-32e5-4c41-a2a3-4be7b1d3aa1a", "comment": "Malware payload", "value": "d3b876d16e072554a81632f7a4aa3834f51c59d4e5c56b5cf8cb96851abc622070c392116d4300cd7e9239c51cae0a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329795, "uuid": "cbd53fa9-846b-422c-ad1c-01a16f02b435", "value": "T19B459E63FB83E0B2E9C901F151AB6FF69C783725872684D7E2C01E6599601D3363EE19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329795, "uuid": "df0c9f35-9d5c-4100-ae1c-02d388e114b9", "value": "87a10eb10e62f1072fb63bab09d26207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329795, "uuid": "50d0bd47-6ebb-47cd-92bd-cf78902c0f03", "value": "24576:zmVpZP40jps2JCeczolvUI6/zUr0kPFlqY9r+po2bn5mv1vHtTReoCM:zmSM8Glvm/Y48Y4ayRHhJCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329795, "uuid": "6fac15b9-8bd9-4df6-9602-6b955a3b549c", "value": 1230336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329795, "uuid": "71e185f9-016f-4cf1-a486-369fedef4b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329795, "uuid": "7905d0fe-4ad5-4bd3-a90a-8a114581ef6c", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ba2e2c-0c0f-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771339732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339732, "uuid": "3243a691-fcb6-4fa7-b8d8-2a2199fd3ce6", "comment": "Malware payload", "value": "5cfc0994c1c44e00d53eaf8e42ca5e18", "object_relation": "md5", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339732, "uuid": "854c8afa-a625-4ecc-bda4-d6974d7478f4", "comment": "Malware payload", "value": "5c9dd3b898e57b0266a54b4b865f4b90acc3193709a6dc79ef55c796320fb4d8", "object_relation": "sha256", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339732, "uuid": "9c3d4130-02dc-45cb-8b89-1a070f17c695", "comment": "Malware payload", "value": "f3b7fd5d2054324dccaeec8b68a727a82866fe96", "object_relation": "sha1", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339732, "uuid": "ef19a87c-2ef2-40e6-ae0e-b790355ad46d", "comment": "Malware payload", "value": "9fa467a94d8e300ba525442c4f7306e0614ca4dc67e6ae2c48a093a4608761c0728709c67f29f1eee16eaf29cf50b182", "object_relation": "sha3-384", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339732, "uuid": "e374e6ce-2e6c-4339-bc2a-3d135e5bc35a", "value": "T19615F023F17C05BAFEAFC871A091C911789CA1E0F84E64FF05B94DA618E3CDA4B51799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339732, "uuid": "975d9873-0417-4064-9a78-91e11abaa71a", "value": "24576:Da1F0iLeeF4owYFSfr67yRT3R620Z9qdJjdpWrdEuWUOgCAbUzP:DaX0iLVuDYFkO7yRTB3M9yJRs9WUCAb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771339732, "uuid": "e99a5cd3-1b0c-4e40-ba02-79624225fc21", "value": 951361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771339732, "uuid": "6221ad9e-ed3d-4242-b959-17843cc14425", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339732, "uuid": "6dae9c0f-a5c7-4f7a-9b5c-07f9319786d2", "value": "Zinc-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cf90f2-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286791, "uuid": "79052604-9f4d-4fc2-ae87-69904f0bb250", "comment": "Malware payload (Mirai)", "value": "c0cfe05be9bb191596a6d1b6744b4a55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286791, "uuid": "71286464-7637-4e81-9deb-1821626bd8cf", "comment": "Malware payload (Mirai)", "value": "5ce46bb5bb8d83d082b192184df8e352728713b91752e1fe9c5ed3bbdcfb78d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286791, "uuid": "90153a93-8390-4dda-aed3-64362264cccc", "comment": "Malware payload (Mirai)", "value": "79fc7edccd9ac9b8edd074428dc1e7630feee174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286791, "uuid": "42e060dd-72d5-4688-9a59-330a6f74d235", "comment": "Malware payload (Mirai)", "value": "3a8f7a9a4f6cfb5d5ccb9774b6b3078e9ca515d5f3da47788d58dd813acb64675d05125ed772197a6ed6d4f989e4907f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286791, "uuid": "36b95c46-58a1-4208-805c-619f34b560df", "value": "T1F683D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286791, "uuid": "55f2df00-1f85-4631-8e99-91cd365f3496", "value": "1536:iVLyu95Keikj752dCexuV/8UZlDwfkJ4MYfWI:iVLyMgOFezxu5VD1eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286791, "uuid": "c950efff-a981-45c3-bda7-806048e3d183", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286791, "uuid": "96ea3fce-f11d-4589-87fe-4e964bbe6928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286791, "uuid": "7e606234-3906-429f-bc8a-ca62fc2096c9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94bc6f6-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771312732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312732, "uuid": "20ebdc51-be20-4708-b070-5a310bc8453b", "comment": "Malware payload (Formbook)", "value": "6c88220a91e21ecfc28ed380c23c417a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312732, "uuid": "b014865b-6e15-4543-9fae-782c91136719", "comment": "Malware payload (Formbook)", "value": "5d30975bc9218edf3018763fb4b2740aef39db30cc7e7b5c0ee9892e118f0d75", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312732, "uuid": "def37b08-aa97-4343-879e-78ca096c99ee", "comment": "Malware payload (Formbook)", "value": "c8fd01e41bbe2cebdf612bb765ae22a102b54e83", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312732, "uuid": "d5920ce4-2c78-40c1-8be6-3d9cc0bf7d9b", "comment": "Malware payload (Formbook)", "value": "d5f7946b5f3689415a6ed75ba55226840e88a0948df0a84ae8eb2151815e011a2e1538d00435327a468d4453f20e7046", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312732, "uuid": "3b97574b-5d0d-4c1f-8cdc-cb7bd1edf2d1", "value": "T15333A5CA37D1B0FC0A6638B7391F61B6B2AE9E40608CD016DA578D787C6372DDC76924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312732, "uuid": "7b0492c5-96df-425d-abc0-ae30725b805f", "value": "1536:3y8pilyiqcqo4yxTusrToX9DdXftpZnKc5Hoh0abIMW7:CTyaqotcsQ52jTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312732, "uuid": "1bdadebe-227a-41ba-b298-1d8d65ccb4db", "value": 51392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312732, "uuid": "52cd5498-4362-4303-918c-1c10b3c03c67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312732, "uuid": "d4a514a7-8658-4e60-84ae-18b5422a148a", "value": "6c88220a91e21ecfc28ed380c23c417a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89aa82e7-0b9a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289378, "uuid": "ada7c49d-b05d-4da1-9e0a-076544042e43", "comment": "Malware payload (Mirai)", "value": "815c56ebf8ebc4b5b6571783128356f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289378, "uuid": "8f1879fb-5977-4a26-a8f0-b4fc1d3cd4c3", "comment": "Malware payload (Mirai)", "value": "5d7dcaf23c98e7484895af9a1cd14af57b0159dfd02c11ffa79f2d34f7fc112c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289378, "uuid": "6c6266a4-af66-4597-8342-67b434c37302", "comment": "Malware payload (Mirai)", "value": "2da2259b483d5baad7b764f2fc2b104c98437b04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289378, "uuid": "70a992c9-f468-409c-a4d4-02ba604f8c59", "comment": "Malware payload (Mirai)", "value": "a932859fdb21fb0a6bd4f2bb5fc8b2c87074e3c5a11b01320d1e0bc3f85da11ae0db0d7e6d6e6890eb12210c87add521", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289378, "uuid": "3b8bf047-1680-4ff4-aa04-9a579550ede8", "value": "T167B31763DE5AAF1AD617A1F0B2F28E741B53BD6548470EB9A472EAE04143CCCF5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289378, "uuid": "3ee50c02-cfdb-49b9-a37f-fac296694fe3", "value": "1536:NTqZ5Rb76lsC9eK3q0U7/mGJrTlJMzW5sMDzpGeTAEXGy:9qVX6lsoR3YFJrhezW5lDzplJXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289378, "uuid": "de53e4d4-14e2-4f49-866c-6d2042d8ebcd", "value": 110108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289378, "uuid": "87518870-3b0c-411a-a9b5-af7152c932a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289378, "uuid": "451f0608-2c3a-4300-85d1-91ac61da8f1a", "value": "israel.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6441fd-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312903, "uuid": "228f5533-8d98-4260-989a-ba114ed7beb8", "comment": "Malware payload", "value": "8303499a50f40f602534e4ccb627b5e4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312903, "uuid": "f1844aa4-3c70-4419-a421-c50fa7e7b786", "comment": "Malware payload", "value": "5ea3646a6767b40dbe9caa0c8bedbc214370be02555b5f18ae2ae0bd530a098e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312903, "uuid": "f30fc8b3-25e6-43fe-9a00-4bb7ae1ec12f", "comment": "Malware payload", "value": "47171cefd260c9a80ce6913ef3e646847c103e81", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312903, "uuid": "4d68de87-5f1a-4d0e-bf93-622d08778b1d", "comment": "Malware payload", "value": "19a8db58a5c853bd5391931a7eccbf05aea2f1930c38fd5082fedc412edc4ebe958be8abed7c80f38488c97506db4feb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312903, "uuid": "3be8355e-cb07-418c-a691-80da3568dbfe", "value": "T1A452B72A8A09DFF0097E3261A99B6C1975610322B635380C7D5FC4EC7B36B10CFD59E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312903, "uuid": "869a05b8-40f3-4d8d-9d53-c32acca3aa93", "value": "192:KkUFQQFVGq0qMovJ/2CDVn5Hi4CFQufsKxA8VofYSd1CBlMqLk/m8yhj:K57Fcq0povB2Ch5iFnsKW8VofYSvCrIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312903, "uuid": "bef95ca9-37f2-4ac1-aefe-8766a68e745e", "value": 14099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312903, "uuid": "952ff2af-f063-4e6e-ad86-52cfcb5e4e56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312903, "uuid": "da782433-27ff-488f-a88d-af9525f7cf7e", "value": "8303499a50f40f602534e4ccb627b5e4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60eea09b-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771290598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290598, "uuid": "f2fc923c-a1e2-4a75-809d-3d8aa5fd66c8", "comment": "Malware payload (SalatStealer)", "value": "9788035f511ba3c1d1dbc187e1f20dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290598, "uuid": "90e1f68c-3dbe-4a74-9d12-55f9d875ae26", "comment": "Malware payload (SalatStealer)", "value": "5f60705a085e000a0e89654413990f78443e2c088418f70b4f82bf89ec36017c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290598, "uuid": "bc5b8abc-8062-409a-85f5-bba023690957", "comment": "Malware payload (SalatStealer)", "value": "dc8fce3cb5247744f68908a11b04813c55c42589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290598, "uuid": "7dc38e9b-efbd-4bd8-a758-59e08b8d6fe5", "comment": "Malware payload (SalatStealer)", "value": "70da6727d2527877b2e3a9e1c2b0ad903f169ae57a4754552c6e9b3cae1d88a0eeaa3858cab3a3052b6ebb3d5fd59131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290598, "uuid": "76f9cb3b-f792-47b5-a01b-f72acc0fc91c", "value": "T1CBC65B41FA8B94F6E9031835406BB23F63315D049B28DBDBFB543F6AF87B6911D26209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290598, "uuid": "f03fdaa8-1cbb-43d4-be6b-3947c7b20c75", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290598, "uuid": "f447bee4-523c-4843-a035-58907aef25ad", "value": "49152:InQMOV4bcCXm3O+5xiU0yWFF8UY26n9L5AuPAQ87KNdaGVjPZNlv1V1HJEB0BYrj:OXOV4O3Xp6Q8KaGVrHB73T/SmGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290598, "uuid": "e79f36b1-ad7f-452e-9367-7480dd4f648c", "value": 11673088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290598, "uuid": "a2c4db88-9cc6-439c-a865-9033111b5ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290598, "uuid": "7c7a1867-4d0b-4b67-896a-ccb35705daa9", "value": "x5f60705a085e000a0e89654413990f78443e2c088418f70b4f82bf89ec36017c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73ec612-0c02-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771334176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334176, "uuid": "8aa2fb22-68d8-4c72-91ea-ffb50f038878", "comment": "Malware payload", "value": "b4092b6a6c17140e1699f4f31c8d4dba", "object_relation": "md5", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334176, "uuid": "41bef947-e3e3-453b-a72e-407738f834eb", "comment": "Malware payload", "value": "5f61ca45185c89bcc05f69018ff5e4275580ae32627fd63d460c697040bf2eee", "object_relation": "sha256", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334176, "uuid": "0cfb2a13-02aa-4628-8473-c786868de272", "comment": "Malware payload", "value": "f82a0c1ac17ce6071a8a9a24a880d4ee160de764", "object_relation": "sha1", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771334176, "uuid": "c5a6e94f-ec5e-4785-bf65-4cdf020b6535", "comment": "Malware payload", "value": "1481cfdeb39b69ab4a8ca0e5754cdf1f419f2c8979e978f3c1e700862d510b92f221bd7e561c58f387e23373cbe15f92", "object_relation": "sha3-384", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334176, "uuid": "d95e5ac8-6a3f-47cc-a017-e9cdf8a5eb40", "value": "T1B2E4B787F1208AC7F84FDA7F14504210AEF0F4704607F2561B6E885A6FEB9C89E657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334176, "uuid": "29dec129-106d-4bcf-a7ae-56745c5807ca", "value": "6144:O1eMX5Uh/W94gpr2TMPjhMowU5/3U1dekIK6DY3BK94wUJ6i2//1xp3x1ZJa:ONPrKbQl1/1Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771334176, "uuid": "852e69cc-636c-4283-91ac-b5ba5ce9d0cc", "value": 702325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771334176, "uuid": "a0ab862c-3155-4ede-8ac7-606a89fcdc98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771334176, "uuid": "852cd15c-ed06-4b56-9bdd-90b7326f50c8", "value": "dupeitsdev-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b4334f-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352640, "uuid": "c4f1f631-05d1-4b97-901a-e3a9676db9b7", "comment": "Malware payload", "value": "4652224a55a68c3a37ef8e06107bd9fe", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352640, "uuid": "795a15da-1983-48e7-ba04-22e91b4e2c2a", "comment": "Malware payload", "value": "5f63fe69620faa7b5624774920492a16d45aeb4ce64a601b66ab44fb3a29422f", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352640, "uuid": "de3eb14e-a50f-4506-bb8e-5470f6db5f61", "comment": "Malware payload", "value": "b502f8bf830a834adde5432c7037815e19472f03", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352640, "uuid": "0938dfd9-b7ec-4f95-be79-5b8de092941e", "comment": "Malware payload", "value": "9fc1cf4c865d025f1362c2015ba536ac9c0a1f7c4a89486610bd1d088985ddc20af05ce2572a92dfd88f26a7c39d1d6e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352640, "uuid": "e5e18e57-8417-4420-b70f-cbd3ba95efb9", "value": "T182763335FA446868C8014372B63E37362E7EB3034B8C55D3A89DD267A706ECB563E8D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352640, "uuid": "b2f7cd99-1baf-44df-8810-ab714a14802d", "value": "49152:LPSFOBtHzDMbYEAzP4CxLiAlVEwLcLFA2H7gNPO+e6CzxPnkBhmE5pMtjZpfWhkn:Juim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352640, "uuid": "4c42319f-20a4-4f35-a13c-23bf310edc09", "value": 7206912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352640, "uuid": "0527dd31-2fd0-433c-a92e-95fa781ae344", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352640, "uuid": "01ca63d7-4d87-4cc7-a596-7dac659bcd48", "value": "TrmR6727H-3961XYBGLAU588_Expe.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c979b726-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311390, "uuid": "25eff63a-6cc4-469e-b133-8e216e0f8b53", "comment": "Malware payload", "value": "0fc283babecbf9694ad95d10e6e2f288", "object_relation": "md5", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311390, "uuid": "bf0b46ab-e521-403e-9724-5af18e8b76b0", "comment": "Malware payload", "value": "5fec84812a874e0822349c13c8244ddb5e86702bef3e58edfaca3603b3d7ba9b", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311390, "uuid": "03603d7c-4a1e-409d-a56c-9314211c8457", "comment": "Malware payload", "value": "f6a7363832ba1142fffc823a02f9291c10389796", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311390, "uuid": "cb21c8e2-ef0f-47f0-99eb-7123fc790888", "comment": "Malware payload", "value": "8ec90ce867f93c134b5eec37769411dbedd426c435d021800a308da497f09f84c4bfba9e2c24f9da4561268e04b4b360", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311390, "uuid": "54ae9ca2-8f05-4496-8fa3-78122a8f0db3", "value": "T19C231A0F6203B4DCC20FC2768AFA927674727902A7A1175932A5D7610F70EB927B9B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311390, "uuid": "e7f46207-788c-48e2-8782-fe4a65134267", "value": "cf818b472b8ec85cc12444c315a83727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311390, "uuid": "1c8eb008-c51e-4dcb-8442-11b29b5f8571", "value": "384:JAh15Afgg0b00w7TDgI9FheQA7EQ3a0o+Z3k0m/Q:iVQgBc3Dz9FPApa2009", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311390, "uuid": "131045b0-0a3b-449f-987c-98204da8926f", "value": 49292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311390, "uuid": "b9e6c569-353e-46bd-acbe-ccbf839a5738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311390, "uuid": "e9c2ca05-b6c0-4e38-9c23-4c3fd0ba80a9", "value": "5fec84812a874e0822349c13c8244ddb5e86702bef3e58edfaca3603b3d7ba9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944486c0-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342224, "uuid": "52b5f4bf-a54a-4892-9eeb-955ba62caaff", "comment": "Malware payload (Grandoreiro)", "value": "77c23cec3e58f1ced1d396f88c82f281", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342224, "uuid": "303792b6-0373-4d82-b70a-b2c66d080534", "comment": "Malware payload (Grandoreiro)", "value": "6063d00798a284e4975cbbe39315ae394fd6f8bede69a40ff8aae76726874e52", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342224, "uuid": "7c6883fc-45d5-46eb-b9f2-0754943ff397", "comment": "Malware payload (Grandoreiro)", "value": "dd8c7389c95631b512f8fe4cd7e96fab258b61e0", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342224, "uuid": "4d2bf6a4-9b1c-4105-8355-f051db66a902", "comment": "Malware payload (Grandoreiro)", "value": "aaf0a027a814bcbe13ed60b74217eca9b6544cb6da62b2d7e6bcd4b6b97595319972ccba1ee6502b47e9626e7d88c65b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342224, "uuid": "619c5159-8edc-441a-a43a-b7fcdbbc6b71", "value": "T1EE563336AB165D29C66043B6743F2B342F3E774742C8AAE7786DC203374BE92475E891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342224, "uuid": "0cebc904-1668-4129-802e-7ab825833b46", "value": "49152:usnoISVR8m+N8sAzX8XSj/xqnIrZWNd2zcW17ObQxntd6nhtg1KWZD4enr6gXhIm:nUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342224, "uuid": "3f8a4e5f-3436-4d8a-9122-349ed99ecab2", "value": 6197248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342224, "uuid": "bb12ccac-17c0-4510-b869-54a938ca8b80", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342224, "uuid": "2c9b0d52-3816-4d05-b0b9-6887c1de5cb8", "value": "71UY_402113CMRA-Reg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71901e0d-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342166, "uuid": "74f82839-6a4f-4a0c-9cef-61f9d6800d6f", "comment": "Malware payload (Grandoreiro)", "value": "9d0d9277ccc74977bda27a5402fdef94", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342166, "uuid": "f659389b-5617-4f1f-a90b-97c0de711187", "comment": "Malware payload (Grandoreiro)", "value": "616052efcc34a8ce6bf5919857330f23d3a3063bad4c27b971ca56d9d7b2ea74", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342166, "uuid": "196da32e-60e0-4ce7-8054-08b4b712af6f", "comment": "Malware payload (Grandoreiro)", "value": "b7dcb683870416507f06a4a5807bea8eff46e699", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342166, "uuid": "36441056-c866-4b4a-ade0-83a6c906a22a", "comment": "Malware payload (Grandoreiro)", "value": "567e06b4e415166ffddd7e82280c3c0f59550a182a3f7563d6e6db4ad5382798bfaa008939973fd06e2279199ed33a5b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342166, "uuid": "b5b993f4-ef32-4555-a8dd-d80733911a3b", "value": "T168262333FB40587BC5400372752B69352F3EB213674C5AE7789DC60BBB5ADC2993A48A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342166, "uuid": "8edbeaa0-cdb3-4725-b996-f05dd52e89f4", "value": "49152:X3xnZC0gwKWuF2uP0gBydJ2LBiuzNnFF3Hkdb6oE2ouim3YIEt:Suim3YTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342166, "uuid": "cf4a77d6-3756-45bf-9cba-946a5010a6a5", "value": 4444160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342166, "uuid": "9d544e72-3598-4c22-8a2b-c1bb3bd9ee85", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342166, "uuid": "727aaaf1-dcb1-497a-a209-0cd374d3beaa", "value": "4H635338_RmbTTVZTG-828199gxbrj.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0c7c15-0c57-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771370559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771370559, "uuid": "b7ce7197-995f-476f-abdd-c9508c0f7696", "comment": "Malware payload (Mirai)", "value": "7f0009cb8688558bf6c93f414babf13d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771370559, "uuid": "b579bf1f-ef6b-4263-9dd9-8f39a910e385", "comment": "Malware payload (Mirai)", "value": "617db5bb5702af00e1f092a74abb5dfe5d726d351c115255ace7dd455d801beb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771370559, "uuid": "99027685-e922-4655-b1a5-f41dcf94c5e3", "comment": "Malware payload (Mirai)", "value": "9000fcfea953d5a051da4a51bc13e68bf62afc81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771370559, "uuid": "bceae2af-3a73-493b-a0a4-d0827d561380", "comment": "Malware payload (Mirai)", "value": "43acb8c019b4a4e633429821e3c9721694e9328f5c20a3fccd6dcb97e4418e7ca0646d855cfbe5afce5e2ea4a569fef6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771370559, "uuid": "30e79806-ff47-419e-aa2f-a84ad59d8def", "value": "T17AC31856B9519B11D4C721FAFA9F414933136FBCE3FA3102DD20AF64278A99B0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771370559, "uuid": "89538023-0de1-408d-aa3a-21a17ee9a411", "value": "3072:Ta74VtinFIDK7zXOUbaKDB7gMVpX8vweXLV5DE1A1+:uKUnCK7zNbaKDB7gMVpsvwMh5+A1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771370559, "uuid": "9ff018d5-7285-4bd3-9d1d-6e7c0abe58c2", "value": 129684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771370559, "uuid": "9c57d8bb-9daa-47d6-ba79-3e27aaec53bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771370559, "uuid": "424e06b1-8280-4066-9157-071438b48317", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16a2bfe-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313175, "uuid": "5729f207-8e59-4568-893e-5d8deea19f6a", "comment": "Malware payload (ChromElevator)", "value": "5d5bcdaf2335707261a24bca652eb3b5", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313175, "uuid": "f94c0485-b0bf-4518-9ebe-3709d6a5a23b", "comment": "Malware payload (ChromElevator)", "value": "63bae4929da48baa903251966e3e6bc3b46c4c9fd70b4e8b171bde3218484362", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313175, "uuid": "b748dcba-5124-42db-81b4-72b88b44b0c2", "comment": "Malware payload (ChromElevator)", "value": "f8fcc983723d668346f8b52a395fa4fe8e366368", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313175, "uuid": "c244ba73-f1b0-4f3c-9a0c-e479e26bc367", "comment": "Malware payload (ChromElevator)", "value": "9d2367ab044b3868b7b3485a2acaab1dc25964fdfe436671d5df3d1f187ccc42803727f2f3abe3ac6268c4e90d706042", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313175, "uuid": "0d828d8f-4867-4c4c-bb42-f38b985bdbb6", "value": "T12C96E75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313175, "uuid": "69ed6f4f-6339-48ce-90f2-49cc01b8c61a", "value": "49152:nRFbYRZ/nTW6RvzequPKWZdkiChqw25bg8R5mSALFjgv6xJ3e4k3CZHPXLRvzxGe:rq1NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313175, "uuid": "32450aca-fa98-487b-9e78-6a6e3d821db1", "value": 8735131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313175, "uuid": "852355b1-5488-4a12-8eb1-4a380246eafc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313175, "uuid": "3b60f993-9fca-4435-9b43-c1a6ea392b12", "value": "nouveau_curriculum_vitae (15).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bc4185-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343050, "uuid": "698f534c-eb65-4296-848e-d709d2e9e2b5", "comment": "Malware payload (Grandoreiro)", "value": "6c03b2e2ab9f492d588f06078c18ca7e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343050, "uuid": "62e44267-5fde-4e01-9fae-a08e7a783952", "comment": "Malware payload (Grandoreiro)", "value": "63bd37bfa964a20bb9f871f4e1ddb44d77378dbbae8a186307bbc78a409edd1e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343050, "uuid": "50282bde-c721-4a7d-b2d4-651e4f03169f", "comment": "Malware payload (Grandoreiro)", "value": "9b3fdc51d4e1877e9409f6e075d3a8a657d71014", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343050, "uuid": "66bec627-50e8-4674-90c8-35767eb99f11", "comment": "Malware payload (Grandoreiro)", "value": "3afae704e55c4916748b45948109fd310542ca7bb161dac48f1d8009a62ff34db10ad3d04a036b69ab34b9a9334cf6cb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343050, "uuid": "a3c6c0d8-0c54-408e-9889-65ad462bd1c8", "value": "T120663332EA596C6AC5604378B02F3B3A1E7C32174448B2D539DC65866B8FFE2C63F495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343050, "uuid": "c44a292b-4819-4f70-a609-357834c7e29d", "value": "49152:Var58PpFFYjoBtwwqpKbd5ARaB6eRAAw3E+EYlmp7SvF4OvZ93DA59qDS3aM8nmZ:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343050, "uuid": "325ffb89-a085-42cf-8503-8b6be6f54263", "value": 6918144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343050, "uuid": "b5a94f2d-853c-4a25-894b-ed2eca574c81", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343050, "uuid": "422a49af-1081-4ece-afe4-ef06cf53a2ac", "value": "96ZZUSntc-5745TMHFQOJ6P.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaa8654-0c4b-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771365535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771365535, "uuid": "9fb831e6-dae5-42cb-a836-4ac4941cfd8a", "comment": "Malware payload", "value": "c745b17204a49b09985a6efe8d7957cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771365535, "uuid": "fb510c5d-2980-4194-964f-73c77b1b272f", "comment": "Malware payload", "value": "63e0d5455b54ab44f0c589472c03e292f609a9fa9dad847cf167ed0e1520e948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771365535, "uuid": "627581cb-89ac-4258-a89a-91445328b079", "comment": "Malware payload", "value": "907405db002833f81b320ef09e27732b71c9aec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771365535, "uuid": "c75c7b9a-99f8-4ac4-bb36-ff7951e55938", "comment": "Malware payload", "value": "1c7cfd65c40cc34cc4b11ea840d0fb527e9e8758fd7a8a5b67c02079946e7a0a480845fc25db9595c9d24bb4c077ce7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771365535, "uuid": "404e9850-3f9d-420c-a4a5-ffc7d3911a1e", "value": "T13D67D816A77990D9D17FC07892939F22BE21749947397BF38980826A1F34EF8AD3C354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771365535, "uuid": "027b3418-eff3-4f04-bf4a-034284ef035b", "value": "65f7c929f08b69e7cb4d01248c01685f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771365535, "uuid": "3fbbc1c7-839c-4f65-aaba-775eda5808f0", "value": "196608:mJvJm3kWp0d8Cr1KQfy7vvDCeFAZCooHfU2T:m2TCZ+7GeyZCvHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771365535, "uuid": "9cc442bf-914f-4ee7-a6a0-7e4ee1d5fa95", "value": 31778816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771365535, "uuid": "61dc1986-a572-4259-9e50-adec74d70add", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771365535, "uuid": "2e16463f-c206-4d62-aeec-f132e48a06b0", "value": "microsoft-windows-system-host.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49a5943-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356505, "uuid": "f1edcc71-5a67-400f-909b-a8a762cacd82", "comment": "Malware payload (Mirai)", "value": "ca10ecfb99ec585f8c2255298365fb42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356505, "uuid": "bf36c61f-6a1d-45b5-90f8-981849a1024c", "comment": "Malware payload (Mirai)", "value": "63e215877f4fa6d5ae1ac3839bdf95060d86bb87dc95ad4fd4907df1bd8256e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356505, "uuid": "3d279d11-357f-45e3-a1d9-8ab25c179bc2", "comment": "Malware payload (Mirai)", "value": "f5fbccac058a1268abb20e113b3c3d3efef922ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356505, "uuid": "4f7a3402-732a-4620-b7bc-decb48e12200", "comment": "Malware payload (Mirai)", "value": "ac094c1ea4cae3eaf3190ae2a78edf5c392280f6d6e7ea73f525cfab74f736bd1b513df795880e04ef6677ba817e228e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356505, "uuid": "4819802e-ce2f-40a0-a5d5-e501a1ad6fcb", "value": "T124A32AD7F801CDBEF80AD6BB04570A05B631A3E246831F266367B963FC361D55862EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356505, "uuid": "cbe79eeb-7dac-4b1e-8137-7333119fde58", "value": "3072:AddnNE5OSXcEkoncSoy1o/VF4NZg9JtjV3Kyzj:4YOSXNOy1MVF4N29l3Kyzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356505, "uuid": "d57cb693-363b-4fe3-b738-7b44b3f74cf8", "value": 103452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356505, "uuid": "d6f242cb-e446-45ce-a6e0-f155f7570a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356505, "uuid": "4740d023-4bd3-4430-b680-669797430d85", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67e959c-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352616, "uuid": "f386c2c0-05ed-40e8-b71e-4e54ab280933", "comment": "Malware payload", "value": "6cb739a85ad491a75795998b25fd2801", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352616, "uuid": "9a1ee6bd-764e-40ad-8e22-50e07fce8d42", "comment": "Malware payload", "value": "644214f34274db1a6c655f309c0e6998071c4a70b8cbd4619bb7c31febbf7289", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352616, "uuid": "de52caaf-cc78-4eb1-8334-a804e8f262e1", "comment": "Malware payload", "value": "ad64832176daac5e2e20ef9120a7cc9015ede4e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352616, "uuid": "d21d34fb-40d1-4a3d-9691-324e9cce2979", "comment": "Malware payload", "value": "428e5bee9d346f855fb2da33973caff2a2cd09cb2770ac41007d22f95ccddc704eac53d9d6fc92aeef5ec857b79e6cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352616, "uuid": "16f539e7-11ff-4abb-a429-f4aca6f12e1e", "value": "T107059D2BB2B2B27DD017C03047DBC6725132F4756A322D7B26C4DA343E96DE9176AB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352616, "uuid": "b37f7523-c03a-4d18-b1f8-60f0b03459bb", "value": "12288:tHenNgrNhQKCAW1oHd9H42Fm8H6dlUGvayE8baHXMmhXcr53U:tmNgBhQKrWSbH6dlUAWXcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352616, "uuid": "0753a6c8-1c68-4d24-9a8d-3774216e95f3", "value": 795976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352616, "uuid": "c6b74057-8818-4707-8657-83e85673792a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352616, "uuid": "3caffc0b-d951-4941-b8e7-2c5515e7b52f", "value": "hydra.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90eab25-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352594, "uuid": "7998ecb2-7481-49d8-86c6-1193670628ea", "comment": "Malware payload", "value": "fb3acfcf9b4cea6eef0d13d8cf58274d", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352594, "uuid": "689a2150-fab3-4b25-8962-6496fccf0f2d", "comment": "Malware payload", "value": "650b14b23e70522bd0f2b270ed7a4b7065293143038564ffc8db00e404c71e09", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352594, "uuid": "1007227a-021b-4546-b621-4453d4c0281f", "comment": "Malware payload", "value": "000d3701fcaf1b5412b933d52274c25bbc4f4f92", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352594, "uuid": "61427652-c735-4d49-9c23-681b629e75f5", "comment": "Malware payload", "value": "7b2afd7a1af07786da9f19360a177e4f6e894742354b6c67a7e23925ffc835443bd2665bdcdefe528f6121202b1e0f40", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352594, "uuid": "b079880e-890b-4980-95a6-526911ed198e", "value": "T10C763333AE810DB6C1A04331715F6E0A6E7D7607894DE9DA75FC948B379EBC0443A4AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352594, "uuid": "fc6dd415-68cf-45fa-80e3-e9c2776e5b42", "value": "49152:oZPeaEk+h02WSpQUzbAqReiDkqT2k79qHzyDRnba8zbXpgUWDlHnAkkHznMcEllR:huim3YGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352594, "uuid": "8665f234-77bf-4237-8eb1-f30c1216fcff", "value": 7221248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352594, "uuid": "93bae523-c3e8-4621-b4b4-4c981644ffd6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352594, "uuid": "208d5598-e3a2-49f9-b5a8-12217a701576", "value": "Slct97754IUXU41LAUR_07817vikod.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c69cf7-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312380, "uuid": "6c28f3c6-abf7-456a-b386-ff1eb81c121b", "comment": "Malware payload", "value": "5bc78ae3bbdaed86439e0637052844ad", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312380, "uuid": "0669fa23-2a19-4a1e-8bca-4517b4d6446d", "comment": "Malware payload", "value": "651a3617df77b223d4468e0df514704ffca059d767a443ea785c3b419267ba3f", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312380, "uuid": "0d285938-c0f0-4758-bef1-5602f9d57f40", "comment": "Malware payload", "value": "3cf33c1ded050b2c2bfe93e01178430276442038", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312380, "uuid": "87d29c77-9af2-466b-abe9-e770e059944b", "comment": "Malware payload", "value": "597591336c366880a6054b39a2df1a18f2ea3597d69b8df262dc876dce3c0f812b7a86c68d6773befa43bb994acd64cc", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312380, "uuid": "99b1ec07-74ec-4370-9cf2-09d82f2ed23b", "value": "T159A19572F9BD007F1093817271BDA70939A5C143CB9A08907ABCC2755F8AF45AE131C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312380, "uuid": "56d8d845-b41a-4a5d-a0eb-5be9ecd55e4e", "value": "96:fjFj7jOjEHDK/D5DMFGzLeiO/t8GeF+YJqZNeBu/7RHlvaQxvbzM:fjFj7jOjEjK/VounOVOF+CqZyu/7tlCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312380, "uuid": "508f2171-48f8-4a89-9d34-ff874300343a", "value": 5020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312380, "uuid": "fc18d610-bd59-48a3-a067-46c512b89c22", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312380, "uuid": "959394dd-947c-4097-abbb-36fa603a1ad3", "value": "651a3617df77b223d4468e0df514704ffca059d767a443ea785c3b419267ba3f.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272820fe-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771312835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312835, "uuid": "09670018-437b-41a4-b6ff-fb50f2a70ac2", "comment": "Malware payload (AgentTesla)", "value": "f3ad53f101caf19eca7d63da3f20bef3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312835, "uuid": "fde2ac52-02a6-4a4c-9da8-257053d93a2c", "comment": "Malware payload (AgentTesla)", "value": "655d4ea2d6631804662d14cf4c31690593ff49d310d44e54e23985f606a7cc79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312835, "uuid": "2126fa8e-1b51-416d-9bd4-a60e3f59f15b", "comment": "Malware payload (AgentTesla)", "value": "70922f796bc6c2879774625d4ff7ffb483d126ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312835, "uuid": "86c923c4-aa2c-48e9-8aad-22c14a8f6101", "comment": "Malware payload (AgentTesla)", "value": "f44197f18365d999db060a1a76ca8f94b9a55e801d9eeefcb157d44e5c0112150294ee474281f13b01cc01cc2d51d524", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312835, "uuid": "2e494f17-52f8-4692-a992-3dd4a7e6164c", "value": "T1F193A574194C45EF2493EAB4B084A7E3FE6C0A5C9FFD6A4F525087DA1A3EA8734C3581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312835, "uuid": "c65fb7ae-3a3a-4ed8-b1ac-11b6062723e4", "value": "768:bZiUT4gN3XJqZ8PfFl8amT4r5OLxfrLM3ikbahov5R7PyTWc:FvT4A4Z8lX9r5YFcSkbau5Rbxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312835, "uuid": "7aadb440-df54-47c7-b6b6-8d0fc18c086e", "value": 91266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312835, "uuid": "611f7d10-bd6b-47f5-abfc-1d96ac8f7034", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312835, "uuid": "12b41a9c-649a-41d9-8e2f-1ec2f644dc8e", "value": "f3ad53f101caf19eca7d63da3f20bef3.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a7ab7b-0c0b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771337829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337829, "uuid": "08ec8e76-4a15-429b-a0e5-2635ecce8b5f", "comment": "Malware payload (Mirai)", "value": "7302c70f169485c09df1b869b6f24ec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337829, "uuid": "0ae35f3f-9b2f-42b0-b1ae-a444bcf9abdb", "comment": "Malware payload (Mirai)", "value": "65affcaf72d3b7ad7cebb0e15780851cf35e21fd7ec0c5aceda12532e70d06d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337829, "uuid": "4796f3f3-202e-4713-9fde-bfeda2d14d6e", "comment": "Malware payload (Mirai)", "value": "fd004bc00e7d4753424bea25b9d228f8fd426a21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337829, "uuid": "de446db3-6db9-4879-9c0c-c427c4d43fc8", "comment": "Malware payload (Mirai)", "value": "40a57aacd1c760e58635f837d638fffacf3f47cf1b4892732b733a8e2772b6e845ee75cb8a6f379cbf5cb897f9af28d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337829, "uuid": "cdc9493a-5a67-481a-a33a-4dd56a9820c0", "value": "T131C305639D26AF5AC126E0F4A2F24E791B53BD2648571EF9A576EAF44003CCDF1043B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337829, "uuid": "822bdcff-7a85-47b2-8809-014270f35f4e", "value": "1536:IIrVZJyxtLlCctK7g7v7SfQJgUKsVgtzZWM7lVWtVzD8tB:ISViLlF074bJgU7iZW8lV+B8tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771337829, "uuid": "8cd3eb80-5dac-4587-a259-ec17abd08169", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771337829, "uuid": "f824dc1e-2fd0-4787-986b-679d8ea4e830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337829, "uuid": "36988d6c-bfe5-41a8-b7a6-dcabd64d2b60", "value": "israel.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72cd7d7-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352644, "uuid": "f1503247-ac3e-41b7-b181-75defcffff2b", "comment": "Malware payload", "value": "452c4682abac07b228c037f9ee593e3b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352644, "uuid": "fb5a5204-9ba2-41d4-8f72-f5e54730c11e", "comment": "Malware payload", "value": "6635999913667cc6fbd2c3057efc42e3a2cebdbf97da56e47f95f49eaed50125", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352644, "uuid": "d50d556c-725c-4ad9-9593-da9fb0cf0df7", "comment": "Malware payload", "value": "6810cdffaf0bdfe09a6f8c1eb1eca619add923fc", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352644, "uuid": "fa4f80a6-0768-4428-96e2-81b0dd941fe1", "comment": "Malware payload", "value": "44259d15d96505ddb0d89aa2314345ea0d63e1159cb1269bb504cd34d74547d6c6248c52ac80a46c1752c07a388ab94b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352644, "uuid": "8cb2162c-b486-4ec5-bd14-dc907f693b16", "value": "T1876633309E990C6ACA50C734702F7A351E2C7763828C91D776EDD1C7278AFD19A2F4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352644, "uuid": "03faca2b-56c2-4d2c-a92b-c8eddd6956a0", "value": "49152:+52wcusGFzIdwAutW/2hnUg9O05Y4C3wSevEcFvwqLZbxHYstbdWjX0G++iG2FTw:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352644, "uuid": "6397682c-933e-4a11-95b0-f8fcc784b0e4", "value": 6946816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352644, "uuid": "515cdaad-cd6b-445d-bff6-7e3645d4da2a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352644, "uuid": "2e6e30a7-2d5c-4003-abd4-9444b2a543d2", "value": "TrmRC2K-5742BMXB4YI4_Expe.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd56771-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341782, "uuid": "26074e08-d97a-4bfc-b214-d4888110e877", "comment": "Malware payload (Grandoreiro)", "value": "3faf84ec97c6e6766fd0f831eba6e69e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341782, "uuid": "94f53d25-3df3-45e5-9c22-8b84d8f6ff0b", "comment": "Malware payload (Grandoreiro)", "value": "667752656926a03bb429589b6478f385d2e46e33524ee905ac469612d02f9edb", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341782, "uuid": "55721299-61e9-4d4c-9472-93ff43a2fb68", "comment": "Malware payload (Grandoreiro)", "value": "c43885e11397e6f6513964e18ef975e82f6988c2", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341782, "uuid": "4c14157b-e568-4ac5-9656-cae64ff296da", "comment": "Malware payload (Grandoreiro)", "value": "bf41d4f9de62edb4e48743c67e67cc05e40fe9af46cc8430b7ff3f3d965ad8811fb9895e6d08f9af76b1a07edd36bc93", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341782, "uuid": "f329c6d5-a168-4c75-be1b-91b6f6a9dee7", "value": "T1C11623329A840817C6A047F6B15F39227F2CB72784C895E6799C828F374BED5961F0ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341782, "uuid": "87aea895-9b88-4e3a-aefa-8072ed7ed598", "value": "49152:0kCsYIbKjSWpTsKcBWqoxiemVUFOe0jMHA35Jjg3xugRVA9k:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341782, "uuid": "a3dd8e36-c148-4b4b-af7b-bf057d8eced4", "value": 4280320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341782, "uuid": "706ce794-d608-499f-ae0a-844459208d4c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341782, "uuid": "2ed89644-f2cf-4855-a2b2-56f6d4da7907", "value": "KBXYX033451BY37_Vr-Ict94373oibrcr.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc4afe3-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300817, "uuid": "1ddea9e8-6d7d-4469-86e0-63d1953dafdd", "comment": "Malware payload (Mirai)", "value": "bdccbfe12053f82993fcee6dac8dc5a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300817, "uuid": "a9258b05-ea84-4e09-9569-4eee7ef091ab", "comment": "Malware payload (Mirai)", "value": "668f74313db46fa980d2080f80f59d10be8f65ed7fcaa80261bac572926a023f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300817, "uuid": "278aaf24-f0f2-4af6-be52-5caaecda5372", "comment": "Malware payload (Mirai)", "value": "0ffb467fe5d27eeaf86ca5666d67b09592a1caf4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300817, "uuid": "4cba34c6-8a4f-4241-b461-711efc788aed", "comment": "Malware payload (Mirai)", "value": "2add373b4795e91d00cba7c8d320613dd0fe816f2697529e3a388dcfe69a24783e9e11937f6684b12da96cbd5421f664", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300817, "uuid": "d854631c-7407-4ee4-939e-194334d3407e", "value": "T108C2D0AE0B0254E9C85B41B6BFB80FC03EBA0B634A06DD0B39ADDD16DD4656D64A37C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300817, "uuid": "1fb10542-dce3-47a1-8090-4d169b351ae2", "value": "768:YXgQBA1GCJIYIrC/+HzjRjpBgBJgGlzDpbuR1JGE:CdAoiT4yKjRjGVJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300817, "uuid": "e68255fd-7bff-4867-8a83-2ba5d436a442", "value": 26764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300817, "uuid": "cbae9902-91ed-4779-a1a1-426b50b955b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300817, "uuid": "1bcd2905-32d8-4ca8-9217-d1360ae19a8d", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52f9f3c-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343997, "uuid": "d770d77a-9d77-4c75-8d17-ac8347b2d65e", "comment": "Malware payload (Grandoreiro)", "value": "95a4dffb76e1b68ec1eb3aaca82b0a1c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343997, "uuid": "4e12e5bf-f7ec-4bce-a92d-a776e86c7bb5", "comment": "Malware payload (Grandoreiro)", "value": "6693b6c186c7f905eef5269944211adf2b655a06a31804e33bf8d40910a99982", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343997, "uuid": "2fb0b6a2-f9b9-488c-abbf-7042d40048cf", "comment": "Malware payload (Grandoreiro)", "value": "7bdc40b3153edbf5026202a4590d4c703ed0de4e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343997, "uuid": "9afd5be0-6660-4c70-bdca-5e729ffb13a3", "comment": "Malware payload (Grandoreiro)", "value": "7e3d06835f4b381b097868a9d3f2b871fb456a6d6847e8bf441d09f880cbe538b530b5b6827f92fe05bd68bf9840bea9", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343997, "uuid": "c4ae7eee-1bec-4a6c-91a1-847fe767ee3e", "value": "T1C1563333BB122C77C5508372744F6E296E3D25474A84E5E6B56CA887378BFC4C93B4A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343997, "uuid": "edc3e53f-a325-463a-9084-20f4a12b6b0d", "value": "49152:7ojuO/qgQuXEXxF2yk7lcZhRTSU8RrSbfYF7SzdfxC2V6NfaG/vx5ICAAkbuXlE4:vuim3YOMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343997, "uuid": "a67cc542-7658-4102-aba1-ec56387cb03a", "value": 6424576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343997, "uuid": "da9a026a-877a-4a10-b40f-c7f7d28fe94f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343997, "uuid": "112ee160-58e1-4fef-a90f-2ae00b4a9727", "value": "PlnlXLPEU_915108CU0IIOYFPE609350.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097b9221-0bf7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771329106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329106, "uuid": "92d9d0e3-95db-46c5-ae5e-21e4b0c8b724", "comment": "Malware payload", "value": "35ef24f094d362e272b14aae9984e07f", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329106, "uuid": "62c9a58f-753e-4d64-bf4c-5ed5d5c39b5f", "comment": "Malware payload", "value": "66c92aecca56115bdbbc2dc29bad267a607e23fec6f33a4593e4fb97257d734d", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329106, "uuid": "495388be-7359-4693-abd5-9a529eac05e8", "comment": "Malware payload", "value": "5cb4654d80759b21e518fe62d6fca3a50f915170", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329106, "uuid": "732cd9ad-d712-4ed1-a168-65ad2ea3bf84", "comment": "Malware payload", "value": "8faa289333e37260a1102fd77003218a4dab60fcf119b462d8f9a47eb21d9e13747e29ee6a3535354ded83772c1f667e", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329106, "uuid": "b0f640dd-2641-4582-a796-34ad5cefd8d5", "value": "T149D422B35BE43E6ED85D40F360633432B31A9D5B9AB970B1452386CC98C652C476A1FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329106, "uuid": "59405b3f-532d-4c37-bc4e-9ab402845b9c", "value": "12288:Fktl/NXlQBkUK1Dvgdy4veigq1ldvTzrBQpNlNBRDcoQc9z0NZkl/cx7FRQ7nCN6:gx6k71D43veigq1HkBJ0clE+1+C7CrWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329106, "uuid": "1fc27f66-f019-4235-8631-d6f3bd397da5", "value": 651208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329106, "uuid": "506b895a-0f4c-497f-8355-18a4267578a3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329106, "uuid": "c3b9e2c6-90df-4a0b-8ca2-1ae4a5a49156", "value": "RFQ_Product_Specifications.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cde9bb-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312719, "uuid": "bfd80bf3-aa33-4328-910c-e6b35495d8aa", "comment": "Malware payload", "value": "2457b5fe486e0c6a9c2dd3070c6e2191", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312719, "uuid": "cd033418-544c-4b9e-89a4-817b42a0c379", "comment": "Malware payload", "value": "66ea6ea35f1c4e022063e069e31ff4fbbc209181287cf97e28a89e44ec96eafa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312719, "uuid": "ba46d1e7-5ee4-4fb4-9f40-7d385757aeac", "comment": "Malware payload", "value": "ab520a798c639fb886dd736f52c6359cc0ab1d30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312719, "uuid": "b3ef511d-519b-4bf6-b1fc-f75146fba5c2", "comment": "Malware payload", "value": "198c5f2ee70ec6c4223f83f4d65ba38f82e38b5303dfba078f7113b6dee4d54546919c3797bdbcf1b641fbe2da0e7cf1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312719, "uuid": "be8d8699-48b0-4200-9780-99b737fc4444", "value": "T1ED03A58D32D7B075562F34272C57B0D6762ECF9CB00CA524E66A6EA0F8B431DC9BB464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312719, "uuid": "dfb8a476-e022-48a8-9967-406cd125e492", "value": "768:5/Hd4/Go1m1vWSxyYbWZ6HaZ1/Dh57E7zRdlrW0ea8DrXhtSk/yAVWoW9ySxkcH:ZBvWvhD7/Dh5I7zRXkDrXhtSkfVL8db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312719, "uuid": "61c78b5f-bef9-4460-9131-d0bbe01c3597", "value": 37776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312719, "uuid": "036b25fb-2976-4284-9e37-05d148f7189c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312719, "uuid": "abd0b3a8-64d6-486f-87bc-9872ecb5d96a", "value": "2457b5fe486e0c6a9c2dd3070c6e2191.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d49ccc-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342061, "uuid": "bb5ae250-ef98-40a6-af8e-1efc7eead8a7", "comment": "Malware payload (Grandoreiro)", "value": "086c0aeae9a1026ce6c97ae494ce56e5", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342061, "uuid": "950e3fc8-59b7-4a0e-a49c-c87cf7bfd96b", "comment": "Malware payload (Grandoreiro)", "value": "66f35d43305641de3515e723d865799b24d7dca85f788ad1077ec113e31ddb27", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342061, "uuid": "21ff524f-97e7-49ff-9686-3a5352f63f9f", "comment": "Malware payload (Grandoreiro)", "value": "6880d5771e896bef2f0b43d3b933210bf3fa26db", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342061, "uuid": "bde86236-7c24-404d-a841-e297926143b0", "comment": "Malware payload (Grandoreiro)", "value": "001dd3b2ae1d74b4e60c9bcdf9587a2647d1caf0b5c46ad7636ba39815d69d74974c07993f23e4373eb9e6f250414db2", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342061, "uuid": "138cef73-bc4c-4ede-8a46-90eb239866b1", "value": "T11E662332FF499C6EC78083F4343E6B312EFD6553078C90D7718CAA9B2766AD15A3A095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342061, "uuid": "3c55d6fc-2912-4144-952d-8020d4ff52d3", "value": "49152:4VY9ltV/liFtf5IOKC4LGyW8nSzueZpEjAp51WRNkhozepTp0FgINMwuK4WnlX7V:0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342061, "uuid": "f7c8e582-b2f7-4514-b3e1-0eae72b6a558", "value": 6475776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342061, "uuid": "b7e39ba8-8ce9-4b4a-81de-6333875a0969", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342061, "uuid": "73bb7b29-e2af-43ab-a019-615216b1ec56", "value": "113997U5CProc_HRYLPN7751834OE5P1ugfok.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5508e08-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356560, "uuid": "0811decb-4e63-4a63-b057-d34377b44e04", "comment": "Malware payload (Mirai)", "value": "96b1d774acff93f8d0e3d3d846b34f33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356560, "uuid": "0065b518-7c00-46d1-adb0-f8e16fb3d694", "comment": "Malware payload (Mirai)", "value": "672b57df551c701567dae739c53ad053135a3a3d9fb6d02175d4fab4fdebcf83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356560, "uuid": "4a6e6fe4-4802-4787-833a-379a5bc8e461", "comment": "Malware payload (Mirai)", "value": "3c0d4333eb9aee9838b0934102d321ccccca7e56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356560, "uuid": "cd0c7141-89fc-4781-b2bd-90232359ede7", "comment": "Malware payload (Mirai)", "value": "6fc8abc6a6690bbe894046c6754b9c48f1cab642e25c5609d007c5d11755d3d49a8d2245edd60e0be5321aaabf46094f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356560, "uuid": "fd9e5abe-29de-4cad-a099-fd441473bcb9", "value": "T13DA32A56F9814B22C5D512BAFA1E118D331317B8E3DE7213AE205F247BCA85B0E7BE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356560, "uuid": "a7e841c9-ad35-4b3c-85fb-263cdada0d1a", "value": "1536:MbnXOv/BqpQgy9G3aAPg6PE+A+1F0aBa9TVI6qu6QbkM9ipgbnm6q7O85tYzV:tvAQjG3h0aBa9Tbigbnm6qa87+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356560, "uuid": "7e3ff470-a4b2-48e1-8a08-67eb6bcd0c1a", "value": 104124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356560, "uuid": "4600856e-6b29-45d0-a4b1-9ca5e85d1a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356560, "uuid": "03e87912-998d-4837-a459-1ce2633faeec", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9018e25-0b97-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771288142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771288142, "uuid": "72fb6a7d-759d-4167-9efd-c703872073c4", "comment": "Malware payload (Mirai)", "value": "9207a1ade8bd245ecab4350bea1f850c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771288142, "uuid": "18a6a9d8-2c88-4a03-be93-85d6dc9ed7cf", "comment": "Malware payload (Mirai)", "value": "673de3bb81e79fba3aface878f02c458611e4e2a2379b04767460905140c676e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771288142, "uuid": "ed501787-957b-4b02-9d18-d75b334b2bc4", "comment": "Malware payload (Mirai)", "value": "a6427ebfac09a5a8b07d915fc7c2efc9f7d78fa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771288142, "uuid": "f5a3d11f-4630-41c6-9d40-99757952ff65", "comment": "Malware payload (Mirai)", "value": "1c417787c32bf6d0925c95ee7c6a4858c8bc31f138f2d5be88599c2cbf4ab621bc9a0d4fa6377336f9f7a40ab0601e0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771288142, "uuid": "e4633685-68b0-4557-aa1c-5206533d80f2", "value": "T111D46D9CFE5E3C42E2D7E2789A4D87E1722771E4D32391A33982434CD5CA9E9CBB1512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771288142, "uuid": "9bef155d-8d4d-4560-b879-0b028dde0820", "value": "12288:uw839bLprhM3M/HxAwI+SOpsyMqX+OTEdWDl45bT+w5nzU9v8:fM9fprhrOxZOp/MqOOrSTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771288142, "uuid": "2ab3c3d2-5d30-471f-bd42-2c9e95e86822", "value": 653632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771288142, "uuid": "e3dc498c-e006-4207-bc24-43a09ab551fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771288142, "uuid": "38701921-4e6a-4e15-b25c-dbe3a5c789c9", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94feccd0-0bee-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771325475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325475, "uuid": "edc01639-0c85-4fa2-ada4-793a65cb7e34", "comment": "Malware payload", "value": "0169f36d9f26d3a29bbf4cd4abcece15", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325475, "uuid": "f0176e82-5fdf-444c-b757-fb5154ba1839", "comment": "Malware payload", "value": "67bc27edf75ac2cbda6aca3c276571190d77d6b1314ae86662c2fed2bfdfb9ad", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325475, "uuid": "f8fa5064-c81d-4e81-9916-350729086c35", "comment": "Malware payload", "value": "cddf0e15854478d38c9d11a18012e76fafc0d238", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325475, "uuid": "7ae82b51-e2e2-496f-be0f-5e0f433e74fd", "comment": "Malware payload", "value": "aadeb6c559c053c10b0caa09f3171851abcb628319971a374874bafa4230f061d368fd8a1063220f054409271c0d7342", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325475, "uuid": "1844c8c0-f72e-49ac-bc84-fa09a4b6bd66", "value": "T100737D07A0FAFE922B56DD317A8744B69106F29A21433380D8B05C7DABF35CA55B4B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325475, "uuid": "1bfeec3e-163e-418b-a351-31e500e54fc8", "value": "1536:EvJKFDPqcNesp8N0VggggggggPzzzzzzzzzzzzzzzzzzzzzzzzzzzzz+EEEEy19B:iMTqgPlzzzzzzzzzzzzzzzzzzzzzzzzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771325475, "uuid": "b79c3f49-807f-4342-91be-8cdd566f618b", "value": 79628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771325475, "uuid": "009db600-4f38-4777-a1d4-0d9ea7b9bcc6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325475, "uuid": "cd00e39f-69df-450e-adfc-20a2b58a1f9c", "value": "2_19_7_1105_17.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7708f095-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341746, "uuid": "c77d07c3-93c1-4e46-9fad-2788f384bbef", "comment": "Malware payload (Grandoreiro)", "value": "50a5dcfc125ea20a6b224034bb1d093a", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341746, "uuid": "7524e407-dc99-495d-b212-f1c579f730e8", "comment": "Malware payload (Grandoreiro)", "value": "67fc8229a122c41c4766035c35c74f4bc32c58263179926bd404783027b97351", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341746, "uuid": "5e8fa11d-3f23-4c14-8f45-435b8f1c6376", "comment": "Malware payload (Grandoreiro)", "value": "e46d10b4787a5059badad9bdcc78c37179b07d88", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341746, "uuid": "71a972ae-6258-494f-ae0d-2454231bcab2", "comment": "Malware payload (Grandoreiro)", "value": "2343006476fbca952d0cc5a25e61c7ed9299a9cc009de246b44adb49f32a07551d320bb58b24fe275a7d00d93382d575", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341746, "uuid": "bea54019-0b06-4ebf-9bdc-071e35635867", "value": "T15D863331FE052C17C6844371B17F3A392E3DBA47848D66C1B9ADA2976746EC34A3F885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341746, "uuid": "7ffc3ae0-56bb-48b0-b392-ce10e2706b1f", "value": "49152:crKE4yR2jSu0agzZosYuSDk9TYzfKCJS+tsLOYK0g9mVHDmg13v0/hLz/pXylXXX:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341746, "uuid": "fb6e8ac4-6d3f-4f12-9a6b-157d84e768f9", "value": 8288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341746, "uuid": "fddb9aae-db25-4f8c-bb25-e0d857edabea", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341746, "uuid": "1debcea5-e958-4f0d-8e1d-54f1892dbfc9", "value": "0V4PHR2274MHTIU_Arb9093729KRzekn.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9327dde-0bcb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771310503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310503, "uuid": "7eb3eeeb-b85d-49db-ac2f-19343562da4b", "comment": "Malware payload", "value": "184f3358f9f34edd0728b36693b0139a", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310503, "uuid": "6685f05c-d54b-4790-92d2-c71fe0a6ecc9", "comment": "Malware payload", "value": "6842d3f39591663c2197d0d3b2f5db538511bb058ee2faa9d41208cc785665e3", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310503, "uuid": "f8159d70-cd09-4243-bd7f-8e595152b01c", "comment": "Malware payload", "value": "b7cb8d4a552ae26c0bc9925bce4095e762c978df", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310503, "uuid": "5d9de0e8-3552-4b0d-965a-f180f6f1f06f", "comment": "Malware payload", "value": "6b38f81ed1ad6a8756edb546dce4a3c76c0a2bf8935928ae0ff37d2a78f3663690be86ad1e394fef0ca2a291d2e047ee", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310503, "uuid": "1f698836-c64e-40f2-97a9-bab5deca3b4e", "value": "T17D1733613A85C072D3D543BA8E62A2523BA67D740B30E18FF35C7D59DA319D3B839326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310503, "uuid": "a2fe8d88-4d05-4fb1-a1b3-a42ffa676e3a", "value": "393216:WqSa8t/Rww3hN4u1pVDy+PcLHll9OXhVhc++YW1fImCutH/QZhEVAxlHJ:WqS1t6w3hKeFixWhjp+YqfImXHIvnDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310503, "uuid": "4ba6b555-c56c-4df2-9182-e4acb11fdff3", "value": 19714670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310503, "uuid": "620c28f6-a176-407c-84be-2d178f72dbde", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310503, "uuid": "696fbe4b-7276-45b1-a13b-0da7423584cc", "value": "6842d3f39591663c2197d0d3b2f5db538511bb058ee2faa9d41208cc785665e3.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadfb6b6-0c04-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771335041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335041, "uuid": "9e42f38c-dc83-4a77-917a-7ed020cb7b6a", "comment": "Malware payload (Mirai)", "value": "d841a92f6ef19adc68537aaa03bad78b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335041, "uuid": "88ebca9b-6981-4e1c-8ae2-b04d22b1fd76", "comment": "Malware payload (Mirai)", "value": "685f629365288dd8832878d5865260ccac53f79da7d42c3c831ed23ced91d88b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335041, "uuid": "731638f2-e392-497c-a6c6-4b11b460deab", "comment": "Malware payload (Mirai)", "value": "0603440bb3ac75645917a618ee1be6711d14270b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335041, "uuid": "59b23c5d-b3b7-4389-a1c5-bf82d5a1e87c", "comment": "Malware payload (Mirai)", "value": "afa4a1383fa2b72e2e94d0c529b310fe0961a5e36f3ff345f7aff550b90ca2ee01b63dd98855c518653236bb44741733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335041, "uuid": "d96e30dd-c71e-4953-9420-0887c95f290f", "value": "T141B3F816FBA10EF7DC6BCD3742A90B0525DC550623E83B763974C928B15B24F8AE39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335041, "uuid": "87284cd9-ac3a-4fbe-927c-a62b1b5a0ec7", "value": "1536:yYyLIVC6DB/ZNW3I9AtdRpPiOaFb1hX3uns+ScWmgE4Z0bK5Ll8yEWW:y7LIV1Dxu3OSdRB2n7+Scf4HCyEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771335041, "uuid": "e1cb6306-664b-4d34-9aea-1e75f3bedcc0", "value": 114068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771335041, "uuid": "973c3a49-1dbe-42b5-9f63-d9c23473e767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335041, "uuid": "a930736b-8627-4ca3-a6a6-0c3d78033e57", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1c3d9e-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348415, "uuid": "66b6f143-7c36-4f6f-ae9b-1d77185156e9", "comment": "Malware payload (Mirai)", "value": "1142e062689e8c25894fcecc79925bc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348415, "uuid": "601efec6-4fb9-4e38-899c-2ed14ed5f163", "comment": "Malware payload (Mirai)", "value": "6890f0562bf7ccb632787f7d067ee9853b1fea2b891f7a323536c38f245d39e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348415, "uuid": "1c2bf97d-dfe4-4502-8f43-16e1cce999f2", "comment": "Malware payload (Mirai)", "value": "9aa0dd85da1046db2bf88c63b917c137485732f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348415, "uuid": "f73de9d7-2871-4f7c-bd20-f56af706b926", "comment": "Malware payload (Mirai)", "value": "fc73125040df5cfd48a3b2d39dab88344a126e447a6eb75df11f568c0781410f7cd86a89c0fdf952e0ec544c1b9ea2ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348415, "uuid": "bd48d797-a677-464c-8164-f22a882dc7f8", "value": "T188D43955F880DFA2C6C12976F65D86A873174B79C3EB720689254B343BE786B0F3B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348415, "uuid": "279da50a-78bd-4ca5-8174-e5d51cd2b747", "value": "12288:cDpY9o4Xztaco6Xtkm+gO92AIVynW+2gpkltah:kY9o4htZ+gK2AIonW7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348415, "uuid": "a6b74790-f8db-4a2f-82fe-3131bce6eb40", "value": 607568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348415, "uuid": "3478fce1-e3d2-4807-b329-94746c15fe74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348415, "uuid": "b7bd491a-410c-4a84-881f-2368c65dd200", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe38ebb-0bc7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771308662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771308662, "uuid": "3300477c-7b27-48f9-b5e8-e731f2b8c16f", "comment": "Malware payload", "value": "c4861b92cdc7ea5faa8ab5ba0ae966b0", "object_relation": "md5", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771308662, "uuid": "581a5d7f-0941-403f-b0a7-7585e73ca19a", "comment": "Malware payload", "value": "68d3e2668bed540e9ead5e0f8f064b7d700fa1c5b93c2e98e7da98a1de56e514", "object_relation": "sha256", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771308662, "uuid": "1cf8c4ad-531e-4302-9ea1-07f64c003626", "comment": "Malware payload", "value": "bfca1fbf2b0fc69c75e8ac8ddbe78ecf03c30d48", "object_relation": "sha1", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771308662, "uuid": "346f9305-5b10-4174-ac00-a84ea2dfb341", "comment": "Malware payload", "value": "a0cc92adf693463ccabcaed74922972f8212b1c796d3068b648bb24ef0704b8b13f07dc4733fc5fec64ffc6d50f55e05", "object_relation": "sha3-384", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771308662, "uuid": "9255f52b-ac99-49b5-8080-e04b2cc0e6e7", "value": "T141E4C787F1208AC7F44FDA7F14514210AEF0E4704607F2562B6E885A6FEB9C89F653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771308662, "uuid": "4ae18f0e-c1ad-4499-b619-9e6f0727beea", "value": "6144:C1eMX5Uh/W94gpr2TgPjhMoQMl/LsRdewo6ur4jBe14UURK+q3/1Fp3x1ZBz:CZPz6X891/1nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771308662, "uuid": "dcdbc9ef-941e-4a83-b067-4eed9dba07da", "value": 702333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771308662, "uuid": "eba08086-d7af-466a-ba46-e76ac7dd8599", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771308662, "uuid": "4116d69e-309c-4075-b7df-d44b86135b25", "value": "LifestealEssentials-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b29e25-0bcb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771310370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310370, "uuid": "db992443-55dd-4a4e-92ab-b10b37d9b607", "comment": "Malware payload", "value": "8f82ec160145f043f5ee7df69c445d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310370, "uuid": "bd039e89-c817-4d33-9268-cbda8bae7b88", "comment": "Malware payload", "value": "6a36ec29b69f3e75d7e5481964081c725dd940beded28572b604ed35c9923dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310370, "uuid": "28ed1bd9-3a02-400b-bb3a-fdf453acb4f2", "comment": "Malware payload", "value": "93e3d138e1b204ad0a6658869595f571152c5c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310370, "uuid": "4b84460c-9ef0-4bce-89ba-bab07d3ea198", "comment": "Malware payload", "value": "44f493f54c663f5d82cbe945e091a9294632abc60d5f87f4b9867ee19c336dfcf726aea0c951f4e861db4e5e82747086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310370, "uuid": "a0eb6331-3095-4830-8124-8d149c2a5ff6", "value": "T1E1724C434B688263EF264F75E4E5A6236D7CF7819EDA810F6014830D3E173646B65B3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310370, "uuid": "3e7298b2-ebed-4385-bda4-fb409f60952f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310370, "uuid": "487b4251-9c39-41b3-ad91-e6723499d127", "value": "384:419j4SBW9bBWDrQ2ADkfrArlbraPd3KzCKjd3gSGBkSK:w9j4jw82AD++lbEd3KzCKZik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310370, "uuid": "5557a53c-ea7d-40b5-9877-c716869d02ab", "value": 16088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310370, "uuid": "25a740d1-17f4-4d2b-84bd-b1ae999d76cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310370, "uuid": "4ac4157a-e23b-4ec1-8289-0f98975b2eb7", "value": "6a36ec29b69f3e75d7e5481964081c725dd940beded28572b604ed35c9923dae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebb20bf-0c3d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771359448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771359448, "uuid": "0cd8642c-231a-4ea9-92ba-1a96480899e7", "comment": "Malware payload (Mirai)", "value": "3925756b0ab8533ff0be4e9c0680e666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771359448, "uuid": "01a9db96-ed1d-49cc-83f6-51054796cadb", "comment": "Malware payload (Mirai)", "value": "6a485c5a9f5b921e0b6e80b61c01ab74fab915ccaf935e7cc2208c613738d782", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771359448, "uuid": "9fb4a6a5-d9ba-4610-98fb-02440ac53936", "comment": "Malware payload (Mirai)", "value": "3d55efa1e1bbf071293e59971ffc39f1b329e41d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771359448, "uuid": "0d52120b-23d1-44f5-917a-da6dd4ec3e7b", "comment": "Malware payload (Mirai)", "value": "9485daa6ba1202f8525ce70e79dde4a53f4dec3d3c0adf12f7481372016cce662c2f3058c1214c04d2f6c907ad37ba31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771359448, "uuid": "db89ef87-2f4d-4e6f-946c-6d90c21a8251", "value": "T1E5B2E1AD056C55AEC09E137182ED93135275EDC13B8F83AB7FC8476EA40AD60EA356F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771359448, "uuid": "3136b5ab-b1cc-492f-9b61-c68b2c741fd6", "value": "384:MTVs70CkFsFVxQqERlKbHwmxWDmEvkvCFEZvxDLuQAclncrPoMTL0K/mVLv1RE:8sWsFAqYKrzJET2ZvxD15ZcrA9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771359448, "uuid": "b045996d-9855-4ce8-ba4d-995f8c25c40c", "value": 25164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771359448, "uuid": "31bb6277-2bcd-4fbf-bc32-723c276489ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771359448, "uuid": "470400f9-b351-468f-a095-b38cbed4848e", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9c1887-0c11-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771340411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340411, "uuid": "d3b882cd-c8cf-4b8b-b368-76a210225e9d", "comment": "Malware payload (RemcosRAT)", "value": "8b9778d67f898ba66d2a852d43c72e13", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340411, "uuid": "17ffcee6-c8e5-45ac-8d17-4ac9cce5db37", "comment": "Malware payload (RemcosRAT)", "value": "6a66c3c74abfca0765da7eb318c6e24774b82315c487003628cfe61e380edda7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340411, "uuid": "afaa20f8-cd35-4f3c-a5b8-6aaf76b782f4", "comment": "Malware payload (RemcosRAT)", "value": "fc4eacca914091ac1f8ee1d4091b5a70f8a79518", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340411, "uuid": "1e2c0622-02c5-4aa8-bab9-c44d73590f95", "comment": "Malware payload (RemcosRAT)", "value": "471b096eb907fec160b0ddf396387a41e25d5a2eae3ae4c1e538b13c9e7dcb8adc885086466bc2249559fe9caee8943b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340411, "uuid": "447ccb38-048b-437b-b78b-898a89690e5c", "value": "T10D55F4A44779C0FF943D0E4890C5E4793E4F767FAD062F3CB524A9BBAAA0142C4F5A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340411, "uuid": "1cd30fbe-7cc8-4065-95a6-5263ea6c2281", "value": "384:d33333333333333333333333333333333333333333333333333333333333333e:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771340411, "uuid": "26d6ef0b-5bb5-487d-8777-cc9ae2745690", "value": 1386691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771340411, "uuid": "8d4d00a9-3b95-49f0-9e6d-da847c3a4874", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340411, "uuid": "e7e6dedd-a077-49eb-a151-1348cca760c4", "value": "sd878f23823878428348fd8g8g8384838f3453dfg.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52a39de-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352614, "uuid": "37df85f2-2e99-46d9-9fff-ac9a61bae8d6", "comment": "Malware payload", "value": "b0623aba104872f93abc7f92226f6933", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352614, "uuid": "248f94f2-34c1-4ba0-bf34-9d3957f1fae7", "comment": "Malware payload", "value": "6a6bf2d0161f9a58e2cde8b1e2a0b387b088063479ba5fe62a1482f207a66986", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352614, "uuid": "662546ff-222c-4f11-8124-27ac3826c84c", "comment": "Malware payload", "value": "9ebcadc7936d55bc7740b69162e5e0e39e4a7164", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352614, "uuid": "a4dff611-1ff4-4513-8a8d-3735caff467c", "comment": "Malware payload", "value": "bfd69fbab49e4009cc3b3376da3b731c6094dc60b48b3f031f1d95fb96ead5127ba6ae4229c5f6bb4255f0a9cb2737c5", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352614, "uuid": "e7216227-8fb0-46e1-873b-d1e35bb96526", "value": "T197763331AF159C6AC6A04339B02F3E291D7E75430B8D91D7719CA28B234AFD68A3B4D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352614, "uuid": "2e9f2b57-383b-4602-8684-5935cf4dec8e", "value": "49152:v16cHryYYqoGQDlf/BeX9/JfksfehqbUtjLDFinRn0/5Tz5scHOmi2iZdK/WR4nk:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352614, "uuid": "f99d7571-0a9d-4fbb-9e76-e970ee4e99dc", "value": 7753728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352614, "uuid": "3ac58755-92cd-47dc-bf8a-d6d07c79277e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352614, "uuid": "84379db8-6bff-4e63-8545-a4994353afb4", "value": "TmprDLIU9741-37A0.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e5e530-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343254, "uuid": "e3fa65df-9634-41ae-86e7-3fec72047f3a", "comment": "Malware payload (Grandoreiro)", "value": "3383c395c8a70982bf493f29a9a6c290", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343254, "uuid": "f4850259-c6d9-408a-9f5f-8ab4c7d182f1", "comment": "Malware payload (Grandoreiro)", "value": "6b9ae8f4a6cdc85f413ce9c09be644e0b78f1a86c7f8eb4bbdad732c2abdd647", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343254, "uuid": "acc6e291-0720-4acf-ac24-eedad6161e42", "comment": "Malware payload (Grandoreiro)", "value": "70f4720b2e4958227aed198f8429ff4c4c854fcc", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343254, "uuid": "c6b711e6-2ef4-4f74-bcd3-b2603bc902f2", "comment": "Malware payload (Grandoreiro)", "value": "2e60f2708ea3f6e7fb67f6144d5c55433d7332d57f14f66d5ba12667fdc06b1f1be1c03bf50401a13441e2d10d6abe86", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343254, "uuid": "5502635d-6073-4410-8d10-df07905ddc5d", "value": "T187663333EE815837C1A443F5B42E3E212F7DB60785C8E1EA759C85C72789BD0499ECA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343254, "uuid": "da19bcc4-2773-4e12-9b46-378297b399b4", "value": "49152:FVOeYrNYI5OYY4OrAJBJq8IHYFku+M0dbU77pHVYdZx80P+C42KrNKNaucXsKtPv:iTUDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343254, "uuid": "e03dc904-4af7-4e0d-9f8e-58c6c9bd0e31", "value": 6537216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343254, "uuid": "c52a3406-7f7d-4839-9d38-d4b8ed79d1c6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343254, "uuid": "1ad13f7a-eca1-49a6-9df7-5392fccd3809", "value": "HbrRQIB6615_TVVRKGhluj-Nota607RJ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4a6419-0c47-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771363578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363578, "uuid": "8977e7e9-760c-48ad-9370-233771d56812", "comment": "Malware payload", "value": "651ed2689b914970c0bd17eaf340a269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363578, "uuid": "31741ae2-7b72-4765-9c00-8a5e21d2eea9", "comment": "Malware payload", "value": "6bac8a740563429df850c0ffff8510fa366812139bc9803737cd1cecfc5b4ddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363578, "uuid": "c9cbbd3c-b2a3-4808-ad36-2fa646e20219", "comment": "Malware payload", "value": "426386bc60034a96a626835182f11f0c53e2cf4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363578, "uuid": "b277717a-f900-4a21-9890-81707ac71c30", "comment": "Malware payload", "value": "5c80c7d147a52baa2c2592d4873132a5bd6029264e55ed193eddfcd6ca24f7768fa0f2abbc3a77fa23c010c0900c401e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363578, "uuid": "c01cfc36-c129-4b19-81a2-0af4eb33f8b0", "value": "T1A937333171568571D08321B26D78EFFAD15C9A319B7A04DBB3EC5E28D7305C2AB32E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363578, "uuid": "bd7343a2-208f-4187-a1b3-0166e0c5db5e", "value": "c9ed0c76cd975480b9599a73737988ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363578, "uuid": "f9629388-5a8a-45a5-9394-251872029d83", "value": "393216:bnHHlVm1qFiFJ7F91EZ42NtuL9ukh4goGFflbsOGtZDTe/2Ql2seRdb:rHMq8J7r1EfN4L9ukBvHbsO0ZDTe/2Qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771363578, "uuid": "248b2c56-5499-4df7-8299-e05f0414b105", "value": 24415592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771363578, "uuid": "a22b534f-a92e-420d-a682-32cd5b89b08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363578, "uuid": "048f1eec-5de4-4a1a-96c6-95835cac01f5", "value": "confirmation36m7t5stx19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35deba3c-0c1c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771345072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345072, "uuid": "d6575694-ae9e-44bd-a056-5b3757a3b4fe", "comment": "Malware payload", "value": "1b4c46c0c40463cb4af341304345ab10", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345072, "uuid": "99d44e52-999d-478a-bcb8-6566b994936a", "comment": "Malware payload", "value": "6c0c480e6182d5aa36385f8956489fd0fb9821045953751e0b861252daa93521", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345072, "uuid": "853577f1-6bb6-435d-8744-6a366ab5c3af", "comment": "Malware payload", "value": "81daac3c5a4a1697f744fcd9b8c8c50e338ee01c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345072, "uuid": "e86beab0-924d-4738-8057-ed16fa1b7037", "comment": "Malware payload", "value": "6232283d91547887dc3b75ccb19e10ca641b03aaef4b5bb15dd579ff5fd3dfad0db748ee773986ad8fa05035f9525f7d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345072, "uuid": "a3073dd8-e9dc-43df-affc-e8bf6c5d158f", "value": "T13024239DA39E54A5C66820F8AB963E809407B23712893FBCCEB05C7C435F805747ABD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345072, "uuid": "832b0e37-166b-4376-b2e3-4429f69acd51", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345072, "uuid": "efedb114-b98b-496b-b6c5-fb75925ec1a4", "value": "6144:lS8bUZjtgn5V0tCAveK8yuC/EsIrBX/S33A5V9nHwdr/:088jtgnIwAQPQIrBX/S33A5V1Hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771345072, "uuid": "81883f97-8270-45fa-aec4-316f324a8b78", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771345072, "uuid": "d79fb61a-e50b-4bf6-b116-089e3ab2cb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345072, "uuid": "b38569a8-7ed3-46b8-85c5-1de5ba180d80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2458e9-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356495, "uuid": "c339eb1f-7fea-4703-90a3-05d60501ab16", "comment": "Malware payload (Mirai)", "value": "248b8c10c0d7a2ea30b004980c187d8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356495, "uuid": "a76da8e5-315d-4cd7-a157-d5c589a8343a", "comment": "Malware payload (Mirai)", "value": "6cab3e91a084957a1d488df52a1703e091c1e9c5da44fbb8b42ad6390335499a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356495, "uuid": "f132f18e-68d0-4a0a-a7b1-d42dd7bd1b49", "comment": "Malware payload (Mirai)", "value": "98a3fa452d840600827472cad8db8e785bb8b72d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356495, "uuid": "fee506bc-a4b0-49df-a861-ad655dc1b307", "comment": "Malware payload (Mirai)", "value": "7f5f9615d0ed12c5e5f631c410e0516e67bc45aa12c6677f4bdf131ccad17625f5eb87546be01460b628023541aa75b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356495, "uuid": "fe929bb6-eb2d-45fb-a716-1a18a3e650af", "value": "T1482302E5F27A3C9359C9317785DAC8CA7A3E073DB08A60E11050099CB996EF0767D52B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356495, "uuid": "372f433b-dd2e-480b-bf2b-79f6eedb2fc9", "value": "768:XSh/fv1XtipWgxIw/kxTVafV/F0SFjZBt8aInFVjvlm7Q+Pqvd9q3UELh5j:k3v1XtipWg2EWTVyNHBm/nj9m7Q+iwLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356495, "uuid": "9c5c01c6-e4b0-4e85-9708-adb8373e5509", "value": 46788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356495, "uuid": "2ed326d9-4edc-401d-9d19-4088180b0e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356495, "uuid": "d6c1df3c-a943-4373-ba67-1032f585009e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e1aca8-0c4f-11f1-a129-42010a9c0007", "comment": "Malware payload (SimpleHelp)", "timestamp": 1771367168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367168, "uuid": "bba6f747-cfc7-4733-a2a7-b7f2d3061f83", "comment": "Malware payload (SimpleHelp)", "value": "251852cd24c24971281d8ae281f08137", "object_relation": "md5", "Tag": [ { "name": "dexamethasone24-com", "colour": "#FEF2A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367168, "uuid": "5dc2c1ed-19a6-46a1-b608-7d57b10de53b", "comment": "Malware payload (SimpleHelp)", "value": "6cb9bb341760edac2df73054404d36f4cd7a5c8f3659d1eb0888a98de27c7680", "object_relation": "sha256", "Tag": [ { "name": "dexamethasone24-com", "colour": "#FEF2A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367168, "uuid": "90d95540-5b86-46fc-b69f-727ec16309b0", "comment": "Malware payload (SimpleHelp)", "value": "8c7e8d70e6442d3f1f3c0afcca9e1b8e0e1b958a", "object_relation": "sha1", "Tag": [ { "name": "dexamethasone24-com", "colour": "#FEF2A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367168, "uuid": "008accbc-b336-4ec4-97d6-3d6a561c42d4", "comment": "Malware payload (SimpleHelp)", "value": "edc34dccf8824b6d64bedd97d780d53151a5623508b84ac08ecb4526974131878e3668c1e4b14b7b0fe59f3f26be94d4", "object_relation": "sha3-384", "Tag": [ { "name": "dexamethasone24-com", "colour": "#FEF2A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367168, "uuid": "2c73c85d-1df0-41b4-b03c-fb88b8e0b0ee", "value": "T116873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367168, "uuid": "9a69264c-b53e-4819-99ac-fd999e8cd8ec", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367168, "uuid": "e2201c43-6ba1-4d64-9c62-a3d3294c50d7", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1b9:/uRf+nAu2FuQd73XyFeDMnKT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771367168, "uuid": "69ec383d-be7e-40a4-9e3e-2c9d601871f5", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771367168, "uuid": "8a7c900c-061f-4f67-94ac-fa204e3b9305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367168, "uuid": "d30c7f84-c7fe-4088-8403-9627e1e6e5cf", "value": "SSA Statement.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad26b2c-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771342906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342906, "uuid": "ff4d4c92-2118-49d2-a4ce-86416f3a2fd4", "comment": "Malware payload (Formbook)", "value": "33e6145cd07fd9563bf1fe7d34b0933b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342906, "uuid": "4081117a-f77e-4362-883e-7d55d8c96159", "comment": "Malware payload (Formbook)", "value": "6d517db7770bc69d5bf119116a7395cb74f1ca3839da9e8096f6a41cb2868810", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342906, "uuid": "ab6548eb-708a-4673-809e-63e07d8ba416", "comment": "Malware payload (Formbook)", "value": "0a553f2f5b54370fb5e850f542e3d5f2ec78b1ee", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342906, "uuid": "ce9d7429-fe78-456f-bc4f-e0297d67caea", "comment": "Malware payload (Formbook)", "value": "0f9e9934a417d2c224e72ff3aa875f77d0fdb066604a27fd60523c90bd7b4f3ef4248e400b735daac220fe4f1fb4ddb3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342906, "uuid": "f63738ab-2c79-4b61-9ad2-8ab7ec53a93d", "value": "T14746651A5DCD0BA426FEC76AED0936433F082D3E1E6CD1D8D236B5A665E1250CDCA7B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342906, "uuid": "97d3b93b-30ab-4c84-81b9-12a4cb900862", "value": "98304:3WQ4uyKB6FNkED+urO8Seh6kuA8+xpaf211crbpprUT3vfzxioCTVG9cPFu2wg99:3WQMKB6TkEAgNuyXc/rU7v1iS2gB+vP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342906, "uuid": "fcc48b1b-1f04-4dbc-80ae-335276aa397d", "value": 5797873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342906, "uuid": "5f702631-177c-45d3-9b09-373796016ed7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342906, "uuid": "aefa187c-c4a1-40b8-9c75-160435768bb9", "value": "70986523344686.PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4c69ba-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353863, "uuid": "6e921581-4a67-4210-a61b-dd1f5cc40d3a", "comment": "Malware payload", "value": "b926937a7112d648c10a70a761ded138", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353863, "uuid": "a20a6359-1b98-44e5-94b5-acc4f0ace622", "comment": "Malware payload", "value": "6ddd17f482e0987776d24dda4b4f615dd745a7713e031c54860ff6b4965f1134", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353863, "uuid": "99b365eb-e94f-41c1-9675-ef14899afa74", "comment": "Malware payload", "value": "3152ac4a445f91a6bf4127a8cb10aa6fb497cca6", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353863, "uuid": "bc32b07c-c8ad-4010-bdd4-ded488a828a3", "comment": "Malware payload", "value": "e9cbfcf4bc4cdd9857d7d0f1278985b1f6809808a1a810df29ea8cd1974364b023291ee565520345fffb67d3b1a9b952", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353863, "uuid": "7c9746f5-39cd-4a31-a105-6df0d81f2f3c", "value": "T1AD763333AE05588FC584837AB42B7D362F3C7B6745CCA0D175ADA1833789EC5862F866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353863, "uuid": "1ce37596-8447-42cf-a281-e275f65b8c8f", "value": "49152:e0eLoQmeefUVbnD1mBaSufjJPx870ixezCZfLCvRd/ZrQdi8YFBo2gRUf+RwaWqx:c0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353863, "uuid": "0eac4c28-04ce-4d1b-8b2b-41cd5e383149", "value": 7340032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353863, "uuid": "fe172b92-41f1-418c-8e86-dd9f63a468bc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353863, "uuid": "963526eb-8709-4dab-aa1d-c0e2265b3feb", "value": "Rslu444167BDFMP_97RE.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a9a6d9-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771312727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312727, "uuid": "cfc4ace2-ebef-4365-a6dc-65f4a887f4e7", "comment": "Malware payload (XWorm)", "value": "9e1a5e9c8a30d3f2ed32154219d93321", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312727, "uuid": "fbe966db-c7fa-421b-a619-e1aab09897a6", "comment": "Malware payload (XWorm)", "value": "6de8375728eaef7c8c75350d2f9e0b2fc6a33d41857eab4e38f7a46db88ce272", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312727, "uuid": "7430af3b-9846-4f86-a869-be49e911e593", "comment": "Malware payload (XWorm)", "value": "73e0c9aff09139cb96114acb8f9c48a0401a6862", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312727, "uuid": "86f65eaf-b4c0-45eb-b609-54f874a84535", "comment": "Malware payload (XWorm)", "value": "6d30b55a0e6b7e18a2a2157886dd20aaba77302f171260e3c8b49a58368e47e6ca17549e316717b79fae20b8d4f299ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312727, "uuid": "501a6529-522f-4952-add0-550b9a151de6", "value": "T15423E7CE31C371A81B623D2711AFB1E7E63ECBD858CC6560D2A59D61BCA031DCEB5924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312727, "uuid": "f332470c-8c11-46d4-818f-5f2af4a58b40", "value": "768:DYx+tI46Lutae7pYFcLTl36ajGQqBJD9kYkJ8luyOuedzxMlZ5Wh4Jkup21DSUWO:DJ6cLh36ajvU7TOuedzxqDIupiSUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312727, "uuid": "21d2d1f9-df41-49b5-8343-f90002812f1c", "value": 49199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312727, "uuid": "c3f651ae-91f6-4873-8f67-ac5c976bebac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312727, "uuid": "3cdc290d-1fb5-4804-96d3-18761b8b1a8a", "value": "9e1a5e9c8a30d3f2ed32154219d93321.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bf07e0-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343978, "uuid": "14f15f41-4404-4972-8120-04640ed0b8e6", "comment": "Malware payload (Grandoreiro)", "value": "0c5cd31772960efb2b35d8ba0f776d84", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343978, "uuid": "94a79476-08e9-4a1a-9964-44c6049ace0a", "comment": "Malware payload (Grandoreiro)", "value": "6f3bd16f29ba418a5b2366c3da355a5dee1845a05890a01759c171e54a7e1698", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343978, "uuid": "058ebb34-3bc3-4fb2-91d6-9085858cb946", "comment": "Malware payload (Grandoreiro)", "value": "4c3e03fe8b507c35f1f3ad0d6c9e880d8416d8c4", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343978, "uuid": "c48dd5ef-f2d6-421a-8537-ee326d4f934a", "comment": "Malware payload (Grandoreiro)", "value": "0d0686caee044d8ea23625e4ff2be2b59c5d7862427767bfb041cbe5f86ec0e92a09c9073b12dfecdba90f62dfb53e5f", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343978, "uuid": "8c2f10f1-3766-4b2c-abb5-fc0d02009b20", "value": "T1A3763332FE952CABCA144335706F2E252E3DA597818CD6C234DDA1877B47FC28A2F465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343978, "uuid": "06abdc45-aab7-45fd-901c-a083fde698e0", "value": "49152:fnnGPlB4IAi6dZSEBW/jIxERmy2LOnvOb91f8fCcHkbM1UM/uQ7VrjgL67c/X7Ix:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343978, "uuid": "070a744c-76fe-4de2-bc29-6e538f0de250", "value": 7677952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343978, "uuid": "7261276a-e19a-43ff-baa9-e89639e0c23f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343978, "uuid": "4a432fbc-d281-483f-8cab-9ea6390e8d7b", "value": "PedKZOG4804722_FNCUSA808827qifz.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641e8cb9-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342143, "uuid": "7598a31a-0b0f-453b-a67a-343a5ff6b4fa", "comment": "Malware payload (Grandoreiro)", "value": "53bbc219a0e18e8164e1d62a4c17774f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342143, "uuid": "40e9f390-a0ed-44aa-8c01-9bb9edc2af4b", "comment": "Malware payload (Grandoreiro)", "value": "6f99762f44c853ea18e90c1abdaf9b8dc0322387fb7278f9d952aeec99c18754", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342143, "uuid": "0b03316d-925c-4722-82d4-19021d1f7ebe", "comment": "Malware payload (Grandoreiro)", "value": "0e5a51888dbe24a072ea8abdd537097640bf5529", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342143, "uuid": "8fad543e-8ca9-4f5c-8032-06dea425d3b2", "comment": "Malware payload (Grandoreiro)", "value": "0f9b8bb08f3c76a39fa82c5a00c09a0c934be2cf4854af0d5f1f0137c35b043883d5fde6fe444f01ce96192e7af7e307", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342143, "uuid": "86f0496d-7774-4237-b6b5-6220c79063d7", "value": "T15A662332BA51A96AC2408376706F2F251F3D2613470D89C3258DE1A6378BFD2DA7F4E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342143, "uuid": "787001b7-6103-4572-a43f-597e990b24e4", "value": "49152:QbPoJdMSvQ2zp1Dopt4EcrsWMGK0cu9JjTgyF57ApLNIYzq5zXwLPRQXUcfOi0fd:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342143, "uuid": "76b47134-4320-473e-922e-8b5607033f3b", "value": 7008256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342143, "uuid": "4f6b2d68-5744-4324-b8b1-d41ccd4a6b1e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342143, "uuid": "ef406939-c052-4a67-a036-d4a7bc6eabf6", "value": "424212Pag-GVX44ABUEREeczko_Trm199314S180.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b76138-0c1c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771345099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345099, "uuid": "c3841ed2-947a-45d3-87af-9152dcd16904", "comment": "Malware payload", "value": "ff777857f1152dde8b2f812725f3b777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345099, "uuid": "6c3c6607-fa3b-4ee8-a253-f88831e73cc6", "comment": "Malware payload", "value": "6fc6760c24329e7e12e5e629220308f6f3a71c1436c9bc730312c2906cb52d8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345099, "uuid": "874c3a76-2141-4d4f-b103-e3996fe18004", "comment": "Malware payload", "value": "d3dd4335bba9b507edfe1507ccfcf76b7d4ebbe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345099, "uuid": "e427ca76-0d1c-49de-bfee-cc2c12cea9b5", "comment": "Malware payload", "value": "e591f4533ff65ae426e26484138c7f15a55dc337dfc38a937c5a9c286d001d0952017673ffcfd3c990090850ed598bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345099, "uuid": "16f0a6ff-bb6c-4c9b-9d27-bff71975d445", "value": "T102D41ABDAC20E366F70D90BAE246D3534F2138410636A9A329BED7141246873DB577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345099, "uuid": "f783e68a-92e3-40f1-8053-b39ff8a92ab4", "value": "272da274133b3bd9f0a6f58d3842d526", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345099, "uuid": "889a22f3-c649-4606-8843-42da2b2ece4b", "value": "12288:VrW8rSu9JOwZD6GIlgjfnI48z4He981xvO6qYO:V3rSu9JOwFdbjf2z4He98jO6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771345099, "uuid": "9fa35cce-978d-4529-b4dc-84b4585edeba", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771345099, "uuid": "53402f36-3577-4c41-a4b4-8a2a980a6d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345099, "uuid": "7097f232-3b00-4053-b65b-074b79ef523b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7702c5f3-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload (AuraStealer)", "timestamp": 1771311251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311251, "uuid": "afa83377-38a3-463a-ab24-295c54ed23ed", "comment": "Malware payload (AuraStealer)", "value": "ce223670524974b51445c29a61491712", "object_relation": "md5", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311251, "uuid": "cf4867d0-0b9e-47fe-9478-07cec922c139", "comment": "Malware payload (AuraStealer)", "value": "701f5f9fe2a386456622ae19164990084df41e789c826e45fb56a2f5a4596036", "object_relation": "sha256", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311251, "uuid": "145fc2ab-4a75-450e-93de-9578ab733a4b", "comment": "Malware payload (AuraStealer)", "value": "8ac09bc50dd2502a7e0cbba76c4a607cc925da2a", "object_relation": "sha1", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311251, "uuid": "609f79e3-c0bb-4d48-8683-434cea65cc5b", "comment": "Malware payload (AuraStealer)", "value": "ac253f36d91a9e0a9f49406f570a06fbfb648db3a615249333b3fe73971b2a8cdefa5a6f25749dace24bbfeed6093764", "object_relation": "sha3-384", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311251, "uuid": "0f54fddf-c59b-4d4f-a979-60a6d386ca5a", "value": "T16FF49E22F99311FDF4B31034989DF33ADB3A3A158E155F8BE7C09B74E9702416A2661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311251, "uuid": "50542cec-2114-4227-967c-1ea04a98d3a5", "value": "1cb7010fa29c1205e95faaaf21e5a21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311251, "uuid": "8dfdb018-c0f7-41a4-ba8e-512a19ce9448", "value": "12288:eWCXhe4mhLKlRUQGJNTXar3lSn65/QLtk:eW2mhOoQUTXars65/QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311251, "uuid": "d7f368fe-9c40-4763-b841-698ac2f7b538", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311251, "uuid": "5f0243d2-535e-464f-b2ea-e85245d718d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311251, "uuid": "59c186b8-3c4b-4e06-83e5-7ff00fa9217e", "value": "701f5f9fe2a386456622ae19164990084df41e789c826e45fb56a2f5a4596036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d660b4ec-0b9f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771291654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291654, "uuid": "065f6e5e-e9a0-485f-baed-7afc10b0d0da", "comment": "Malware payload (Mirai)", "value": "de9a51d3612749ffe89d1a8e463585ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291654, "uuid": "313deae9-a333-41f1-8d79-58728e9b3587", "comment": "Malware payload (Mirai)", "value": "7034dc45a7f8bb126b34319282e49b9ab145f7bdf0a144b861037abfc00e4f55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291654, "uuid": "4e47adde-e148-4f04-a537-42119db93001", "comment": "Malware payload (Mirai)", "value": "3e86d0475cc351e36e465261b8a816735008376a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291654, "uuid": "1fc05f3f-75fc-46b6-85b2-89fc8759dbfa", "comment": "Malware payload (Mirai)", "value": "682d9b7d5bfbaa2cb8d0adeb53b6f3385d63d1ff3c9efb4e64b32460fbb7af026c46f8237bce15ddb822ce2c29181e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291654, "uuid": "013d2f10-9ec0-42d7-97ee-fc177386e64f", "value": "T10C833B95FC818A12C6D112BBFB6E428C772653E8E2DB3203DD245F65378B86B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291654, "uuid": "a8b5d980-3688-47ab-b85c-b649f7d8a1e8", "value": "1536:ldu1i9RMyGlP7vWRwxrJhTiculCqMpPa52c4lrBsAL83TnO7zN889XiFinzo:ldsQPa7emARgqEa5hYrBsA0V8YFinzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771291654, "uuid": "49f3018a-0963-41da-9c75-d7e8cb4eae00", "value": 83492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771291654, "uuid": "d0cd4979-5ea2-47d4-ae52-782544a86b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291654, "uuid": "5bddcbf2-6869-4875-b28e-00f6dcc5066e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519a5ac7-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342112, "uuid": "20e31ce8-78ce-4b7d-a63a-4597769172e8", "comment": "Malware payload (Grandoreiro)", "value": "d236739dc94bda9998bc400f2c7240fb", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342112, "uuid": "88514a8f-7eba-48f9-bb56-7c70e58e84c0", "comment": "Malware payload (Grandoreiro)", "value": "70797e3216d232c65139435603df1b60e34aa6bb5b5c6377b8cecb56d748c1a0", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342112, "uuid": "ca898fdf-605a-40bc-b20e-3234a8455b04", "comment": "Malware payload (Grandoreiro)", "value": "4c3e132034df51acc64806a1d3ae21e33cd78107", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342112, "uuid": "9e542d32-ea9d-4e41-8ee8-e2d85c2370b8", "comment": "Malware payload (Grandoreiro)", "value": "fb8d4133a5cea040933a7746f1a64fc502c06d87836ce848854407d85c99f9b7daa67922689bf55e99f4e59e5751b31e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342112, "uuid": "f801145d-9917-4dfa-8863-6d53f382fce3", "value": "T1C58633316E855C9FCA940371B02F6A257F7C26539288E9D37DDC9183278BFC1DA2B468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342112, "uuid": "20338955-9203-42d3-8204-83bea5b785e7", "value": "49152:sZ/A4TLbwRkQqjBhwvqbtKCggYn0SYvRCd8ISvwqkcJe1fQ8/Ej2RNBKreWsorQr:aQLr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342112, "uuid": "bc5352c8-1b8a-42e7-b2c6-a6d1da2298ba", "value": 8118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342112, "uuid": "4b4f4702-e3d3-4b62-97e9-5c84c3746ac7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342112, "uuid": "35a23d88-3f3a-4b47-bb7b-a90a1b37ed8f", "value": "346022S4R80_Gst-IonIPAD.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd34e5f9-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352601, "uuid": "3690ec91-d740-4e20-87fd-724ba9449381", "comment": "Malware payload", "value": "6c5d2def5fff273ba8d84fe996109129", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352601, "uuid": "15a77776-c914-4329-a376-2268fd6b1673", "comment": "Malware payload", "value": "70e665d84180f6923701a0af4e56f4a8dd832ec51673765e657986d384e94d68", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352601, "uuid": "d9a7ac08-ec50-4af4-bbaa-90f56684ba0f", "comment": "Malware payload", "value": "ede3a8c45708fc3c278a46e29a668f65253f91dd", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352601, "uuid": "e833ed91-4741-4e70-b06f-b531f109403b", "comment": "Malware payload", "value": "81710a0fadb9f5ed4d8c8215952533dc321ef98b7b65c03969aea2ef5e1a0f55297c0d636ef089e5f8ab7fec5ae7e8f2", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352601, "uuid": "25c32121-8f94-4650-a21d-2083c48e5b24", "value": "T1BD5623329D445D1BC6548337702E2E362F3D391785CDA3C631ADA18B3B86EC58B2F4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352601, "uuid": "534073c4-3b42-40f0-86dd-9482d9a93a0d", "value": "49152:EkE0q5jfcC8svSqvF32v1xaVPBqskw8UhfXg2w7oDyW6wqP4Wk5lyawNRuWdQMTY:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352601, "uuid": "4b4a9c69-61fb-49da-9835-c0699372384f", "value": 6086656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352601, "uuid": "7f365084-6805-4ab1-8138-daff3d6cde6c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352601, "uuid": "a0c9a76d-d804-49fb-a9a8-7289e295b13f", "value": "SSKV587NS36839_Hst.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ed8473-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356509, "uuid": "87762adf-2d2f-4240-bc90-ef64ad13e2a1", "comment": "Malware payload (Mirai)", "value": "91d7c1b2a32fc2bebbc41fe4d625f739", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356509, "uuid": "edad0288-54ff-4d70-b9f0-9455a6d3faae", "comment": "Malware payload (Mirai)", "value": "716b31a1d7fc9a3ae8ee681d8cfd8640d842d7cc854c6e66f05e8647117725d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356509, "uuid": "0d579e43-647e-4e17-9b70-2abd640cd703", "comment": "Malware payload (Mirai)", "value": "154ebdc57d818c60e7f7512b9dd151c2b582b22b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356509, "uuid": "c6f8088f-a65e-46e6-93ae-0b06ec6b3c33", "comment": "Malware payload (Mirai)", "value": "157ddaa86d53b90c52a3d7f475a048ab452b96cb0ea97e42d587d1b2dc45a7c7b433b455925e376eafc5e0a8fbc1c296", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356509, "uuid": "173c103a-23f8-408c-ae75-d3aeeaf480ae", "value": "T121D39D97F28704A0C46305F003CB1B9E6EA321925E5BD9F37C2EAA3B5E764DB1905BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356509, "uuid": "1cb32fca-07b9-49cb-a4f8-e7d336352376", "value": "1536:ObuhWNbSPMVg5PqRZbcLTQ0J9Nvl+YahHHRVx6UpgMIB+/LWr:jUgMe5PqRZ4LUE9t03hnRbgMq+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356509, "uuid": "0069539d-fbc2-4ead-b422-a819d681c3af", "value": 132764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356509, "uuid": "0ae6fca4-e1cb-4b93-a946-2726c765e9d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356509, "uuid": "821c202f-eb8a-4119-887e-64c85ac25428", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f7cab1-0be2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771320261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320261, "uuid": "8e6be9e8-ec3e-4819-9225-45c88af1b560", "comment": "Malware payload", "value": "b4ee2f9dcae350b317bfcca07263f73e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Floxif!pz", "colour": "#F66F6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320261, "uuid": "685930da-ee73-4f0f-a71e-442ec443dfeb", "comment": "Malware payload", "value": "720e1a32fcc9308e33781ea1f1e0dd5e980f11492e93ed14624a68c383752159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Floxif!pz", "colour": "#F66F6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320261, "uuid": "ecfd4b43-7035-43d2-80fe-3dd8c17658ae", "comment": "Malware payload", "value": "17db27e10118704a1ef6fed13915d182e2513399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Floxif!pz", "colour": "#F66F6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320261, "uuid": "b1252fcf-db1c-4d2d-afc0-da57305e27ac", "comment": "Malware payload", "value": "cb96552e04e6e170ecdf6d69ef4a9736ad05ffdf1ddd15496515fc5e6800eec9bae6636d3722ccbfcf5c847a5be7efad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "TrojanDropper:Win32/Floxif!pz", "colour": "#F66F6D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320261, "uuid": "94df296a-841f-46ea-b55b-e39c2ab14cbf", "value": "T17D27337107E222D6EDA0077ED7F87C6E8A689E41D25B0A4CE1A7F79E1F117934002D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320261, "uuid": "375c601f-4f98-4eee-83da-3411588c5f93", "value": "a1283915514627780782842699398053", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320261, "uuid": "a6010ea2-6437-4d30-92ae-1ea3cc4ee15e", "value": "393216:2KXqGDliJND2Rl2uGFaFdTWxQRf8OIQDSaZ+DkwlEVsx5XQcxdOTvuIFDlyR8:TPlE6RofaFlW4zrZ+ofVs5XQcPWWI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320261, "uuid": "c2fc47b7-598f-44ec-9ed1-e061ac7dfc6a", "value": 20526607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320261, "uuid": "2f58de0a-be22-40a0-9f2d-e50b47149037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320261, "uuid": "7caf5ad4-dad6-4114-8ad9-124e667f9ae4", "value": "\u4e0b\u8f7d\u56683.40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf35b5cb-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343182, "uuid": "90095afd-6519-4343-943e-d94676226c59", "comment": "Malware payload (Grandoreiro)", "value": "96f9b81a468a15479a08a28eb00ca743", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343182, "uuid": "e6645dfd-8a5f-461c-9c70-5581e6e99b11", "comment": "Malware payload (Grandoreiro)", "value": "722fe27fac9fbe7a6fbf00f8ae02cfe9c224e27b0d0b35f037b8f6ae470073e2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343182, "uuid": "ff676948-6b81-4c9b-bd4c-0fd1f484d2da", "comment": "Malware payload (Grandoreiro)", "value": "c819e6d2e7deb2f256faf65238d74b30d66f4111", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343182, "uuid": "7e9fafce-f79a-42b1-9528-7e2b67d920cb", "comment": "Malware payload (Grandoreiro)", "value": "9618e08169774bde006c33507c4dac187a34a74b45e92a819847f6f62e8b4ffab3edda9306a1c00dc48d6bd71ba4ad5e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343182, "uuid": "5334fe71-e075-4cb6-85e4-cdbd0eace033", "value": "T1EC362336AE854D9BC9948776712F3B225F3CE95B42CCB1C7789CC0463B4AEC5A81F0A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343182, "uuid": "f9c0b607-8861-4966-a5d8-3dd1b8be69c6", "value": "49152:yUXdsnkf3xegmqhNEu7as3Pog9f0eNAemzVwbzvlxaC6gLt+CNP:f3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343182, "uuid": "c7c91218-de44-4cd1-ba75-d45b23aed488", "value": 4927488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343182, "uuid": "23dce3f0-633a-41a2-92ce-49f63c585546", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343182, "uuid": "5646ebf2-ebe0-4da6-b49d-26c28a1e6cba", "value": "Ced-006301KGTN3TM1_Vrfc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d90172-0c00-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771333078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333078, "uuid": "35ffe134-b3b1-4e54-81da-dabfe206ae9e", "comment": "Malware payload (Grandoreiro)", "value": "ec5e640a9e7956f448a7ae8e82ca512f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333078, "uuid": "ada092d2-ab60-4988-a86c-4d97e35a6a7b", "comment": "Malware payload (Grandoreiro)", "value": "72e651008b5364544135d81b82fabf5076eac76500488a498e1de18c3807f39f", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333078, "uuid": "bd5f9dda-934c-41ed-9221-65e4bc29def6", "comment": "Malware payload (Grandoreiro)", "value": "7776194b09e6b84c14114e310eccf03caf48c42d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333078, "uuid": "07a15c2e-da40-4285-90f6-8d551d45dc23", "comment": "Malware payload (Grandoreiro)", "value": "e2e54eccddaadf529df843f8c5bc1086e430787190d63501a36a1c293cc42de4a0cfdf67ee09cdd75a96eceab91f36ab", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333078, "uuid": "26613c6d-84ea-4d77-9d29-3d3f4d2a4e98", "value": "T1E5562332DA562C86CAD08375B12F3A326D3C776347C8A5E3789C8187370BED6963D499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333078, "uuid": "0f6da1a5-f187-4143-b179-30cec5ec1ca0", "value": "49152:DVAZzxPPJtkx9fDVtpFPL/D5GcPYfECAWwPcjTfgSNhlwMAV0QxtCVz0jd92FR6H:hyvKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771333078, "uuid": "0d24b04d-f5b9-4251-8450-ca1ffe74c2f2", "value": 6268928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771333078, "uuid": "48fac189-b4ee-40fe-aefe-d58bc9830c4b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333078, "uuid": "753d24d3-4247-41f5-b6d0-f23c514daac5", "value": "0VldcYB1A8012604HRNR_2B4O.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0571d7e-0b9c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290410, "uuid": "f90969b8-ff5f-4157-b48e-aeb68f56cc9b", "comment": "Malware payload (Mirai)", "value": "3c674e0c151f8685de82b27021ddfb12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290410, "uuid": "0d6d12ce-b6ce-4188-a8db-bf7d954f3bf8", "comment": "Malware payload (Mirai)", "value": "735a0558cc6d85b3dd3353bfcb28308d8ddecb86108d5d40fd8a28f97bd56ba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290410, "uuid": "c7ed8799-e362-46d7-b302-22dc8e19f2a3", "comment": "Malware payload (Mirai)", "value": "f8bd273c1dd6c4bde903f16015b4def1491d0b78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290410, "uuid": "7361c4de-2635-4177-8704-33ea4921d8ab", "comment": "Malware payload (Mirai)", "value": "1d83b300cfb275ba84e7936c0420f27c6dcb6239bbe6f362c89eba6bdb8e76b9255b04b8632a63b3cb0e30c3c2fb747e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290410, "uuid": "393a042e-e5ec-4f14-8e12-f00760e41118", "value": "T1A3043C53B7324FA0D365D2720BB38B595AEB11811EE198D1936CDA103E206F9689FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290410, "uuid": "686b9687-c2a9-4d6f-b878-a36133e894e0", "value": "3072:knxBHuwe6Noa++Y/+I3c445WUN4k5pLF/6+Do+epL3:kxJumoJ+YVc4KLqkrF/6F+g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290410, "uuid": "96714043-6539-4779-98b5-f13a36cac1a2", "value": 184960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290410, "uuid": "2c903e70-a1fb-4a8d-9009-7d95b9922b61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290410, "uuid": "7a37761c-478c-4588-9d95-2109295c755c", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9416cb-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341805, "uuid": "6f35eea2-b873-4373-b7b2-4352f059e34f", "comment": "Malware payload (Grandoreiro)", "value": "2afda0edc08319fff2c27d73c5a748d3", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341805, "uuid": "cf658378-f968-49a2-87d7-be58932894dd", "comment": "Malware payload (Grandoreiro)", "value": "7453e5cb560d72b53386b9a0b61041c0041f6212565537d0b756ebad20c20641", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341805, "uuid": "cab8f9fc-5082-4813-b176-a492e4759912", "comment": "Malware payload (Grandoreiro)", "value": "ac7a78193d3d9bd9d8bf87845d3fcf60e061935c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341805, "uuid": "95fc451b-3a56-4d36-adaa-dc71197fa950", "comment": "Malware payload (Grandoreiro)", "value": "d2d0f9ddd8e0534e43030657eaba5c0e4e94140894cbd011beca7bf8922c6e4cd5e6d1e581e4bc536ebf4dd0a24cc797", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341805, "uuid": "77338bfe-4aee-4c1f-bc74-dad42d6363a7", "value": "T1F3B63330AE911CAACA948236B06F5F295FBD3B474189E0D7549C70C72B5BFC1C53B4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341805, "uuid": "4d61d638-9d70-412a-b0a4-831f3d6f8ef2", "value": "49152:bVJzsPCOB881F0+6SM18Cn6feqEtzmdfn4782xQZ4phQvF2YFROEig2NIDJDsYKu:LfkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341805, "uuid": "27a91f2b-58d9-4c10-830a-2e01987b71fd", "value": 10588160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341805, "uuid": "cdc242c5-a93f-4062-9b73-2017baadd9d0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341805, "uuid": "d82803b4-c948-4853-80d8-2b8dc9b4462a", "value": "MTMFFTrf-496371C74PPTXEI502408rhmkhd.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee7fdec-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341813, "uuid": "83ceca14-c6ef-4568-b646-b3da4944bd35", "comment": "Malware payload (Grandoreiro)", "value": "7fa9143d57afc1154aee1d10aa9dd0cd", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341813, "uuid": "425ab34b-38ab-4c6a-a1a1-618f87413a18", "comment": "Malware payload (Grandoreiro)", "value": "7467d5bd69228b41bb30bc1acc9108071cfbf7a9277b9a344bf541ac2f2f0020", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341813, "uuid": "8c81527b-6f13-46b9-9a1c-08ed4ccf8960", "comment": "Malware payload (Grandoreiro)", "value": "ee4a47c21d6f2e511cee408bf7b47f85582b053e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341813, "uuid": "45fb8f24-9ac4-443b-b91b-28f14974173a", "comment": "Malware payload (Grandoreiro)", "value": "3cafd0794392704081bd691751071b31a665ad0ddd69b2885382094f5f7bc4c9336ed33677ebd40b23ed193a498a8bc3", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341813, "uuid": "b112a6cd-a972-46f6-826a-b1d891495618", "value": "T1B6B63330AE616CBACA748338B16F7F3A5F7D6B43858DD2D559EC6083224FB81412F459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341813, "uuid": "1ab25cb7-006d-4ecf-bb64-cc61a8af08ac", "value": "49152:ioLqJHRjois72XREKGCdJGOhkBEAEI6WIN6xUHfI+KIpscQqxDam7x8OlXoHjdgy:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341813, "uuid": "b351c90d-30aa-45a2-a407-5da70146d276", "value": 11032576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341813, "uuid": "96e9fc3c-b275-43d4-8474-ef2952fb65ae", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341813, "uuid": "f66ae775-aef2-4b2c-9103-477f0815e728", "value": "Nmcl4D8B79745_LKMP.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6f2a3b-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313168, "uuid": "4da82394-d688-472d-88a4-f570b65c5796", "comment": "Malware payload (ChromElevator)", "value": "b04b3d68660f3db9e87f2a380a169677", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313168, "uuid": "e1a59f63-ac2f-4a99-b987-eec7c08752ce", "comment": "Malware payload (ChromElevator)", "value": "7578a9ff2b432f3fa9582d2adeb281eca73ce7ff73a48f8dbdc29c54e616c1de", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313168, "uuid": "9b7a2ce9-bd5d-450f-b716-fe1f5f3606fd", "comment": "Malware payload (ChromElevator)", "value": "dd6ecba8e6e31eeaf7d0cfd487f7c0f256478da0", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313168, "uuid": "4bee6569-f4e7-4333-9673-d6747e82d5fc", "comment": "Malware payload (ChromElevator)", "value": "c3d9a8d51fe88cc9ff38a9b3df2cc0e7c435ad186db92262f74502353c916d65fde2a181465121ac06e51d571414132a", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313168, "uuid": "38c88ba9-d35c-443a-91bb-c038d159834e", "value": "T1F696D75FA3D003B914B26214E58E75BEF312C47C5322D2382D5CE568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313168, "uuid": "6ada266c-ee70-41f2-b427-ecc6d5864491", "value": "49152:jffNURPQFQahpWN/dBTXkJ6qkq5LvWw7YEVNJBNWpvhAIryCRHOPnOEUEWmYW8f5:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313168, "uuid": "e3b6b196-7985-49c6-8cc1-168ea013a105", "value": 8703594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313168, "uuid": "703cfc3e-ea14-48a5-90dd-c5fbc2b8dce0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313168, "uuid": "b9e2cad6-3305-47b5-9c55-7bcbf8ac2dcb", "value": "nouveau_curriculum_vitae (14).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794d2376-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341749, "uuid": "32e68e92-2f33-4a6e-9d8e-2fc9a1a55fa9", "comment": "Malware payload (Grandoreiro)", "value": "ffbeffe6e4fea924efcb9d8b458b4db1", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341749, "uuid": "bd175d06-a339-43ac-8252-9cf7d3f124f7", "comment": "Malware payload (Grandoreiro)", "value": "76869281556ac2acaecdf0345e20400bde17be5097300131b6ab17a098d5b6db", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341749, "uuid": "2222c544-ef5f-40ba-90e5-dec1bd921bc0", "comment": "Malware payload (Grandoreiro)", "value": "56b23e3f9efdbad35c0ef100a098cd04578e40c3", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341749, "uuid": "878b7a98-d6e3-402f-ae7f-f671e18e182c", "comment": "Malware payload (Grandoreiro)", "value": "0d5485f18920169ba45996186d3064c70fad48be92f9c3622f57329ccc7db36a1f3ffd05c236779c24b655e70b0647ff", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341749, "uuid": "f41408ab-9521-41f9-a003-bfd241363208", "value": "T138A63331AFA51C7AC2644735706F2E285F7C7A23598CA2C3749D2583378ABD0993F4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341749, "uuid": "bb74455c-8935-49eb-9da3-d3545aa22189", "value": "49152:WURNv3VfNzGsnWz7JKnc/O+VVe+3KpG3IzspDktirlh0jiKe/fSpqv+bLspoFEDM:a6DO3f+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341749, "uuid": "f04749b2-50cd-45f2-a20a-a5e3bf8d8131", "value": 9480192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341749, "uuid": "6f8d7d8a-865c-4ac8-acbc-d82181975369", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341749, "uuid": "a3a9c3cc-1d57-40a6-9dfc-9b36d3375127", "value": "0Vldc1FY555818EJIJTR_02UBNQ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06430f1-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352660, "uuid": "98504708-c0bd-4ca3-97c6-16f5de979229", "comment": "Malware payload", "value": "9b13fbe4ced390fe61923b14bbb47b56", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352660, "uuid": "e74e14c2-6afd-4f1c-b8f1-657a3c08bb0b", "comment": "Malware payload", "value": "76caf5cd7d7b658b600eaace8d9bcf99f492935ad77b8126d226bea95d6764da", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352660, "uuid": "2627d3d7-c4f1-4dcb-bf11-4e6d9bee4268", "comment": "Malware payload", "value": "0b9725b9d2b7db15377e88c514898cbf22cc6e14", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352660, "uuid": "b33716c8-f27e-49b1-afad-dc6a04c3072d", "comment": "Malware payload", "value": "b8ad980b1dc8abe592f9c1069662c23624b8ee7624d225c839fe0effed39b5aa0869e8d96d27a77ab00d54d1fab21cb2", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352660, "uuid": "5dd37a45-d8c2-4a5f-bdeb-c4e325f5ac52", "value": "T184563332BE955C17C5508337B02F2E265E3DA4178788E4C2B5AC914B37CBEE2667F864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352660, "uuid": "ca0724fe-3fb6-4831-9b31-6e47ba66a3cb", "value": "49152:v8P9bzT1Ka2IB+a7BBFtwHO2x6QUjhCqr0eOtJsLfzelPIL/SBCHIFpoC+IEJiJl:3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352660, "uuid": "7948255a-9d11-4389-ad84-9923034d5a45", "value": 6293504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352660, "uuid": "a8829183-df37-4e19-82ae-f56258f5479c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352660, "uuid": "00e72b99-9e67-4983-ba0f-c48f542454b9", "value": "Trsld8386SSPR-85S98K.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f579aa-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356566, "uuid": "84252b27-8af5-47e9-8e03-01c6833d573b", "comment": "Malware payload (Mirai)", "value": "5e68736e487451f4fb51339e4905d0b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356566, "uuid": "3137004a-8c0a-4589-a11c-860408a4acd4", "comment": "Malware payload (Mirai)", "value": "777de9428f994ec792d4976eb94d27707269af0680f07d295157b20cc977ef1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356566, "uuid": "6db2723b-5288-4075-a6ea-10f2e9d30728", "comment": "Malware payload (Mirai)", "value": "1d2325da05477871653f5b25e5944d76b7cfbc10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356566, "uuid": "eff6f8d9-0715-4174-bfa4-688184094326", "comment": "Malware payload (Mirai)", "value": "0ff752a94504cfd22dec3da136255985db9f22b509e0ab87713d0b33b2e0b05aafcb7ced977de04365a5279285951761", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356566, "uuid": "ac44ea47-3c45-41eb-8a3c-c58c5019bce0", "value": "T197C3EA1E6E218F7DF769863047F74E21A75833D627E1D581E1BCD6102E6128E242FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356566, "uuid": "40d328ce-f723-49c0-985f-c64e982169bc", "value": "1536:sTx+9vD1LhTWTsgI2UeHvuAT0RXS593BsICTtazdjZjebbCewF64GWrnZ:vNlhCT6S59uICxazjebbCGWrnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356566, "uuid": "59a3c57d-ab2f-4963-b5e7-e74901d4e330", "value": 122400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356566, "uuid": "0bfb12f9-c0de-4799-9851-8318057291a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356566, "uuid": "f13dacf3-0534-441b-a5de-976830cbb127", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c55d3a6-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342882, "uuid": "99b7e48f-291e-4099-b116-107f38e850e3", "comment": "Malware payload", "value": "156b9790f321cd9cd6257627b4ca9806", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342882, "uuid": "06fe2c1d-9c22-4621-93e8-5238e1405f91", "comment": "Malware payload", "value": "77893eb5875021d4ba5d47564b04ce333eedf26008e12a3d56b7f48bdb7a2985", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342882, "uuid": "95f710fa-344e-4f7e-9454-503ef4f7635a", "comment": "Malware payload", "value": "81c65e7ff9a41ce5c7fea2a188ebbb11726459d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342882, "uuid": "2c145296-5add-4380-b760-1783917bd6ee", "comment": "Malware payload", "value": "ca6587228995d791abaa91d04bff292d0f3a4754cfeca891cd10931016efd988c7282f17832010444a5e05515f740dec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342882, "uuid": "bdfa924e-f73b-4dcd-9918-9209f9542eec", "value": "T1D5356570223980EEBA563540424C79DA7E381067E621FFAFE11D68F7A70727844DB7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342882, "uuid": "c3330d42-c37e-460d-8539-3e62fe5bbb19", "value": "192:Bdbxke97EGuAbYY61V5zXZnFmu5ciSOfmS91Wtl7t76NuGOpC7O0pvZIAvUb3pGM:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342882, "uuid": "d332551f-77c8-4180-b7c3-57cb601a75aa", "value": 1111865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342882, "uuid": "4e97b37a-9ad4-4cff-b401-4d32d813ab80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342882, "uuid": "c6394a4d-9ddd-46d9-9290-1446da8cb12f", "value": "Transfer_Advise_Swift.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9447b3eb-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290685, "uuid": "08d8bf3f-bb06-468a-8e05-15c95c1d423c", "comment": "Malware payload (Mirai)", "value": "2c1570e232fc47b2e2a6e29d70f1b386", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290685, "uuid": "6639d8ea-9dec-4ee6-83f0-dbb1becc47a7", "comment": "Malware payload (Mirai)", "value": "77bbe2634aad82a288388a0395ce8d3a3bb887ffb7b6ca47f1763d26240b3047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290685, "uuid": "0a4501c1-c3a3-47bf-aa36-81aa9f606a97", "comment": "Malware payload (Mirai)", "value": "51787f7a37cf2e1876d8df8bd628f7740a6a4de7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290685, "uuid": "d6f1790a-cb20-4ce4-bd31-3ce2612469e6", "comment": "Malware payload (Mirai)", "value": "07d6610a62387d6ea0656d8b94dc547b5b3d889cbfd1b5eb856b26854ae0bb316d20fa0e2de289674dbbc33ac64a3d3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290685, "uuid": "8ed4a5a2-2358-4d1f-b11a-03e844304ba2", "value": "T1E7A31A46B9919F11C4D621BAFB9F419933136FF8D3EA3112C8205F9427C69DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290685, "uuid": "b9be4ae7-1950-425e-8367-cedf4d38330f", "value": "3072:h4UA0Dk0BzIUoOa4SU/3NCrbDM7zHL6O+nzf3i:JA0DLIrOa4SU/3NCr3MmTf3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290685, "uuid": "4bc16d44-8fa9-4be7-b3bf-30f19db1b85c", "value": 105236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290685, "uuid": "e83cd497-7849-4293-a1a3-f6ab3d0a4b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290685, "uuid": "edd9e5a7-7bbf-4886-b695-4a1b6aa68540", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5a7f8c-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771349355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349355, "uuid": "e52661ff-f2fa-4f27-a0b8-2a8ef3db179f", "comment": "Malware payload", "value": "ec9ef719907e883aa8a489e707004801", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349355, "uuid": "7e63aff3-53c1-48dc-93f6-0942e738f206", "comment": "Malware payload", "value": "77cf1e4ab9006a436ba64fe3f78a94f9d7be4e81206e040ff422f64b5da8480f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349355, "uuid": "c75559b1-659f-420d-8189-bb391594342f", "comment": "Malware payload", "value": "8e59f4cbbf83ed2ef6acd1607873bfb8463e1f5b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349355, "uuid": "3af2f0d5-87e3-4ccb-aa86-ab4d4c603eec", "comment": "Malware payload", "value": "9b055aeb755405ceb2b958ff7f0247ce75725a177646fbb96851aeb8342537413b11f941a46dad36954fe9399bf15151", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349355, "uuid": "23af281d-9aba-45ea-ab12-ee33182c53b8", "value": "T1FED1FE35798A21F430CEC63E79E52101612AB10B75148D38B80FB1291FEE9A577F92BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349355, "uuid": "d23762f4-5ba7-4bd1-a8d2-36da32f9d210", "value": "192:uBW+El9s2JZITE6R/TJauu6AEaM4X83rxV:cWHy/9uqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349355, "uuid": "cc511a63-2eda-4cf3-b035-dcb5556bc17d", "value": 6421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349355, "uuid": "20938466-f18b-4548-a33d-84ff32621aa8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349355, "uuid": "6af96d44-e262-4a39-a387-a5289de7f2da", "value": "omah.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e8d286-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286787, "uuid": "b7c6a700-ecc8-4ad2-a2dc-4328d1486f56", "comment": "Malware payload (Mirai)", "value": "15034caa3f996618a0b5e970ef953d00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286787, "uuid": "11ccdf43-8c00-44ae-83f5-2610a0ca16be", "comment": "Malware payload (Mirai)", "value": "77d8721cd22e77550b4e0739c889238e684e31c8897b569e936f60812c8dc5df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286787, "uuid": "ae0f48d1-4ba8-48fe-ae9e-8cf3750077e4", "comment": "Malware payload (Mirai)", "value": "62a11eb93bb71bdf000f8f8cff9a4fb872c665c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286787, "uuid": "c081b752-0a9a-497b-bedf-6b0615f122c8", "comment": "Malware payload (Mirai)", "value": "55a17b76c2567d4235897455496f04a7fb699943d5f9b35ed2045d930b540a932bd9f672c0a50128af9a44306029315c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286787, "uuid": "da2ad1b0-092e-45ef-ba68-90df2ef8135c", "value": "T16303E751BC829A37C2E1137AB66E4A8D336167E8D2CF7217DD204B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286787, "uuid": "62cf12e3-8a93-4da6-b0a3-edb68459a956", "value": "768:kg4QCbvsG5f0OlnlUlQOBFdApwAUb9z/W56v+b8O7LDUXoTr/NwwW:kRbEG5fXlUlbH4aScv+/UELW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286787, "uuid": "9b14df4e-0b01-495d-a19a-908ac70fda6e", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286787, "uuid": "c0e48f2d-f644-4b23-a961-07a9881f55b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286787, "uuid": "2af3b11e-4b22-4d60-b68f-5118070c8577", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254376a6-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312832, "uuid": "de0ef2ce-12d1-4bbe-8c3e-99107eb6c980", "comment": "Malware payload", "value": "f75dd2c85f0978b0e8a94cf1be0a3fee", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312832, "uuid": "0595e700-feb6-4c82-92da-07726e52eaf3", "comment": "Malware payload", "value": "785d2108a081b1f7cdafd5c72dd028aab859246ad22eb75b11180de6f5237dc1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312832, "uuid": "7fe0527d-2158-488e-b7eb-e3f0b002b963", "comment": "Malware payload", "value": "01c10968821e9c42bdb2c3a0f8c7b9e630c8c693", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312832, "uuid": "69472d5f-f4f9-4a32-bb25-428a4b6a30df", "comment": "Malware payload", "value": "890c56868ed055fc82e37c839c45f7849803685fb68035b15a61dfb1eb02cd98f270a334d31e6862773a5b52f83df75f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312832, "uuid": "13e296ef-f49b-494d-b186-f1333754fda5", "value": "T1D04633315E68193B16A4873DB02F1B366FBD5C93818CC5C6578CF0873A99B89527F0BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312832, "uuid": "1db71e3e-d35b-4c1a-8cb5-37c4f016d3f0", "value": "49152:Yz6sQy5zfYlmZUeUt3WPo1NsLEM8gj6xktBRuy04wxWc3eLu9mBonPDrjWoOyccu:2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312832, "uuid": "9c8ade4b-22d1-498e-954c-f284ac5ec1b5", "value": 5620022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312832, "uuid": "1e69d433-72b6-485b-b793-e6e184761042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312832, "uuid": "11098a53-3cbc-48bf-83a0-02d92350f43e", "value": "Cont_Emit-ZGHCRC28916HJ99xtvs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f519803-0b9b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289710, "uuid": "6fd77323-6d22-4ccc-bfaf-05ceb8563af8", "comment": "Malware payload (Mirai)", "value": "3f6c85185dea62a6d9304184e36b97d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289710, "uuid": "76fac3b3-cc7d-48f8-89a6-24ed8fc00a67", "comment": "Malware payload (Mirai)", "value": "788f66d8272f17bf856f927b4be5e1aa1d5c91c4793d47c5aa31347a4f2c7f7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289710, "uuid": "a77d8085-ab20-4a46-bf0f-d27348c30166", "comment": "Malware payload (Mirai)", "value": "b3153090a50d9618fffa6c7be05014ab08a6b8cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289710, "uuid": "38b5becc-66e6-4b66-89a2-1ac1823af72c", "comment": "Malware payload (Mirai)", "value": "b024abc36672095274bf7cdf71a95a99f1af491e77b8eb09af466ec11300e11188bb3deae5c4ca2d895d478851c1f4c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289710, "uuid": "c78a205f-6fdc-4550-ba8d-c2f4ac441671", "value": "T17C734A45BC828A23C6D112BBFF2E528C372653E8D2DB3207DD255F55378A86B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289710, "uuid": "e27a06e1-9b2a-458c-9c71-3c889ade14bf", "value": "1536:WgZE3aZW5y5c/B98zi7dLxSapFmulCqMrPv5QB0RrhFWYR8MOfsu7+601vHnzv:ZZE3aZ4yM9Gi/DTngq6v5CshFW2LEENT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289710, "uuid": "a258d05b-0d7f-4214-a507-31dbf58c1e73", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289710, "uuid": "b0a95a55-15e4-413c-bc41-a8063bb6e383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289710, "uuid": "693b9071-608d-4ea7-bd85-71675dc74401", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d38f63-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352317, "uuid": "fa783038-91cb-421c-8d12-0f69e28f0d22", "comment": "Malware payload (Mirai)", "value": "3bef90001a37b7175e1856b070862e4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352317, "uuid": "a214ef9e-fa01-4eaf-836d-3bf40c8612cd", "comment": "Malware payload (Mirai)", "value": "788f9fba2f932671602cf2f3fd480c507640f82340406ccee7f778781c168a8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352317, "uuid": "a55ca8c8-4248-410d-a44c-cf27a0d5ad1d", "comment": "Malware payload (Mirai)", "value": "5cffce248feb7cf3481047ba584f15ce23b7a0a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352317, "uuid": "2a6b44ec-d74a-4a03-968e-bbabd9788871", "comment": "Malware payload (Mirai)", "value": "3c6da7af10f23500e0b4e0ba682ac9483cf18e72122a839cb8bb0fc4da2aa9ae0748747c5675228c9e198e6ba4142bc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352317, "uuid": "137a37cb-9f19-4c74-8903-84aa69c80438", "value": "T15A334A22B87A1E17C0D0F87A62F78729B2F50B0F25A88A5E7D620F4EFF214D0555B1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352317, "uuid": "5d9909c1-b6cf-4eb0-a8a9-5b67a229e602", "value": "768:cToWb7Qmnahyq9C9Z19G02roQ/7zMR4TAPKOO+hdmHFaR:cT9z5SC9ZjG02roQ/PMRq8hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352317, "uuid": "2cf68d63-00af-485e-a8d8-34ffd8dffefd", "value": 54716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352317, "uuid": "895ba03a-5031-49e9-8ad8-d753dcd7cf2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352317, "uuid": "4afe795a-31c7-4617-a9ba-31bbdb1a83a5", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc341e3-0c34-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771355424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355424, "uuid": "740e3050-907f-4b32-8879-e49bc5feee18", "comment": "Malware payload", "value": "737e16aa162112b6cebc754e72611fcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355424, "uuid": "d24330a1-4236-4f23-afc3-1e0344ff638e", "comment": "Malware payload", "value": "78cde910c94a6f31db8e781da1996ca4be0c434963c31c50a7f03735228290a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355424, "uuid": "08135b68-d96b-43a7-9f33-af818adaad95", "comment": "Malware payload", "value": "202e17edb4220af96b39b73f318925494676e53c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355424, "uuid": "4c0201d5-ae5d-462e-b79b-81f849e0c641", "comment": "Malware payload", "value": "f280a5473c217c05786d6c7329f221e7b065dbea4738d27f5457c918d11dc58aff03871ca9ea99082e54e272d01d6956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355424, "uuid": "729a4832-b27c-4433-8f5f-3b005519a5cc", "value": "T1FD95D023B24E733EE46A8A3549769E10583FAA61691F8CA7D6F40D4CCE2D0601D7EF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355424, "uuid": "4f2851a7-642f-482d-b5e6-4c05dc5afe42", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355424, "uuid": "c96f116f-3c51-4a40-9c57-8842283dee16", "value": "24576:4Xkwbj/TcZiYT3a9rgS8uOwSu6zf5+y8flOAotdsVjrrIt2+yOaiV67YRewYJnnE:4nfhrouOZf98dVcLyOax7QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355424, "uuid": "4d090f35-691f-4cd7-8b64-b6a68f6f75e1", "value": 1957728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355424, "uuid": "befbdf9e-5bdd-4926-ab2a-5366ea03eea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355424, "uuid": "180fc84c-2ae3-4e98-89b0-bc717795e4d1", "value": "mp3tag-3.32-installer_mK87-e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f1c25f-0c33-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355036, "uuid": "bfd1df7b-55d6-4df0-ba86-f0a8516d99c9", "comment": "Malware payload (Mirai)", "value": "c8db1ddac02baf4d2d49a11eb7ca22b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355036, "uuid": "4c7bf0a1-2c3c-4fda-b70f-ab04f95afc1b", "comment": "Malware payload (Mirai)", "value": "78f538eb0cfe15a3e91abf300dc80724a15025d4466b1a70c17bfdb3d0d985e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355036, "uuid": "053a960d-cc3e-453f-9e9d-2a86393613d0", "comment": "Malware payload (Mirai)", "value": "95cef1049980e25fa1643e91f98e474c135c653d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355036, "uuid": "d750ed23-9590-4e07-892d-bdb48fae1106", "comment": "Malware payload (Mirai)", "value": "a22ac3a6b2298687af109beaaff5bbf56d129f3b4a6e02adf6a60dc46c8b0d1308289998982810d97ad984378b5bd055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355036, "uuid": "6b88ed00-b175-428b-8b1b-c83b34a20d61", "value": "T1AE93BF63C8646D94C6540275B464FE3AA373E9006A931EF716EACB769047EDCF80A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355036, "uuid": "1df859fb-5462-4608-81a6-0b0ee71a2ced", "value": "1536:O/Lx8llQ6liPvaYZew+A7+c2aGYKf7747xl7XKCIxEt9EI8XV:ODxal1EPiQeq7EaGffwH7XKRyqI8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355036, "uuid": "0c0c6cab-80ba-4fb6-9584-28ea56dd50e1", "value": 93268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355036, "uuid": "83961e01-2016-4539-865c-5e0fe8c4a6fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355036, "uuid": "b35267a9-a270-46c0-b388-5381be53dfc1", "value": "m9x7k2v8b3.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6fee26-0b9e-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771290911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290911, "uuid": "512782f3-b197-4fb6-91cd-b8745fa0a7fe", "comment": "Malware payload (Formbook)", "value": "4cf79e655c7be81f8c58d261671fa917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290911, "uuid": "04d8c5cb-e34f-438b-a746-c0d6fb9d1c38", "comment": "Malware payload (Formbook)", "value": "79dcb6bdf84fdae64873b6fe27c9d52bf30cb4d7c545b13035cfdbe4adb12182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290911, "uuid": "5debb4f8-829e-4b63-85df-cc1c1d5d51ab", "comment": "Malware payload (Formbook)", "value": "c517be80bc72c211e3e696b16b2f3364319e8994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290911, "uuid": "7a707147-d9f1-44c3-9342-817b98c572da", "comment": "Malware payload (Formbook)", "value": "ee37816b8e1c0962fef9bb8be9aa7bc37264bef9138242cd1923ba67bebcfa852f3cccd2b44f11315fb89aa1eb014c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290911, "uuid": "ced662f1-4a42-431a-b0ac-d8a78290e1d9", "value": "T11A45BE0273C1C062FFAB91734B5AF6215BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290911, "uuid": "a45cc7a7-f62f-46ec-8e8f-a1928807c6be", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290911, "uuid": "6326751b-af71-45ce-b066-cf827a81b821", "value": "24576:q5EmXFtKaL4/oFe5T9yyXYfP1ijXdaO72MryHKbYM3:qPVt/LZeJbInQRaO7MHQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290911, "uuid": "927530e8-aa63-4cf9-8797-f8716defd597", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290911, "uuid": "baced0a4-f19b-4550-adc9-d7c2d9222abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290911, "uuid": "a4013251-8549-4522-8286-56a17c867275", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33990096-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349363, "uuid": "ec6f165d-0698-4fbd-81e1-61ff5f743a0c", "comment": "Malware payload (Gafgyt)", "value": "31efa5cdade72570ba8470a69c6c9821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349363, "uuid": "f1acd1ef-bfc6-4729-bb94-5085ff280b7f", "comment": "Malware payload (Gafgyt)", "value": "79f0145ae64862b8224f1dd181a053273649361277b148dc6e058fb410de6da2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349363, "uuid": "f1b925f1-d0f2-4877-bcdd-e507a02b658d", "comment": "Malware payload (Gafgyt)", "value": "2ab66ba0b721c1aee2336e550b72f853d0af2624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349363, "uuid": "31496147-a2b0-48e5-9776-016e68d58a79", "comment": "Malware payload (Gafgyt)", "value": "7d3c0e0825e317a07115323b1c52a630e1e437ab01c77dcbf574c7a6dc941978ebf8620ac8897ffbafccaf6ca7fd04a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349363, "uuid": "e1d344a1-ded6-426a-b16f-9050fc810956", "value": "T12BA31744F8448767C3D327FAE78E439D7735266457D733116A38AEB42BC6B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349363, "uuid": "e8d2bf2f-9e67-4819-8cf9-af9118e8a061", "value": "3072:vlXmjWRiQ6wf44YY873GdUmpEqQ45vVXY0X:0ji6qnYY87xmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349363, "uuid": "224fdd67-1600-4c85-bfb1-b264c775530c", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349363, "uuid": "c77c2e17-d147-4570-bf3b-2a50aee03a28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349363, "uuid": "2c2f7b8f-e8e2-4f5e-8c4c-5e07cdbdf5d5", "value": "armv7l.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c5df3f-0b9b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289964, "uuid": "19846195-e512-478f-b559-0491ac09b2c9", "comment": "Malware payload (Mirai)", "value": "4ca5991458603938ca46a53d0fbc4bbb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289964, "uuid": "cb21cee4-5632-45b3-8664-71c915337eeb", "comment": "Malware payload (Mirai)", "value": "7a24ba92d014446a7c74cea78e90b01787778f58977ef1b68db17013253e57c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289964, "uuid": "50ac8eb2-ac3b-468b-bc1d-4ca3a78ad552", "comment": "Malware payload (Mirai)", "value": "db04f64508de435c88f394ef65ae9f430cbd7b35", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289964, "uuid": "9154ffd6-45e0-431c-ad03-53a294017f99", "comment": "Malware payload (Mirai)", "value": "96b3b8228af4d382ea5dbb55bfaff3bc114e3002762d99824a2abdfa93922fe212d51f83af391578783978238fe7ff70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289964, "uuid": "7c4cbc5a-70f4-4260-ad01-26aaf50d5bec", "value": "T1BBE07264105631963E430E50762BBBC231806C45AA10062EE3B8BE234CBCF017B0E831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289964, "uuid": "c63275a2-c17f-4a6c-b286-76c11060850f", "value": "6:hdc4UJ0OXOZYzBqlQXZRlzTjafaqUZtL57bNwb:XyOZYzYlE/jaC3THGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289964, "uuid": "33f7d32b-6d78-402f-9dca-1d1993f4af1c", "value": 331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289964, "uuid": "6653a9ab-2481-4ba4-90dc-1f860befafcc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289964, "uuid": "0a7b9fa3-0ddc-4a64-be47-71e9bd99f22f", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e899369e-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313160, "uuid": "453c49b8-48a3-493f-9264-6c001e1b5f33", "comment": "Malware payload (ChromElevator)", "value": "44ea15d4679f1372416654b7cccdceee", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313160, "uuid": "3f6ce23d-fb77-4853-b235-f1c9b304dec8", "comment": "Malware payload (ChromElevator)", "value": "7a76eb82b564837c1bf43883a1d93ff7a2e9a56ecb0f093447593329e5200492", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313160, "uuid": "8a97f72f-7d93-4ac1-8b1d-b537be9f15a4", "comment": "Malware payload (ChromElevator)", "value": "ca2fa7ffd9264ccef5536fada3ce9491adb4bcdc", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313160, "uuid": "cb108aa9-9ff0-4f13-8736-498db9e50d04", "comment": "Malware payload (ChromElevator)", "value": "7298c97c71ccf3c2538d74c4c78bd40f49db75c709ae8a998c1d2bd5109a05ded09dd5fbbb1d76e2d1a6190866ff6df3", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313160, "uuid": "44386f3e-84be-49d7-bafd-892aff6aa541", "value": "T17196D75FA3D003B914B26214F58E75BEF312C47C5322D2282E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313160, "uuid": "dbfcf98c-0c77-4464-b50c-d2ab027610a8", "value": "49152:ldP1Y9W5vrStklqrlKFyC1wbc3IPYq7PNlcpjazUb5nOocSeFrUSbbM2t+K1HSgN:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313160, "uuid": "53737799-b07b-4cc0-b529-9c210d4138eb", "value": 8696269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313160, "uuid": "54d311cc-ff99-4210-9d62-709502624f3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313160, "uuid": "a4cf3ba6-d950-40a8-bf70-4b070494d9b1", "value": "nouveau_curriculum_vitae (13).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59431d40-0c13-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771341266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341266, "uuid": "db365ca9-6eef-4449-8926-b5ea4b761c21", "comment": "Malware payload (RemcosRAT)", "value": "059444e61c069767d9c0feeda15db732", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341266, "uuid": "c90ce9ae-a1fc-45e8-a4a2-ef4f27aed7f4", "comment": "Malware payload (RemcosRAT)", "value": "7b2132f424a6ba38309962734cf1a07e3c47ebcde4f3a305f84d9a5933c10b3b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341266, "uuid": "4f2141a7-e285-4685-90c1-a18d134b2e69", "comment": "Malware payload (RemcosRAT)", "value": "959b24693eb3c879f0680c01f08a3a70a5b9d693", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341266, "uuid": "f7697133-476b-4524-bac4-bde876d92a81", "comment": "Malware payload (RemcosRAT)", "value": "3d7211a34e2b99d5150b02fd7feb89fabdd941a4df6f524a20214a818fea55933658c46297a246aafcfb52043bb54e8c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341266, "uuid": "cf3acb59-e48d-41e2-90aa-18475dd39593", "value": "T105B2A4084F4A0E91990322BA0D191834EB7B87776139B51B7F2E7D6C1F3164CEA9C6DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341266, "uuid": "6ca8d1cb-5f33-4755-9004-53dbc04b5709", "value": "384:lymj5Pn025a/A1+wB2UaT5MMJyV51BY6BZ06W5W1oyX:lymjN9125NEVu6Q6WcHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341266, "uuid": "fe56f3e9-ea86-4b5d-ac60-d7e7a04d5a9f", "value": 24916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341266, "uuid": "d0452060-aed1-4595-8101-6d8df4f2c53b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341266, "uuid": "0dd47a78-2259-4885-8412-5aea36c30771", "value": "059444e61c069767d9c0feeda15db732.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c508e8-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342868, "uuid": "6042b655-d9cb-4f9d-b06b-91a508446519", "comment": "Malware payload", "value": "0b7bee6a6400a16441fac4b579cf3149", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342868, "uuid": "cbe1f208-d48a-4e0d-a543-bfb30f24b305", "comment": "Malware payload", "value": "7b8834b2df5a8ec3455c62f3814192d1f772742020a284f2c1de6923c6331b7d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342868, "uuid": "eb0818c6-38e8-4aff-830e-08d71dda5962", "comment": "Malware payload", "value": "34243275acb063b4b85c9e5ad75d40fec982a8e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342868, "uuid": "cb3c8529-dac5-4280-9d33-31b19d1d0f94", "comment": "Malware payload", "value": "cdf82ae2a204590a8b6f45e4ea4a32fa1aedf2102a838cd215a3d14c9eac5c073ba84ad503ea97351ccc8e2c7d3c6fd7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342868, "uuid": "2b8821bf-a429-436f-bd5c-085281447a8a", "value": "T1D83512FB0B1B4EE4C04AEE3E4920336A5F679061BD93AC0C9034DB9E59D7711FAA5634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342868, "uuid": "ad9d374b-8dbf-4750-b02b-8c4d45dcccc2", "value": "192:0ggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggi:VPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342868, "uuid": "4e3248d2-f3cc-4eba-93b7-d8166395d6fc", "value": 1114125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342868, "uuid": "0c34dd09-7fa4-4d7f-b227-11a624061ae9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342868, "uuid": "4030d2e0-4817-45be-b360-4f049a6274b8", "value": "0b7bee6a6400a16441fac4b579cf3149.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e38302-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343198, "uuid": "b69a7176-76df-40f8-a4c6-f4e5761ff0fd", "comment": "Malware payload (Grandoreiro)", "value": "6581d1a913894c1ada9f0f5e6858c4d7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343198, "uuid": "cd413eb8-d583-4028-b303-c1f63f10a94a", "comment": "Malware payload (Grandoreiro)", "value": "7b8b4f0b0b732442f8d0c98b4b8be81833626bb8941f51b2cac5db67b3e39e59", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343198, "uuid": "9c855c35-aa93-4578-b551-9ef747bafa00", "comment": "Malware payload (Grandoreiro)", "value": "d8a8964d72d91aa6b7eded3e5a98e2cc6b21bee8", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343198, "uuid": "f7c69791-fbfc-4f18-81b6-db1aa8bf9867", "comment": "Malware payload (Grandoreiro)", "value": "ed1fa3b558a9318b939f633b18d3abf3c51da01771c107e306e2d9d9c47b0ee8491bd42897fe70d9705f2b77cc100098", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343198, "uuid": "d62736b6-f974-4495-b403-2293a3bb257e", "value": "T103362336BA05886AC64103B6B42E67255F3D7727858CC6E1BC9CC217330BFE6D62F499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343198, "uuid": "db68a12d-15b6-4782-bdea-908f114c9b9b", "value": "49152:ehDPzmL4nD86vNcaJ9sve7Yw87yvnYfXggCQW0a74y1lt+S3cQw1xJFQXA2VQpdK:Pa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343198, "uuid": "6f1ca472-6a12-4ecd-90bc-125de765108e", "value": 5042176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343198, "uuid": "aafd4eaf-fcae-4efc-9fed-cffa0aa58036", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343198, "uuid": "1447a4c9-75f9-4df4-93e9-4cb9b9581922", "value": "FljSLLBA615221-29768SGMSJ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848a7f43-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286793, "uuid": "dafef13e-5d31-4681-9426-177d86cf53d1", "comment": "Malware payload (Mirai)", "value": "16975dd7b97bbb01c082a526a543dbf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286793, "uuid": "19e46760-9529-49cb-84c0-4ebfdfd04960", "comment": "Malware payload (Mirai)", "value": "7bb574077868abf5750ef9bd088acdc8e7705c91a4a85ff6db0a7827a4f1a9b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286793, "uuid": "6462cbd2-1c91-4cb9-aa89-f25d4f4365e7", "comment": "Malware payload (Mirai)", "value": "ed83a546c67b8a441cb220bfe732d12e948f0d39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286793, "uuid": "9a3c504d-44bc-4cd0-8751-838e47ca1e15", "comment": "Malware payload (Mirai)", "value": "b4e4c5b1ce0ee07bf45e9f90011e5e8ef6ca3f06665563536ecc22157dc8efd40f9f19817bce13ef85d9b62639f51cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286793, "uuid": "e1db9dd5-4f31-4ba9-a154-1e7711fbbd28", "value": "T188632851BC819A13C6D1127BFA6E028D3B2623E8E3DF73179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286793, "uuid": "d616f026-abfc-487d-ad6d-4b617f64008c", "value": "1536:iNSlxAmiik110lOO//kWUjRVisI3AA8PNRu5AvbW4:iN/CbkdlVisI3/+Vbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286793, "uuid": "8a43c26d-6275-427f-a296-52f79716f429", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286793, "uuid": "2378f79d-68b7-43f3-bce6-b0009a299048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286793, "uuid": "22a7b896-f9f7-4db6-bf29-005d47a717b1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e770b5bb-0b9b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289965, "uuid": "70cce34c-4b42-40ef-acc3-9b435aa005a3", "comment": "Malware payload (Mirai)", "value": "2808f2da7b5aa2af444c415bedb760ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289965, "uuid": "6456ff61-edea-42b6-a58a-902296c49f5a", "comment": "Malware payload (Mirai)", "value": "7be8158bcafce0606b388ced9fdc6cd12e43136090c2e73f9cfdd96b5c756a9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289965, "uuid": "9ae49e05-94c9-443a-895a-f9581ab381c4", "comment": "Malware payload (Mirai)", "value": "88069cf55890b3ebcf727c45c25d51ef3e5ad5ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289965, "uuid": "2d753f32-2c41-41ba-b2a6-238b8d8ac1bc", "comment": "Malware payload (Mirai)", "value": "baf39974f9ed9b68be7635ea427ffd02b41e69b7d2778b11d561b4e1c550d389c7d78073df2f35fea61ca7b5456826ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289965, "uuid": "9e9198c8-4ea6-4e76-bc71-7d88bfc4e138", "value": "T1D8435BC5D553D9F8DC1015393077FFB25A76E93E1028EBC7D7A8A932A942A03D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289965, "uuid": "2ba24a90-aebf-4ac9-b5bc-a8203da16d0f", "value": "768:R3HT2eWvWWgb3sHazDDbraXqNmpQ20U/HYznpWYdTZVZtOfxcX2K:RD5Wgb3OazDnraXqoz1spWCTZVZt+xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289965, "uuid": "3d15d5d8-6fd1-4193-b10b-b1c33f8a15d6", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289965, "uuid": "25bd0a01-106b-4254-9e4b-e45c74dffed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289965, "uuid": "29bc5d6c-bda6-4302-8de0-b71b5376c56a", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4914bc-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349356, "uuid": "8c0e98fd-cf88-481c-9d6d-7afa52376f7e", "comment": "Malware payload (Gafgyt)", "value": "6df52f035aaa06de3a74207d8a8fb0f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349356, "uuid": "1983f75a-fa84-4c81-a736-1c492308f9ca", "comment": "Malware payload (Gafgyt)", "value": "7ca275f5000ed8e03c319af0c6b7462f3c648599f7512d7504a0d12669377987", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349356, "uuid": "2e26e789-ea96-4cdf-9251-149e04c3d171", "comment": "Malware payload (Gafgyt)", "value": "826dccb1ad91ad004ea785a39fc39af7c89b0978", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349356, "uuid": "fcdfeaed-1b3c-4e86-89c6-2ea112d70c1b", "comment": "Malware payload (Gafgyt)", "value": "ada7c54028ed1a2e699ceab614633e5856de2720b845a2ee8a646ce8d2c9dbbfd8c438a5cf433c78eedc6d10ae25a2f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349356, "uuid": "73723574-04a7-4ef8-9302-bb3b8d6c950e", "value": "T17AA308A2B800DFA6F40BE77604D74B24B630FB650F535626731739A7AE762D42823F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349356, "uuid": "601deb35-a8c8-4ef6-acf7-df9f1117de50", "value": "3072:lGdUm64AM1fbns+TNX4pKVystbk+WmU9VqFyOfk/X:lTm64N1fbnBTrysW+WmU9VqFyOfk/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349356, "uuid": "b583c34e-d2fe-45b6-adb6-42c409cf00de", "value": 101814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349356, "uuid": "54624047-0c3e-403e-af21-5f3141d16fde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349356, "uuid": "70ddc933-83be-41a1-bb03-42a8f27d3618", "value": "sh4.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd85cbd-0bf9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771330000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330000, "uuid": "4f90cfcc-7f66-4e25-9bc8-e23fff8c9f53", "comment": "Malware payload", "value": "07b04aa432d386ac86a7ddd08fffd889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330000, "uuid": "801fd887-155b-412c-81d8-4388d5320665", "comment": "Malware payload", "value": "7ccae21531d32c23ab3732d65cbb39d5305edc1a292b2c874e46e28cf83cf80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330000, "uuid": "e5d8b3e1-69f6-4196-8849-0d708279aa2a", "comment": "Malware payload", "value": "5ffccc010006dfc5835f7e3bb67f41c6165eda0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330000, "uuid": "b67677b3-4e06-4282-b4bc-73e19e03bf0a", "comment": "Malware payload", "value": "a302430c0541066e6a49fcb6705763f58bd998b1f9ce46e3c6c2cc98e51e83048a839a2b179f0ac1d25e0e679c08958b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330000, "uuid": "02b1f9c9-7ecb-4cde-a51c-10f2e72eabf5", "value": "T1AA7633A5E3B008F7F837813AC057DA32D662BCA65760C9D383E8977B1F136C1593964A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330000, "uuid": "25a15170-3d12-4d33-8eff-e677cf03354e", "value": "33742414196e45b8b306a928e178f844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330000, "uuid": "8b9e3a95-2a1c-48a6-90a5-eba2d99ff549", "value": "196608:fg1qWQ3k0MhC85r3uO1Z3JXLtnSEVkh1Ck:13klAAr+O1xptSfh1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771330000, "uuid": "4133a9ff-9bf6-42b8-bc84-ffc05cdfe0dc", "value": 7739945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771330000, "uuid": "33da72df-4b42-4d27-a53d-afcd6101f3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330000, "uuid": "0d06049d-4e50-4e29-980a-4292317c5cc6", "value": "np.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3edaeb-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348390, "uuid": "3893bf0e-fbb5-4424-b186-847b4ac24a70", "comment": "Malware payload (Mirai)", "value": "42beef63239b3c7e91a139b180f06dae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348390, "uuid": "f4f0349e-1c73-4c44-9043-8a9669e2766f", "comment": "Malware payload (Mirai)", "value": "7d30f8f3ca466a1030c6d2ceb309df54ac2576601c93955ab26a75100f29d0f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348390, "uuid": "2920030c-3ad8-4f51-9e2a-22964ee88597", "comment": "Malware payload (Mirai)", "value": "32e35fbff436694efddb5f02d9c491ab3a92ff75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348390, "uuid": "3d362fc4-12fc-4fa0-bb27-4bffae7dc160", "comment": "Malware payload (Mirai)", "value": "5dbff504a7e01cd9dc51d71dee246a14c8f605bae31f08963afc6062c6e7a3ac84262d91791abee04937a9e0e4cd0105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348390, "uuid": "020ae08f-53a7-4f88-8e94-f1f9b1074997", "value": "T133C4CF93F6705ED5C01D4AB454BED2308B89E29713877581F6FE82002C6B56ABF9FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348390, "uuid": "f271c1d6-d129-472e-a853-d03ff1d6aba7", "value": "12288:GmqG3UsALedu3sB9quj1xLpm121VYoLRk3QpIztso:8YYLeQeqAlKoe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348390, "uuid": "902537b5-cee4-4909-8afb-f7c1cf7928ff", "value": 594600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348390, "uuid": "82305dc8-9f9a-417d-a629-d40ad9f74295", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348390, "uuid": "53f57d17-04f1-451a-82f6-ce11dc95e264", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620928d8-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342140, "uuid": "8cc03f36-edb6-46cf-9486-3d661086d6dc", "comment": "Malware payload (Grandoreiro)", "value": "a2784929fc202452cad8f0fee126fe00", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342140, "uuid": "4eb12314-042a-4598-95cb-d47acc127499", "comment": "Malware payload (Grandoreiro)", "value": "7dd0710ed4d7827320afd73e6f3dc5162aca53e3dfdcd54eed2f61e7334c4d09", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342140, "uuid": "8b3e7b37-2c5f-4a99-986c-13e6917bb8a5", "comment": "Malware payload (Grandoreiro)", "value": "bc3687926cb4e99f0c1b146971e0dc61fa9b079d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342140, "uuid": "a6454e5c-c6c4-45a0-a0a0-c59137aeb02e", "comment": "Malware payload (Grandoreiro)", "value": "3b5e1dbfeb1c166da8c9844128beaf8293939214822f1db5f61152221a4eacaaa5feadeac32a74152f95477153f5c156", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342140, "uuid": "35193388-8eb0-429e-9c9f-62acd297969e", "value": "T105663332BA652DA8C42083B1B13F3A351E7EB61346CCA5D3298D825A7743ED7573F885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342140, "uuid": "ee7c5a97-8e79-4c8a-8105-6b223095cc8d", "value": "49152:fD4vPcaJuBu2tWC3jUiPLbNHzbnikt09dareJ3ORUraoo7IR1tO7K4LZOJP3tlHc:Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342140, "uuid": "c91baafe-d7a1-4a36-85a5-7f69f776cc56", "value": 6526976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342140, "uuid": "a745a4c9-3dc6-4a7e-a804-933a62610f57", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342140, "uuid": "a651faeb-ee19-4b85-8260-8bf1bcddf6c8", "value": "4233V70I_DncYATBEP-536513DOY7upivhz.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98d8ae3-0b9e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771291230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291230, "uuid": "5a457f16-da8d-431f-8db7-f79681359271", "comment": "Malware payload (Mirai)", "value": "a5b9355474856489517743cf473ca413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291230, "uuid": "a0439d4a-08c0-4ab8-bcf2-f632f728f994", "comment": "Malware payload (Mirai)", "value": "7e39aeb20a38ec892ee72276c05bd40a342cd3ed14a8422454f58b4cd228d5ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291230, "uuid": "06071946-a565-418f-9cb6-a88fde084695", "comment": "Malware payload (Mirai)", "value": "2ae0e19fc19af1a0852f44ce10561109ce01323f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291230, "uuid": "4bf99846-2ef3-4d1d-beb3-9764c2f9e043", "comment": "Malware payload (Mirai)", "value": "29f2fde9035e606217fed279094bd56df85180abf2dcc888a4b374b1dc024adfb61bb98cf30c017b33404b72d02ea834", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291230, "uuid": "e305be84-0c1a-4ed6-9fa3-a70ef6badb5e", "value": "T150D47D5277218F64E361D57105F38BA19AB521A30AF395C2A37CC6207A50B7D2C6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291230, "uuid": "69b6a6c4-ccc4-4bf0-92f0-741f0b318b29", "value": "12288:Fca48X/o0XiMaNdiXJx4cBGm3zAJmgpjytsQj:S8PA04cBGm3sJSsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771291230, "uuid": "4d61e098-5293-4c24-9905-d841efad61a0", "value": 597936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771291230, "uuid": "d29203e4-1ba2-48b2-8313-70a7822e5d33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291230, "uuid": "752bf5f3-f991-44f6-be0a-ddd30c541ec1", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44de06cd-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1771312885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312885, "uuid": "6e1bc70f-68f4-43e1-b74a-f9d3e1478811", "comment": "Malware payload (DarkCloud)", "value": "5bf56225637287ba0cdabc91107cfaf0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312885, "uuid": "f39999e1-488f-43bc-a3fb-b077f865312f", "comment": "Malware payload (DarkCloud)", "value": "7e6a4cb61f494018597d038ab7735a9369a9e0766e6d53af07cb9bd8ad32f985", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312885, "uuid": "712b34b1-23b7-4e5e-8ccd-a0e4fe2214d8", "comment": "Malware payload (DarkCloud)", "value": "37c29c09c0b06fdf3156c6202b81cfb0c5d75fab", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312885, "uuid": "b19007aa-6816-4900-a8d9-690f3b35b809", "comment": "Malware payload (DarkCloud)", "value": "3d2f746220e6ef949e4ecd7d400a7430c53c0299667e47fe899021467d91af39acf48440aff6a30311f239211e1f80a7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312885, "uuid": "e1f08e8c-141c-407a-97a2-a5c102050169", "value": "T12F92653AFA18DFF40B1E51E0118B6C05605497A6B93A49BCF8D9C1A87F277508FD64EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312885, "uuid": "a508361d-38aa-4dfb-8eaf-cc02af56e6b4", "value": "384:ZrW8eJkf9hbcZbbjMSeRCwW2WOCDHRGf66+oFcmxisoC/qP:Z8Jkf4qSnRQfD+Rr6SP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312885, "uuid": "d2ea481f-a3ce-4d93-bc15-f7eeff948f11", "value": 19661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312885, "uuid": "7a311732-4ad8-4f5a-9814-01f47d45bbf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312885, "uuid": "ece7d0c3-4af2-4e1a-bfb7-a6df0afb2fca", "value": "5bf56225637287ba0cdabc91107cfaf0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da98d0b2-0c09-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771337188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337188, "uuid": "9f54f067-455c-4260-a0c3-a8fd33a46b6b", "comment": "Malware payload", "value": "96b15bb9ce8ef7c41b708b1620029d99", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337188, "uuid": "2c01f0aa-ddf4-4664-87f1-32babbdaf914", "comment": "Malware payload", "value": "7ea0930a332788c2e88e5822e4908d77cdcaad57e0e97401ed8fe4b117fdfc95", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337188, "uuid": "1caefe4b-666d-4705-983f-fce169fb4a56", "comment": "Malware payload", "value": "6fe2e74d009abbd56de01fd7404a1245e9b47c79", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337188, "uuid": "8a996f40-46da-47dc-a40a-7dc1c066ef5a", "comment": "Malware payload", "value": "e623e222871fdc110ad3f448cb12344e394c51b21f01eb73682722bb5015d2796e457ec9edbf880ac49484869223c78c", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337188, "uuid": "0c2bfa6f-4ffc-4134-bd9c-18907562a614", "value": "T1AB6633517BB6136EFFACC136DA242B0D71D40C114A39DDCCCAEE14AAD23692EB595F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337188, "uuid": "bc738c4d-b7bb-42bd-913c-093b57a3be6f", "value": "196608:Ou5LBuWfFAiGmWTkPhR7B5aTUK+MYvCHfU1FzJOvly:LuWtAiJP/7/auvC/Ubzily", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771337188, "uuid": "7b73274b-6496-47d5-8ae3-f6473a8b46e1", "value": 6513936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771337188, "uuid": "d6900b3f-4ddf-4d10-9228-88b82ca6ea91", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337188, "uuid": "e35803d8-14fc-4b6a-b2a3-e961d82c70a4", "value": "NASTP_ACAST_AND_AVIONICS_DIVISION_ROADMAP_Final_Ver_2.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc00109e-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313139, "uuid": "bf1cc9d3-9fcd-48be-a561-a2095c0e53fe", "comment": "Malware payload (ChromElevator)", "value": "14738714899365ef6ccea6b9c1b0c8a9", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313139, "uuid": "ddf90764-7975-4cca-a7a7-a15d675c1ea1", "comment": "Malware payload (ChromElevator)", "value": "7eb7c1d6b03522109517b94779019aedbf93d7e441883dfd09eb90e0709dc2ca", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313139, "uuid": "9da22ee7-e13a-4e43-88ac-8252e65e2a75", "comment": "Malware payload (ChromElevator)", "value": "f76403a080c2a7789a9ac5847dd64e51e3f0193a", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313139, "uuid": "2282b77d-92af-4171-96ba-f0b846bf3a86", "comment": "Malware payload (ChromElevator)", "value": "f695374884772ffc8691f004ff10b68fbc0d45569aa4000df80cceaba1eca8ed7e8674bf931fadc48e8a4ec9ba7e2885", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313139, "uuid": "e72883b9-61ba-484b-911f-a6d7d797e1aa", "value": "T1DC96E79FA3D003B914B26214E58E75BEF312C47C5322D2382D5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313139, "uuid": "74228ace-6523-41a3-8ac4-71d520444d7e", "value": "49152:jC581A53EuJubaiFa4bOGnQPM3XQ6TyLoFim49mzxYtZ6tR5Um0SvyLgl8AtOxWp:G0fTm49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313139, "uuid": "96b9c750-467b-41a5-9d7b-bf0de69a6099", "value": 8767454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313139, "uuid": "dc44c639-951c-480f-932a-52de426dbb55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313139, "uuid": "e44331cc-993d-4ab8-80e6-46b435dedd9d", "value": "nouveau_curriculum_vitae (12).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103485d5-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352311, "uuid": "ccc0c0ef-9c8d-469b-b846-2590ce49bd4d", "comment": "Malware payload (Mirai)", "value": "0cce75cda20a1532ddfd40b3afb3143a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352311, "uuid": "344295d3-10ed-492b-93f1-79a5c113a402", "comment": "Malware payload (Mirai)", "value": "7ebb02380ab8e0fcfdffc3802a1cf0a01ae74f99006351418360cb9e9ba04cfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352311, "uuid": "ebb0d8af-75af-47ae-9f0f-9cd9f8746f98", "comment": "Malware payload (Mirai)", "value": "ef82451fe8094f8fe65d9ab3e0f7be7683d858d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352311, "uuid": "029555c9-4bb8-4ded-ad04-486618c8bae8", "comment": "Malware payload (Mirai)", "value": "4faa60e135616d2838d033eecf6b02d98ccd5d2f996ee17f5c75b1ad669069e7c213c0a4153ea9f6c2a7e3d36bf471f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352311, "uuid": "1de78a9c-412d-4423-bfd3-5c257619870d", "value": "T19263F749B8918B02C5C513BAFA2E118D331753B8D3DFB212DE106F6477CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352311, "uuid": "73cff2a5-242e-46f8-8b57-b1c73a337f8c", "value": "1536:mZnK+jdJ4QLpoEDmmSPLJ3x7nxczKjrY2VyNufGEMr+PKCOLoI7i1p5aZW7:mqQ1xqmcRx1czKlV7fGEs+Hp5aZW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352311, "uuid": "4c330c47-1be3-4f31-bd67-12239377e472", "value": 70916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352311, "uuid": "1bad22d1-ab27-43fa-a632-b05e29f1dd0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352311, "uuid": "e34eac5c-823e-4d49-9d53-51a37a4398af", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cc5ba5-0bd3-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1771313710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313710, "uuid": "e5e52919-70a9-4fc9-81ac-ab2ac77b3986", "comment": "Malware payload (CoinMiner)", "value": "0105679e9f83176f900bfd175cbd6ec5", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313710, "uuid": "3283ee1e-6a27-4150-8bc7-081598e525ac", "comment": "Malware payload (CoinMiner)", "value": "7ebe6cabf4382fb56c33f536edc9e43cc787e9b88f05179e24339c9a68ac6846", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313710, "uuid": "61a51d0a-8d99-4f5e-8ea2-d8aa1e5a1614", "comment": "Malware payload (CoinMiner)", "value": "714ed97fba629b0457b202777f175ebef93e23af", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313710, "uuid": "fcf40a6c-9c35-4e01-a82b-28cd14f542ab", "comment": "Malware payload (CoinMiner)", "value": "e01827996fbb99b634cb49e643856efd7e0a0cf2afd663b76404b3e582f9299ceb9063d5edc96f93cb986269923e70f7", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313710, "uuid": "0986dfc2-8e03-49a6-8107-038d3a602bf7", "value": "T1331633DCE3856E4A8D4B4CF71132885EBC118A251CF6C8FE337B96D61063FD52D2A296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313710, "uuid": "e615cbd2-0577-4e90-903a-958f9c6560df", "value": "98304:Q0qzdUv+kBskKonJvreBhdsiOKbJX7VMbQUpTko490WUWFM4MvrB:6dO+PkTtir3tGbFeoiGWFRYrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313710, "uuid": "05e72416-05de-4915-9014-a1655d920972", "value": 4336646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313710, "uuid": "de581d47-19dc-468d-9658-eea6db17bbeb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313710, "uuid": "db65b5ea-41e3-47b2-94b2-c0e2a565da42", "value": "gmail.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3db9c83-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353874, "uuid": "c7793ba0-10f1-4c2f-92dc-4b6fcb578d7d", "comment": "Malware payload", "value": "a9de12ffb3db4a50e064fbf3e91ced0a", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353874, "uuid": "fde788c9-8243-4df8-9903-edef1889654f", "comment": "Malware payload", "value": "7ecc9b8ca87517725a5ac16e47a20f514be26887b82cd8e67ba7bfbdf80828d8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353874, "uuid": "d2844334-01d8-4031-b73d-32798161ef74", "comment": "Malware payload", "value": "5a46ebee3bcb872055fe88e6a9c22dd697779aa1", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353874, "uuid": "b8fd8322-e4dc-4379-bbaa-3c2cbaf5fcb7", "comment": "Malware payload", "value": "9c595b57ffd6ca2ecb37f3736b721b9b69fe3626088b0cc46a607b7467cd277d3b7f185a319390fd27ba7a39792169b0", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353874, "uuid": "4968054f-0d84-40da-a55a-c8fbc8ca88d5", "value": "T1C02623779E046D66C4908371B5273D382F3DB217878A51E338ADD2463F42EE2E92F499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353874, "uuid": "d2679738-6b8d-4f00-9d1c-0dd72bd1e7ce", "value": "49152:fCYgQRiQDqbq+B4RWGBmDSihA9ccL7vAnJuyIto6ZWbn:ZTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353874, "uuid": "6e1f4d06-f3f6-4ad6-ad0c-f60f5aad76a6", "value": 4548608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353874, "uuid": "9d0c8959-a40c-41f9-86d1-a40045f64c99", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353874, "uuid": "65bcb867-17c1-4b67-81b6-758f89c63213", "value": "RsptEEOI73827O5S.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a24686-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313131, "uuid": "73504a1f-7ebf-46da-8ef7-7bb580695630", "comment": "Malware payload (ChromElevator)", "value": "533a2ef6c7ab7790e4d31eac4dc5bc92", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313131, "uuid": "c49c6ef2-0571-4cae-bcc9-bd40c37fb9e1", "comment": "Malware payload (ChromElevator)", "value": "7f48b81c923002827ffed90fd5ebb9bf98f38c00ca78b4921dab057d89fb1705", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313131, "uuid": "b622d3a3-0fd2-4ddf-ad7b-79d4ccdaa9c5", "comment": "Malware payload (ChromElevator)", "value": "f76b81846db5e672b9f87a4e179321a17801e899", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313131, "uuid": "eb3a2dc2-bea5-41e1-aa60-aa35a0f769d4", "comment": "Malware payload (ChromElevator)", "value": "a64a4be6fa9da7f6dcd0049eb444f4bc0e4b76f622fbd47afb99a8753f640d6df62df78bd76fb7bf03a6603b144c5aee", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313131, "uuid": "274df2a9-f167-44af-b3cd-8837016b5a12", "value": "T14196D75FA3D003B914B26214E58E75BEF312C47C5322D2282E5CD568326E97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313131, "uuid": "c16bb383-878c-4146-9bb0-df463f71b91a", "value": "49152:yzBjH3GdcwyHEZYY4GOxpvZN/YrBlX4o0XYRCfb0kGAYSUqjIT2Zzmu2VYeAMMQd:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313131, "uuid": "0d1cb1a7-7fd3-4e80-a451-a910573a5fbf", "value": 8715928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313131, "uuid": "36561068-13ed-4389-9f3b-6b5a9c47e468", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313131, "uuid": "8d621edf-bfdf-4d58-9e06-42f9b2c5db6a", "value": "nouveau_curriculum_vitae (11).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460b643e-0bcc-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771310740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310740, "uuid": "10d5644f-c8c2-4333-8888-6c64ce4dd29e", "comment": "Malware payload (Mirai)", "value": "63dc25df481b0a5077d0d9208fe528cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310740, "uuid": "a4b2728f-253b-46c7-a715-16b8dc48799a", "comment": "Malware payload (Mirai)", "value": "7fbd8b70c4ec11802a8a4e9b857278bf81e4f57ad278f3309a87726f2b79fce6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310740, "uuid": "4d8a0272-3be1-4b13-8b36-7be0222b8304", "comment": "Malware payload (Mirai)", "value": "49f8a29a07976f992b19cbda69e68e5d80d7efc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310740, "uuid": "7431da52-a4b5-452d-a592-8d4649d46dfc", "comment": "Malware payload (Mirai)", "value": "30cbf611b97d0c619d4b2e510b4f93063c7230aacd27f3ddc0f7b65be6a40c8cd2791dc27039e8fe715cebfb6a76afac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310740, "uuid": "7b3b9e7f-cfe7-4dab-88dd-4345918a2983", "value": "T19D833B95FC818A12C6D112BBFB6E428C772653E8E2DB3203DD245F65378B86B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310740, "uuid": "244085ac-a62e-4053-a26a-5bf47154b654", "value": "1536:ldu1i9RMyGlP7vWRwxrJhbiculCqMpPa52c4lrBsAL83TnO7zN889XiFinzo:ldsQPa7emIRgqEa5hYrBsA0V8YFinzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310740, "uuid": "618dfdc9-2f3d-4460-b689-ffba73a7d320", "value": 83492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310740, "uuid": "d1fa9fca-3f57-404c-b513-16cd851fdfe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310740, "uuid": "be311637-2365-4e6b-8ef6-23fed5ca5f0a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8cde81-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313118, "uuid": "ac9fdf45-80c9-4f09-aa69-6a5a2299d226", "comment": "Malware payload (ChromElevator)", "value": "490b7396562df4da5d7f12ec4c296dd8", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313118, "uuid": "fbf89620-9b14-4238-8c58-dbbe6d1d0bc0", "comment": "Malware payload (ChromElevator)", "value": "7fc00bf9c5ca44e7708a0d1d56221fc564859ec3aa7f299c7f3c698cb4d580da", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313118, "uuid": "8ac4700f-e082-439d-9e21-fb3bbc24307d", "comment": "Malware payload (ChromElevator)", "value": "a2914bcb6f6db0831caa68d58403acae776c31c2", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313118, "uuid": "ee942504-85dc-4f50-bd1b-14f52c41134a", "comment": "Malware payload (ChromElevator)", "value": "8a33e8d147154b7a5ea5fa955679f69aeea0245ef5fb11eaa846537d188c2da0ba909f5178352a7dd9fa301b1578041f", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313118, "uuid": "c018a054-4f72-4e12-8942-2e2df24a8d96", "value": "T1DF96D75FA3D003B914B26214F58E75BEF312C47C5322D2282E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313118, "uuid": "abe276ae-1586-4d27-9b7d-08942fff92fc", "value": "49152:wnA6kvyuqxYmHdhsa30u5ifdvLy+YzCnor4+WbRavK2MtWg/i66fSFe5nH87DsqL:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313118, "uuid": "79b55d74-b458-493f-a644-7c970ee594f4", "value": 8814597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313118, "uuid": "f1411346-89fc-4ea0-be17-7778b1686cd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313118, "uuid": "3a47bc13-b6ce-43d7-8a87-bcddf36869ba", "value": "nouveau_curriculum_vitae (10).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d736553-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342105, "uuid": "fdc435ad-9daa-40aa-989f-25bd8b1d97d7", "comment": "Malware payload (Grandoreiro)", "value": "c5e11e2ebd448ef64091815e748cb1e6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342105, "uuid": "e13be4af-d365-44ee-b26d-7a16a80470c3", "comment": "Malware payload (Grandoreiro)", "value": "80112124ac0361a76b1dea332e5891ab59dc3ca7ac5fe7d970803782eb7fff49", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342105, "uuid": "00e0eda2-ab98-418b-a181-2104e72ed8fd", "comment": "Malware payload (Grandoreiro)", "value": "91a23623a4b97f09be32111f923e961454349b7d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342105, "uuid": "aa89386d-7307-45f3-b844-289f8b341d8f", "comment": "Malware payload (Grandoreiro)", "value": "83dd797c8b834bf6eb9aa8bd8331cdd02f87ad63ad598ad3f1cc22aa3b5c0b668664c487b5337cf110603e8bdf7bdb76", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342105, "uuid": "a5a93a48-b7bd-4820-9cf1-8b36ee25b8b8", "value": "T1AEB63331FF4218AAC6A08331317F3E3A1E7C7A1B4588A6D775DD91C6B745FC0493A86A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342105, "uuid": "40e310bf-c199-4803-845b-acd02b61df83", "value": "49152:AgGrdhO3OnYDmKbLrZ+Gu6rMj3rhfTRm5uVlA6B9jNZdVQO1eqNLyELui+xGbSCp:xuim3YlVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342105, "uuid": "8923f259-a947-48d9-9bba-8dc21e3cbc0f", "value": 10717184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342105, "uuid": "33097409-e671-4949-80f1-ba6fa9e52abb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342105, "uuid": "ee1bade6-240f-4351-baf9-3da59a5f36c8", "value": "33346UVi-6532OHPAruqv_PlnX17YI.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e84c45-0be3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320504, "uuid": "9ec8274f-a41d-48b0-aaed-f5bd08b123ce", "comment": "Malware payload (AgentTesla)", "value": "66f13b9f5db78f84a5d70557e176cf33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320504, "uuid": "e6d7e7f2-e1cb-4063-9db8-eed25aea9497", "comment": "Malware payload (AgentTesla)", "value": "805d1d12c735d839420e3321e61d3a805c203fa1afeab9417e942dff34cc8cfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320504, "uuid": "8f4afc47-0292-40a7-925b-eb6ab7a7976e", "comment": "Malware payload (AgentTesla)", "value": "cda321ed71df0db4d6df81768f0494bfb584c14e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320504, "uuid": "4b1ae9e1-c732-49b0-8882-64149a35b1b1", "comment": "Malware payload (AgentTesla)", "value": "5419b6ea16de7121fd8525bb80af6b5dbf94736cea1f9da2e0466a77751ec66fec9e5337ef759f7c367a6b55c798fa87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320504, "uuid": "d84795d1-93b6-4793-aa87-e085c1d0806c", "value": "T1F0F40141F3D4FCE5E49554B3E83EC7680E12DE2A80E6471B6126B50A2CB32D27627EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320504, "uuid": "b64661e1-135d-4fab-99bd-24818d844925", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320504, "uuid": "9ed75c1f-767f-451c-8762-8f2d32f0af7b", "value": "12288:DbkS1xQQ2Z+Pap1gQAAz5m8nAPzXZMTv5lsm8wJsWZl7MeeXGfa:DbzxQcCHgQAAlmgAPrOTT8wJDZ9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320504, "uuid": "a9dff134-4122-42a6-a547-542e758813b3", "value": 731984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320504, "uuid": "244a406a-b78b-4d84-8223-e54b5e89970f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320504, "uuid": "f5d7739d-476e-4e75-b61a-369c5d4e87d3", "value": "805d1d12c735d839420e3321e61d3a805c203fa1afeab9417e942dff34cc8cfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a04ee30-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349347, "uuid": "e40dacdd-994e-44a5-8114-7a2b9f4c29fa", "comment": "Malware payload (Gafgyt)", "value": "10c4a811579590cc103cf696147545de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349347, "uuid": "a593fde0-452b-43b8-b0a6-161e6dbc2de6", "comment": "Malware payload (Gafgyt)", "value": "80e3ae66885d1707b1a4740ba685274ef7618de44fac2218bb503cfba2cc8a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349347, "uuid": "2fa56893-9c1d-4d76-ae13-1df76759b7ed", "comment": "Malware payload (Gafgyt)", "value": "00e576ddf7b596ec7f1e02b9c5fbd6591bfca67a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349347, "uuid": "3bb0bd7d-d482-42d1-b1b4-99332708a710", "comment": "Malware payload (Gafgyt)", "value": "3e28c78bbb2a3947f9d9142c152f4b7d75e9bb3c9f2932c08dc1160b3ad96201c8f62d7021be937732c3b32d1161c51d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349347, "uuid": "9503a95d-fb5c-4399-b037-8a4c94622288", "value": "T173A33933A753D6BAC09322F41BDB9675A863B47C0B32311B33C86DE56B06DE91E5A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349347, "uuid": "48034c74-5b55-46c9-a011-756983b3d006", "value": "3072:GKpeDvrBonq8SOPQz974qMyo921smrYuOHy+ZNzX:MvrBCPQhWE1smrYuOHy+ZNzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349347, "uuid": "795ce35c-7072-4407-8d7c-780e65b93278", "value": 99332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349347, "uuid": "4a21d372-f684-413e-9120-6a524b8a5ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349347, "uuid": "1eb0daa3-99de-44d1-86dd-5dd0e4399238", "value": "powerpc440.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6d335b-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341699, "uuid": "d9b5f064-1351-40ab-b19c-b81a8f36d8bd", "comment": "Malware payload (Grandoreiro)", "value": "eeff32e4d49d06a54d2704682109973f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341699, "uuid": "595d0722-cfdd-4708-a60b-e057432a4d90", "comment": "Malware payload (Grandoreiro)", "value": "80ee12f768fe6361c2bbe27b20d6c4bb97d76e02e2de14061b0cd5ad0e6ec877", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341699, "uuid": "7f5c63ca-8d49-43ee-9d5d-59aacd47b510", "comment": "Malware payload (Grandoreiro)", "value": "dcf32d1cc654adc6dbc42863ec71b1477b30e03f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341699, "uuid": "d19280aa-f1fc-4d02-9c3a-1ae11b9de74f", "comment": "Malware payload (Grandoreiro)", "value": "502e97aa16c974c8823c4f877417338452de77a4d3ceb12498adaa4673c561d71fd1e6ed16a7779229ca23a7a34a75dc", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341699, "uuid": "8b2961cc-5e96-468e-a760-c9e48ed47e4a", "value": "T1C74623329F056C6FC6408336751A2E291F2D761387CDB4EB252C59C73BC6ED29A3B069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341699, "uuid": "e20d1c83-e20b-4834-b612-b7a8df54c3b3", "value": "49152:7inviMlodez65xvbLQb1M7bfxY7sFaLC0nd0163THZIv1gURqS4ePjPCjkYUy:XYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341699, "uuid": "a268231e-fe2a-4926-b640-689f9638c982", "value": 5646336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341699, "uuid": "b8a43f95-615b-4aa4-aad3-b0dc84963d85", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341699, "uuid": "d20ed976-2210-4808-836a-8674f0717de4", "value": "0Ofc2957AMOXPMU2KS-46467.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07204bb-0c50-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771367665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367665, "uuid": "cacfe100-ce08-46db-ac4d-1743212b939e", "comment": "Malware payload", "value": "c5ab1e0e94ed5bd12bac9ab35a8b67c1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367665, "uuid": "169b41fc-c5b6-449e-80f7-51f0c7121246", "comment": "Malware payload", "value": "81091ae754af253612f9d90329ec304568b5a1bad4083982449e9dadb2c630c2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367665, "uuid": "8859d096-1428-45bb-bdf6-3c560970dba1", "comment": "Malware payload", "value": "408fc048529e49cb30b0f912c8cb25e878f70b50", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367665, "uuid": "31c18b30-331f-437f-8b00-ad9b694b9fbf", "comment": "Malware payload", "value": "463fb106a7eb30128a02285551dc79f6f8218be5d579945fb2c4cd53fb37646689131a76175ee8729929855b54b97499", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367665, "uuid": "14956af1-f6aa-46c9-8620-7932537baf45", "value": "T1D0317B151BE91725D1F38F3A687AE7108931BD15F8768F9E11B885AC1C14710A835F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367665, "uuid": "891dce4d-e962-4771-8aa2-3c29059d6180", "value": "24:8wQuJc33drULUoOAZP5J+/5+fYXDInlFaDvmEidPt1YGsLlaZdabWlYqmRv:8reDVZxw83BhPtpgcaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771367665, "uuid": "9b8fc34c-9edb-47fd-a849-91f9e961744d", "value": 1461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771367665, "uuid": "6adb9c78-bb64-422b-a3a7-8a2db7031630", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367665, "uuid": "fa43ccfc-e2e2-4cba-925e-e4765eae92ce", "value": "\u0422\u0417 \u043d\u0430 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0431 54 \u043e\u0442 19.01.26.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4aa0e9-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343288, "uuid": "82b5b87b-2e09-4013-9193-1f3d1778650e", "comment": "Malware payload (Grandoreiro)", "value": "5a5f2b01a6c8bd489c733a3eb518eb86", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343288, "uuid": "8c9dc2e0-365a-41ce-bc06-276db19a409f", "comment": "Malware payload (Grandoreiro)", "value": "81d2c2a606cd06f57eeff1ee6c25d190e2e37489064ed90d4912dfee3f112ad2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343288, "uuid": "d60c8d18-e477-4f72-8159-c5fdfc9fd50f", "comment": "Malware payload (Grandoreiro)", "value": "92bea095d174c04ab239e6f5204046eb7e040a0d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343288, "uuid": "8f80bd7a-2e27-4efc-9237-2fc530539a37", "comment": "Malware payload (Grandoreiro)", "value": "b6953991b96238023242efd945f7cbe02cefb9a8e8a3b391807a1c76436d550d7aa7a568e082d771cfb929d2e6c97f37", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343288, "uuid": "6e143ef8-89a7-46e0-b7ac-23b0072636a2", "value": "T1B2462336BB506D22C55047B3753E3A36AE3D32071D8AD5C0B89CE1477B46EE28B2F895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343288, "uuid": "2107cc81-38b1-4c4a-b252-c258b57bf878", "value": "49152:K0jFfiqhUYLBWyA1cwvmOfuIcDbin/imKtterrRCIWwPztJEmiyBXRL:wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343288, "uuid": "4c66dae6-ab2c-4173-b10e-630d70debd74", "value": 5505024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343288, "uuid": "b7e19f44-886b-4f0a-84f8-7237f94dc4f7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343288, "uuid": "623cbf3c-1342-4e8b-bc35-a06d596f3f0f", "value": "Not-Ar66143763AA6RKPNBI71965.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feeb6ef9-0c59-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771371609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771371609, "uuid": "6c8a6047-a137-416c-844e-845db9924b2d", "comment": "Malware payload (RemcosRAT)", "value": "1d7a23fc274f3f48286814e406e60271", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771371609, "uuid": "7d8e88c1-fe81-49df-a8a9-b2abcb6b2b76", "comment": "Malware payload (RemcosRAT)", "value": "82521f120291f02708e3787da16dbcecde8d8c93f81fae2745bc5d7d0fb0df62", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771371609, "uuid": "3d8a2b21-4048-4f0e-8be8-9cf1fd0a6445", "comment": "Malware payload (RemcosRAT)", "value": "c8aa4767b7690ffe6e22b08260ac356336392ceb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771371609, "uuid": "0bd04cdb-0c97-438a-9df7-bb089067ff13", "comment": "Malware payload (RemcosRAT)", "value": "e5b87d971aad3bca1ec2a9371e04fb77bb1a5b9db7b6e46dd61a0933bb908552b5432b312e197108de856a5adf6e5697", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771371609, "uuid": "7a26ee5f-2e1c-400a-be68-4b65a797110d", "value": "T105560A803384E4722B2F2BACDB39A6B1AD1E440365C5EB1D30657B54B1E9907D76CBF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771371609, "uuid": "54df5a41-7042-4e9c-b5ad-bc91348330c1", "value": "98304:Pu6SFCCdudl1I64VdVBd+Mq0h6bnUwRb3WkV5Pyr72uhji/:25A1CVdbdPhiYkXPu73hji/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771371609, "uuid": "59feb8c3-23a1-40fc-accf-6f81c80eadd7", "value": 6246696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771371609, "uuid": "db9b3355-9407-466f-8909-1b79a80d0dd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771371609, "uuid": "6ca26cef-9dad-4fec-9f1c-cba88dfb3871", "value": "Transfer-DIB -copy-REF IFT2207251367800-10300.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0774ae1e-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352296, "uuid": "f60335ea-dadb-479e-9059-9c823daab90e", "comment": "Malware payload (Mirai)", "value": "bc44be5360662edc5bf2300188b10704", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352296, "uuid": "9f68a098-5797-4d87-987f-5bec02eef22b", "comment": "Malware payload (Mirai)", "value": "8276c217e79afb29f7ac6afd393515b15010247df0d77a0c69445951850b579f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352296, "uuid": "fa97bded-d1d0-45f2-83d0-2e64190657f1", "comment": "Malware payload (Mirai)", "value": "8c6d39a76d4fc6b12345ad160e45abc8998a2764", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352296, "uuid": "60ed190e-8a15-445c-b042-cdb083dfbd2a", "comment": "Malware payload (Mirai)", "value": "24502be7ea92e2c0a07af43c1dff47ff54c2524ad9a6037fb0e1cc1f7d3fa624314487ed95a19c23259c437ae810adce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352296, "uuid": "93bb0015-1899-4ea7-8e98-a3f621059d2e", "value": "T18B238DA7C43CBDD4D15982B8BD248A3C5B23D016A6933EF6764785628047EECFA093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352296, "uuid": "b4609dca-4f4f-4836-91df-05ea2e325634", "value": "768:baV/jptstaT85n1OEwtgB4sNTeBrK6XXG0QJqF5Uu+nprxC+oCZ21CuHE:baV/3s+YbwtgV6KXq5U5pNCG21Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352296, "uuid": "0f0da2ac-c0e5-43d3-aea9-ddb7741bbc10", "value": 47560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352296, "uuid": "ac8695a7-8ddd-4af6-9018-81cbc1bc1234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352296, "uuid": "378522d9-5457-4bf9-8e0e-d003e2ebcde5", "value": "miraint.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8ab252-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352632, "uuid": "64098a5f-0000-48c5-b2d5-e25f8a4b1ab8", "comment": "Malware payload", "value": "bf1d58dd571410950e74d9cd0f96e6d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352632, "uuid": "959a1e30-694b-4244-baf1-70d9e8ce945e", "comment": "Malware payload", "value": "827f2f959b054e460f58eacf5a421f7990821549145808245a298e48cbca8ea9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352632, "uuid": "8940562b-5b27-4cf9-8269-de4ae21e3c45", "comment": "Malware payload", "value": "e2312c4e0de17f6db24290a9025c9205b3685daf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352632, "uuid": "c684c74e-7a02-45fb-90d3-2c1e1465e09c", "comment": "Malware payload", "value": "f3b6ea017f4b90f0c3a31a6df4c08e38f3d403fc258b263ef1ae82d71b6b47b8c9089708122a8b73b9b94013337a55cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352632, "uuid": "64e7394d-7d99-45e1-8042-9b01d7136877", "value": "T173E46B227B21DFA5E355D63009F3CA514AF121A207E24486726CC7287E11A6E6E5FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352632, "uuid": "dafb7c63-326f-4929-aafb-e66811eb30aa", "value": "12288:PYlsmW7rAoHj8kJuuvs44mG6UC79oWXGgpdgOWm5i6yOaZtW4:PYlsm2jhw44mG6UuvNWPuaZt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352632, "uuid": "56ec9017-74b8-42ca-8802-0b016742ee17", "value": 681436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352632, "uuid": "729fda41-705f-4a39-9e70-914c6ec5aa76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352632, "uuid": "7c3b78b7-c5d4-47d4-b34f-e1de9fee59a3", "value": "hydra.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c3c85c-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356499, "uuid": "faea33d8-894f-49da-8de7-45aa71c1b802", "comment": "Malware payload (Mirai)", "value": "2df33ceaa84582e61ba1146bf6eab2a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356499, "uuid": "18b9562d-0670-4224-a484-c963c3927825", "comment": "Malware payload (Mirai)", "value": "83514341b7e9fb3768ede28f58daa23441d8733239d688c22734ac839b08273b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356499, "uuid": "11b5daa0-c9d7-4505-8c56-f9adde0c755c", "comment": "Malware payload (Mirai)", "value": "bcab47dff2bdfa588b2688b697717fc18d052a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356499, "uuid": "d677cda5-ee59-4d3b-aad0-5d56f19bed1b", "comment": "Malware payload (Mirai)", "value": "590b9aab4adeffbc06aa6bd216ae41a7574cf9b313fa8264bcc9ce44d24607f4bf1e1153f9b1970613f747ca5dafdd6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356499, "uuid": "bc29e789-0976-4933-8262-7ace23077d94", "value": "T1CBC3E70AFB110FF7D86FCD3705A90B0925CC555B22A57B3A7674C828F64B64B1AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356499, "uuid": "812913d1-fecf-4bdc-8a01-2ad7dff68b5b", "value": "1536:sOu8hpjqa3+ATPyWm1Dg/qHNwjWTWPpZqgBomzH8pWJVaHvdSDh5vr:s5SpjqIPmtwlpEg+SDh5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356499, "uuid": "ac527dc0-4adb-42d8-803a-7bee89baa3a4", "value": 122400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356499, "uuid": "7e635669-64c2-4b82-b7ff-aeecba283cf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356499, "uuid": "c95dc0b6-ee32-4bb3-9dc7-2207e76ef809", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a06a9b-0bf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1771329345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329345, "uuid": "fda74512-288b-4684-b5c3-9c4f04f1e74d", "comment": "Malware payload (Meterpreter)", "value": "b71ddb14ebb9aeb4b9f8eadf4c2321ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329345, "uuid": "ae6b1a17-6ff1-4749-9895-f3d2fe8060fe", "comment": "Malware payload (Meterpreter)", "value": "8396c017a244640416b50cba6e4831ec2b92fb35760c715da155494cd326060e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329345, "uuid": "1a9f88c8-bab8-46bd-baed-b3392c3fcf04", "comment": "Malware payload (Meterpreter)", "value": "d3afa1a53da072763692fa67d8c85e5b5e4d1c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329345, "uuid": "14f6edc6-6fd8-4275-a03e-14d580ef50a7", "comment": "Malware payload (Meterpreter)", "value": "401403fde940d77956cf0d75249cba36c97088dccd7bffdd0169a5d28e1bb116dd9372db6308be0b0f52909d145be010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329345, "uuid": "2cdfef2f-3ac6-4bdb-ac43-6a7f9d307169", "value": "T14E346C5A72A01CB5EE77823EC9535A0BD7B2B8120760D7CF0364839AAF1B7D1663D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329345, "uuid": "cf53a52d-a63d-4f74-987f-79fff75b4432", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329345, "uuid": "c32703ab-a1e3-425b-b05f-7c54a40568bf", "value": "6144:qnhrOgb2gTKPkAN4ARWacGSt0M81UjJiEf:4ce2UKP9uAR9lhajJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329345, "uuid": "35b66340-c5a0-4137-a691-55186c46ee50", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329345, "uuid": "b22ae91c-cbea-44cc-93b4-82ac44df239c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329345, "uuid": "02192296-b607-4753-931f-fce6be6a21de", "value": "http8888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d5be0f-0be1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771319734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319734, "uuid": "d818fff0-0fc6-4d54-a9f5-4f9757068624", "comment": "Malware payload (AgentTesla)", "value": "5122ebf9a0cebcd230322886002f3336", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319734, "uuid": "8181f8fd-b6ba-491b-8473-7c75baa40c2c", "comment": "Malware payload (AgentTesla)", "value": "83abf195410d4c5ce11a957fdceba7a8c0644ccf0f385ceee14fcf3ad81908c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319734, "uuid": "720849b7-db70-4fa9-b2b7-b1599ba42561", "comment": "Malware payload (AgentTesla)", "value": "e527487bd93c59f6641547dea102da7d1f20f052", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319734, "uuid": "84ceda4b-4448-429b-a165-d074b7934742", "comment": "Malware payload (AgentTesla)", "value": "c4a7683061403d8ffc79832d5732afbf1a523094a04dfeb4e05d7a1fbc10cec5b41f037fc74225ecbae049f8a5a4d2e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319734, "uuid": "3f79742a-f916-472b-970a-b67188bfc506", "value": "T13145124A3732C06AD4941F712C297EEA6B75ED052930431F737C27DC7B316A9AA0D6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319734, "uuid": "8d1c0465-74b9-4e7c-b396-0e5cf6a70ef4", "value": "6144:Y4t6LsyAWYRsw3HWstc+AD5Vh5websYT55ZRzmdO83hwC42KSRm+Hswd8p:YkdW+Ttc+ADPhpT55Z4dkSRrsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771319734, "uuid": "2be45d9b-88a0-4a9a-b284-38fcd2c4976e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771319734, "uuid": "319da55c-bf7e-4bde-b9a0-d3e4ddcfe73e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319734, "uuid": "c7a9ab4e-6426-4543-b8dc-5c9ff4b3325e", "value": "Documenti di spedizione.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5e3320-0ba2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771292716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292716, "uuid": "ea6c3157-5aac-417a-afcd-97723a9a91bb", "comment": "Malware payload (Mirai)", "value": "00d3c4639a64d1b1d48ab5701f3e9ae6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292716, "uuid": "5a2316de-c37e-4e67-9f78-2b12c99c9aa1", "comment": "Malware payload (Mirai)", "value": "842a05a0764d67bf2cfd38162aae52a2566528269e1b9f7fbab69d2dcb467d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292716, "uuid": "dd4a4e8e-4920-4946-89e6-3f361c9b0732", "comment": "Malware payload (Mirai)", "value": "d3d4ccba07ae91e344b1069e26aa17fb29bc5600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292716, "uuid": "226d3880-8023-4920-8f9b-e79fc50d5a92", "comment": "Malware payload (Mirai)", "value": "3557dfa9d631340099e32d70c570352cf4a70c9f2a5a1cbc70afbedd74b1ace773558489970393fdfced93bbd382b412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292716, "uuid": "06167319-501a-4f60-be6b-14bad5027760", "value": "T195045B47EEC90EDFC457CEF046BF836B19E35AAB8CD1A1F5447C8C0C795918A86A3648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292716, "uuid": "71944f17-a13f-4014-89f9-d8d383716443", "value": "3072:B94IQupD2xaSIAAjwdqQ3FkhvOwMu7lKn6aS6irtynfbsmW6Qqu6:/4IQ+CXH65lKn6aVirUgmW6Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771292716, "uuid": "88b1563b-7058-4244-8788-d327b0b4b4f1", "value": 184964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771292716, "uuid": "0eb5262e-9bc8-4a48-aa31-96564885274a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292716, "uuid": "22beb814-2fb7-47ce-8310-787013832191", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd200ee9-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356493, "uuid": "978d0008-72b3-4089-a537-2769c05683f8", "comment": "Malware payload (Mirai)", "value": "846bdeea05cbb3eb9b96558d4994a3bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356493, "uuid": "8c887a5a-8986-40ff-adf5-f46044339670", "comment": "Malware payload (Mirai)", "value": "842cdfad1575afe94df47fd6b5004ca3b93c1bb96c6f4b7ac141faf4e5897c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356493, "uuid": "2dcec5bf-6b26-4ec5-86b7-773d81bd2f89", "comment": "Malware payload (Mirai)", "value": "46df072a79b348b69667139812d82bfbb10db5c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356493, "uuid": "d800d310-3ce2-489e-abb6-5cd509569031", "comment": "Malware payload (Mirai)", "value": "a34e2fede7a125a5db0cf3f28c01b4714053c5811f005ad0dd81de4ca4c28610007d7506f15feeb2951146aa9c822b76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356493, "uuid": "a8b3cee6-b86d-4730-ab68-b9f649b3e709", "value": "T1D9C2E1A44B8D65E5C6E06F39F87E8287A2B017F0D4BE34743320D76996C290767F644B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356493, "uuid": "66bab32c-513d-458f-adba-40a30af2c7fb", "value": "768:tXxs0kuOZHC0uSmYtBEWm1FS5MuVs3UozNk3:FxstZiimYtu1DoM5zS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356493, "uuid": "bdafa28f-7d5b-4f35-aa8d-8d03ccd99089", "value": 26264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356493, "uuid": "9289919c-8505-4c79-aa88-28588b39091c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356493, "uuid": "a894c70e-5df8-4818-9d57-24b70a8ba460", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce60a0e2-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351771, "uuid": "241bf835-be43-46b2-a181-b10ac128439b", "comment": "Malware payload (Mirai)", "value": "a85d7303997b6c7b1c2e43ac103ea1e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351771, "uuid": "ea842deb-edd3-4838-bb72-5d587bc99a62", "comment": "Malware payload (Mirai)", "value": "84560ab673c071fc2fa8505164eceea1bd9c4bc61a2b882917fc367cf1db9004", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351771, "uuid": "4b357afc-eaf2-4595-a7be-55c968b0e8f1", "comment": "Malware payload (Mirai)", "value": "f0d5c25329a71d664fc200eb145a05880a612bb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351771, "uuid": "0b693a80-0d34-47f0-bf7d-21465cbc1fb4", "comment": "Malware payload (Mirai)", "value": "24d662e4689772c2652f5b5f9a01c734d8834d6ec6c8f6d9cc9fd754126e743f27befcbd733643510ab283071f56914d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351771, "uuid": "ef82fdb6-013c-4838-8a28-1a118437ef01", "value": "T15F232B42722C0A47D5A25AB0393F0BE093FFE99120F4B6892A1FD7468635F771586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351771, "uuid": "9c9ef78b-a216-49f2-8e8f-3b95f9035704", "value": "768:fWLJhV3pc1tbRC+3u7RsGVBCnfd0aC3E+n8Vdk/fEXIZyr:fIRpc1tbR5kDPAMcXkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351771, "uuid": "69d43953-36a3-436c-be1e-9e4c3eaf3351", "value": 47140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351771, "uuid": "65a49c16-ddc6-43fb-ba08-f9c9ed6a92dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351771, "uuid": "b05518e6-2920-48f2-82ec-766cf26275cc", "value": "hoho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa45497-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342163, "uuid": "f2daf6a2-8945-4750-9718-b624f1bb5649", "comment": "Malware payload (Grandoreiro)", "value": "1adbe3e362a31be0ffe0e9f793347215", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342163, "uuid": "0c1394cb-cd10-42ef-a5c2-618dca7539ed", "comment": "Malware payload (Grandoreiro)", "value": "84bfc20947599be00b3cebe54d51fc848c14ecfc142610dea5f2809cd81475e8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342163, "uuid": "3d0efd4c-d696-4a46-974e-deb9c4e4ed30", "comment": "Malware payload (Grandoreiro)", "value": "e91d1e35d2aca100e7091828b3bc586a32c71d83", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342163, "uuid": "17a41912-5950-4fca-a0b1-cf5d7a9fd6b5", "comment": "Malware payload (Grandoreiro)", "value": "8383955f3525172d1c05e2d8106d2413ce3676c905e795c35b748db4711d3968fe6f7b949073a92a359e645415cf12a7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342163, "uuid": "ed7f6c48-95d3-4f52-adf7-6ac67f8db02b", "value": "T13B462332EF611D5BC7908331746E6B346E3DF217458CC6C6A46DE282338AAD69E3E4D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342163, "uuid": "debe1466-9861-4d9f-a1ad-c000c0f70e20", "value": "49152:R+E025trpBI8Y2FDYk/EZkz8fwe8WRJoAO0j0vRxUP6v5b//t9kNfzMkFFVL2IFj:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342163, "uuid": "710220f2-7bdc-4341-8f51-6350fd8d7216", "value": 5634048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342163, "uuid": "4bf72949-4e00-4399-9a8e-148057710730", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342163, "uuid": "28cb941c-c621-4623-940b-a620810708a4", "value": "49239Ntf_ZKQP2CUF8K57573lemi.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689ff34c-0ba6-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771294477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294477, "uuid": "282ae88a-1daf-4fa1-b85b-ff92771babe5", "comment": "Malware payload (Mirai)", "value": "54dbaeb1515112fee4ecc40028d3929d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294477, "uuid": "f4b7c122-9dce-4b59-a037-8fe72e2e23ef", "comment": "Malware payload (Mirai)", "value": "84de1103a7e23e7f1be246a9c7c941602c83483b9df753abbb8f9d1f07a0c1f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294477, "uuid": "ca3246b1-723d-4e96-893f-569a7bdb2be8", "comment": "Malware payload (Mirai)", "value": "7120ce52d30f5b3f55f26a1a3a1c0286af922b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294477, "uuid": "b98dd610-a361-41c3-bc3a-d773c46110b7", "comment": "Malware payload (Mirai)", "value": "35b76fc4b97f50596a0d989c3cc5749b82d7361aa3b998b87b098432c0dfa8a4afd16e6753d1d47e85150c30716273fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294477, "uuid": "eb9c17f8-ca4d-4183-bc76-3d21e5647b60", "value": "T1E0B3D91E6E25DFADF369833547B78E31A75833C62AD0C685E26CE6001E6034E245FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294477, "uuid": "9e0d7b52-272f-4f6e-9a95-e00be659807d", "value": "1536:oN1qVEsdza07J1O9WCOiHqW9xKOxK4LK3PepoLZg65Lm5b5en9gnzRiQ3:Y1oJza07UOVWDpoLZg6w5bggnzRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771294477, "uuid": "0f6a0826-da8d-456c-ae35-e7d82c87c621", "value": 109972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771294477, "uuid": "061d0cf3-8edd-4a0a-b572-f6067d964fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294477, "uuid": "ce799dc1-77bb-42a6-b194-5fb140c5505b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182e47e5-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352324, "uuid": "4240a27f-5ad2-4828-a84f-9d53e8f7285c", "comment": "Malware payload (Mirai)", "value": "ef9ef54f8f8e3d101898acfef338596e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352324, "uuid": "d982d1d7-7129-4fbc-a85c-e927192a3c88", "comment": "Malware payload (Mirai)", "value": "84f21eeb6007440116867f03cef55d2394f53c35521e10a63fc4531ef6778cb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352324, "uuid": "1605491e-5df2-4512-af33-e88e7086b4c8", "comment": "Malware payload (Mirai)", "value": "89200c683ae4d05006707d9076b7416a80a9505b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352324, "uuid": "cc093916-bbeb-4cfa-9412-70fd01e1ff13", "comment": "Malware payload (Mirai)", "value": "acdb4317626ea06559c745a21cd8d8e2777071b85a17c309f8cffa0a818b9f329a34f1e4930a2e9658abf29881fd8202", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352324, "uuid": "d42c6b6b-4b1c-4579-861e-930c2798dd76", "value": "T199234CC5A547D9FCEC190A712177FF319AF6E83E1158DA83C359AD72E942602E9032AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352324, "uuid": "32d5675a-deae-4ba2-8a7b-dd2de28605c9", "value": "768:r+WtjNuFWuttPEszMmsdybV/co8NCSSWfd/046SDZkQoI:r+cUttPEsImsduV/c0WV/046OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352324, "uuid": "6ca327f0-269a-4efb-8dc6-412b0490ff46", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352324, "uuid": "94f2aec9-76d0-4b32-b29e-1e9f327dfc8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352324, "uuid": "f6e276cb-1185-4c2d-8c54-eacd93813a1e", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7978470b-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348192, "uuid": "ff68b1ab-e77f-4cd7-97f0-27cfd9741db5", "comment": "Malware payload", "value": "03cc5a865501e6434eecabc1e640ead1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348192, "uuid": "f22819a9-4071-4f49-9068-b1871ac5a429", "comment": "Malware payload", "value": "8524c04a63ffb797e378aae715689c21d530711136ce3f0cbdd4f65ebd8c1216", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348192, "uuid": "f65decee-5919-49dc-a41b-e76338bed7ad", "comment": "Malware payload", "value": "40f5d11162737d848fdcffc5e0e45c153a928371", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348192, "uuid": "13afee50-bebe-44b1-8eac-40b3187c1a86", "comment": "Malware payload", "value": "2d2c5cd8e7864b19824be4e3f671059f23df9ea907933580c30e5fe3d4d24b6ae75f174e17c613d4f308372b3d918145", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348192, "uuid": "87b32893-209c-4f4c-8ac9-c58c9275d399", "value": "T1BCD623AABF88ACEDC4F2463719B557A0113ADD2D86CBE7CB85D8707905B70C09E41ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348192, "uuid": "22b45995-c562-4e23-9fea-95c342a67a7b", "value": "196608:brjy6IrGxABG2ire+x7mi4kUQDrKIEQcs6EcZID6r1SlCObRUVieNU8k05zlUtG/:HZIMRE06EM2ayxtUVi8Uh08tG3PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348192, "uuid": "8eeff7a4-d7ed-4327-8b19-6cfe8445b477", "value": 13072663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348192, "uuid": "420c0dca-f2bf-4197-ad47-7d34d2e3a4f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348192, "uuid": "1ecff110-9a74-4bcb-958c-50f62423aff6", "value": "ghost.bot.apk.v13.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f3f475-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342068, "uuid": "b90ab101-da90-4c1f-a993-34aba5dec4b9", "comment": "Malware payload (Grandoreiro)", "value": "310d54baf9b812152289f785b8c883e6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342068, "uuid": "2932b79a-cb08-4951-a0c6-15a814fee026", "comment": "Malware payload (Grandoreiro)", "value": "853df8c1caf33750ec229037065aa57ba97175219655411e7eec53fcac74da6b", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342068, "uuid": "dc12e5c8-ac43-452e-94dd-8d8e2a5581e1", "comment": "Malware payload (Grandoreiro)", "value": "7966b645fb702bd77828b80cb21b66226b11eb82", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342068, "uuid": "381c3385-a4d5-4196-a2a3-0f60669e8ab1", "comment": "Malware payload (Grandoreiro)", "value": "e2305343c5663da49f9c0a50e90838c37d5c58fcadf3310158f60220c153958ab88273a85d172740f861698faf752360", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342068, "uuid": "c0c72c7b-3a1d-4039-88a5-56cdc02d6a49", "value": "T114763331AE94187AC194C335B06F3A396E7F630381CC9597B4ECD2CA2747EC7891B5A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342068, "uuid": "35b1427e-8d24-491b-be77-1eaa89a64bf1", "value": "49152:H+mNO5i2QUz+UYKHHryRQTAcZunZdngNcFHFv/MybrLM1ThT8VAq1xL/E6XGY3kZ:20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342068, "uuid": "3b1e4e67-ecc4-4218-8b22-2fca99a35087", "value": 7264256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342068, "uuid": "8c176fd6-745f-439f-921a-f0db8ba8a73a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342068, "uuid": "c44fbd03-5e8e-4d50-bb61-58f174e7eeca", "value": "13374BNGKF_ArbiLF01-3314slxoke.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbe450c-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353887, "uuid": "02a1dbff-16d3-44be-b847-60b0f01b9714", "comment": "Malware payload", "value": "14ab88aaa6a3e0b847e28f31e26c92b0", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353887, "uuid": "59891ba9-011e-4e2f-8a94-e0eb0e47685c", "comment": "Malware payload", "value": "8562e4a2a0972855221fca5cb6ff73604adcb4582027f0c5ce6095d880f610f9", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353887, "uuid": "7fafbbf1-2ae2-4665-a9d5-5b4d55684e36", "comment": "Malware payload", "value": "11c6172ed65feebe8be6a36fe905ae33d3aef47a", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353887, "uuid": "5ca2c908-8030-4934-a021-97c5478eae8f", "comment": "Malware payload", "value": "e0009d2cfd02c30adab021887eefe02f014ebf6e6849ba465aeadb4a29b2070739c20ae72d425e90eb80702dc95636b2", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353887, "uuid": "15566712-8d8c-4818-861f-bf19af059f7c", "value": "T19C6633309E911D27C2A083B9B17F7E35AE7D7613418890D37EDCA68A2747FD1521F8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353887, "uuid": "f6b2bd64-0817-4f8e-87ac-5effad588e36", "value": "49152:jfbiaj0aGAK7nf8kMEpFrCOYfh2l8MAVjijMYRy2I+T2qEYEH8NdXdxbTtuCNxlK:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353887, "uuid": "f4e29e3b-5531-47de-8feb-cceb0259d133", "value": 6610944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353887, "uuid": "83c79ab0-b0af-4fe5-870b-0b7e0631cd11", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353887, "uuid": "8eea4547-593b-4b0e-80c6-42954400e1fc", "value": "RV08FO3342TUMVOuhaa_Desv412936.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fce6778-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343076, "uuid": "b4897708-54b0-407f-a130-54002b6ce7cf", "comment": "Malware payload (Grandoreiro)", "value": "727c62711ee6df670e990142905ec998", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343076, "uuid": "49f9bbbf-36fb-430c-abab-e392adaa6044", "comment": "Malware payload (Grandoreiro)", "value": "85cb086ad6d250ce0bb1889fe1a0b83caf305cc8a9556f732a40cc3850ed8a92", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343076, "uuid": "92214e8a-363b-444f-ae4a-6a667dd50004", "comment": "Malware payload (Grandoreiro)", "value": "d1882caa80412072bb0f064a2861df966353293c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343076, "uuid": "f723ed1e-7588-40d7-bdb7-ce46aac684e6", "comment": "Malware payload (Grandoreiro)", "value": "8c58c4b6a47f0579fa3e27f62647b2562e20e525ff813044989e265239b65630c82e9627b9c73dbe369f2d6dc8a29a6c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343076, "uuid": "a2854a3e-3082-4e05-b57b-e122a02b8f2d", "value": "T15E763332BE419D3AC684833A752F3E241E3D66638B8CE5D3719D628B2B47DC2993F451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343076, "uuid": "cc241006-10c0-4407-b83b-82b44367243e", "value": "49152:X8vvzK9NHeV5AJw7KqVt953+iZ8QZxjbgQiet0XYnTIfZSDCChx5iwkCTurqTIAX:Zer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343076, "uuid": "ce4bb540-4797-4111-91ef-993a1be1b1bf", "value": 7200768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343076, "uuid": "cf8f38a3-db4f-44ee-803b-e73684a98813", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343076, "uuid": "f8efe92b-1d2c-44f0-a348-25a8e38fd116", "value": "AnexGYZLOV98270_2SZV53491CQCYZ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcce608-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312816, "uuid": "a00b8a5b-ce3e-4e7a-8f42-2f614ac4a100", "comment": "Malware payload", "value": "7874dd098ba9da2d61de2ffce3d1b894", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312816, "uuid": "97379051-4a48-4663-8895-66e806c4b7ed", "comment": "Malware payload", "value": "866a0803d06c7941e9ae87cbe83c6d85267c43299b09b9edabf030d54bee2676", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312816, "uuid": "c42de02f-171b-46c5-8b4e-10d4902eeaad", "comment": "Malware payload", "value": "5db50a8c396ec481a11cdc9fe591505b3995b8f0", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312816, "uuid": "fbd6fca4-2505-4cdf-ae73-9fb7ef8fadf4", "comment": "Malware payload", "value": "f33be93366edace8e3c63e72359ab6ce6776c86fe1dd3f55210235eb3853d182dde999901c56e0f03b253bf058d28a64", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312816, "uuid": "f4473b51-d743-4c80-af2f-9eea30792903", "value": "T134E31B9B928003B50573629BF94EA1EAF325C07D5313A218BE4D67AD2366978533F1FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312816, "uuid": "f0c6824b-58e3-4f7f-9d9e-424b52c2ff7c", "value": "3072:u1Kk18ywXMBm3fJ9DRZoQnhOGEeaIu+JDe:Xk1a77DwB+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312816, "uuid": "1426e20d-b345-41e0-abe2-13617c2e3b6f", "value": 149567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312816, "uuid": "12f2041a-fd5f-40fd-965d-cde6e351c4a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312816, "uuid": "a33f79c2-25cf-41a5-8a6e-0581f04e6e55", "value": "walls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda91c5d-0bca-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771310135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310135, "uuid": "8983db41-c39e-4ba3-93ee-4ee626ed6abd", "comment": "Malware payload", "value": "cae1c6a861a4e8cbf642da00c84818ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "polygon-qbetfhwz-xyz", "colour": "#7657E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310135, "uuid": "a3f22dd1-eb58-4f9e-b8e9-e78a53b4feaf", "comment": "Malware payload", "value": "86739eab87cab6951ed5233f15324228fa4054c1f323cc211c3b6d3197b7bf28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "polygon-qbetfhwz-xyz", "colour": "#7657E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310135, "uuid": "a398c674-64a6-462b-ae12-28e7ece703f7", "comment": "Malware payload", "value": "96c61ec65661f797e60d5e73186cb4d9b782d3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "polygon-qbetfhwz-xyz", "colour": "#7657E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310135, "uuid": "53ecc046-15e8-495c-b347-c6f345b2125a", "comment": "Malware payload", "value": "f59d3b7864b5145b8a7cd2704ddede59ac4b53f59c7cb7b2bb06c171e46be04fc9dd09ad4fb8c58a3038d582fdaa55f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "polygon-qbetfhwz-xyz", "colour": "#7657E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310135, "uuid": "0300fa31-c93e-4531-8588-2f5445fe30d8", "value": "T1BF545A2D679519F5F9BBA075C987A7BBD2A2B0028360739F27B186761F23521F13DB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310135, "uuid": "2130bb5a-7a28-4754-83f1-0b8ef424a8cd", "value": "d87d2bb39fdbb3151d8e2aff4f51c9ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310135, "uuid": "ca1af9ab-29b6-47b3-bc86-b56d8645e21a", "value": "6144:Q7+bA58IKiD5lcnAURwvaYnSYWVpKWnmgVY9ibfeblYWDPDdziw9h:tA58PillaAUoaSdWVpKWnmyY9GpWDISh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310135, "uuid": "e43c8138-d9fb-43ac-9d3a-9078007c0187", "value": 287248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310135, "uuid": "6676605e-b513-4249-a981-54b29774da5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310135, "uuid": "cff5318d-b422-41a7-9cd4-e2b434b6a0c0", "value": "86739eab87cab6951ed5233f15324228fa4054c1f323cc211c3b6d3197b7bf28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a02e9ef-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309001, "uuid": "6377e667-eb04-4ede-8c5c-3aeeb1c4de2d", "comment": "Malware payload (Mirai)", "value": "52b86ba20ae1c888f0dde190e111a02a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309001, "uuid": "e063f540-3b7d-4534-880e-b9117bb1c64d", "comment": "Malware payload (Mirai)", "value": "868bf0eefaf419a4e549a93125db2e30b82b5c79a670fdd91f223e69647093eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309001, "uuid": "1b9a4d29-2ca2-49ce-8b48-fce0b314d944", "comment": "Malware payload (Mirai)", "value": "69444b156ef94dcb5e8a30654c8797e0dc8cf665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309001, "uuid": "11ba04e9-3c09-40db-8610-914e2ee54fd0", "comment": "Malware payload (Mirai)", "value": "9b7609bf5562b3126e8082dfee933c22328354485f70b1d41fb86695c3cfd483af1edc81e407f20661a194ababac92c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309001, "uuid": "f46673fa-0c26-46d5-a752-fba6729a6472", "value": "T18423F159EA1968A8C8341AB4D5D059F96FA90A44F0FE34A3B35C5F1CFF8250AB87F142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309001, "uuid": "45958c2a-b746-4206-b4e4-28189aabc54d", "value": "768:axx1HZLnpYPxQvazkSrOW9zRy2dSiZ4+9q3UELbod58P2xa73kYePLd:axxhYiaYiOWBs2dnmjLbod54QmeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309001, "uuid": "29600ca3-63ea-4de7-8b5a-083742820e5f", "value": 49220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309001, "uuid": "a37e7b6c-f985-4af6-b173-d3e875d6a267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309001, "uuid": "b0a1ed7b-263e-4bb6-b315-98bf6b5a8a52", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2338bb9a-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349336, "uuid": "8b71f11f-f78d-4833-ad68-e600fadf51f5", "comment": "Malware payload (Gafgyt)", "value": "8d480a73e7774e3fe3c697599bb65416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349336, "uuid": "7936e1ec-b37e-4597-8e07-ac81c1959420", "comment": "Malware payload (Gafgyt)", "value": "86ceead9a46f2c426983f96f8c298b0cb0807a657f5f899f6dad7ff6b53f8635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349336, "uuid": "67055f63-b25a-4b23-845f-0fe5fd8d7221", "comment": "Malware payload (Gafgyt)", "value": "41f4171b0636209c01408330ccc5760ef766172f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349336, "uuid": "2f84c3be-4d22-4ef3-b054-4b043c199dad", "comment": "Malware payload (Gafgyt)", "value": "d76f47cca7645f38d22012b47164b7f53da3e15a6df8635a30086668b0fdb53aa0f83178f91919db849d85d9318bdaa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349336, "uuid": "3123e58f-96b6-4922-9731-c025195d489f", "value": "T108934B0799A59FB7C0C7EAB919FB59300316A8520B2F1A59613C6BF4438F9CC741FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349336, "uuid": "04ffb518-6ee6-42ab-81c7-eca34f9d0010", "value": "1536:zU7Ox4Io9+wLAi5K5msuxHh4U6vpVymCS6dadmW49VquLeefkcX:QZIoxLAiA52Hh4jymt9m79VquqefkcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349336, "uuid": "ffdd5009-0459-46b1-aec5-bd2819465ac7", "value": 94352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349336, "uuid": "b10cb76c-eaff-4f9f-bcea-26716c657116", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349336, "uuid": "8287d6d7-1530-4620-bbe7-64d2b5cb3597", "value": "powerpc.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2f3443-0bcf-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771312035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312035, "uuid": "b14500b9-2012-4f4d-af40-87343317b7f7", "comment": "Malware payload (QuasarRAT)", "value": "b146a41e53f26065683cbc40e7c7bc6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312035, "uuid": "52c24220-aff5-4800-a1f1-d3c5f899e82d", "comment": "Malware payload (QuasarRAT)", "value": "86cf3714663b45d031c6ce0ba00e7c572f89a1b233efca12de3dbd5d7cc8f7c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312035, "uuid": "2b5e0f2d-13e9-4bef-8065-71da585f16ad", "comment": "Malware payload (QuasarRAT)", "value": "8dc0b8e564d70e73e8dd84c05764c7b666bb9ee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312035, "uuid": "77e92fab-deb3-405b-99d0-e84de3691ae1", "comment": "Malware payload (QuasarRAT)", "value": "27109ad2dc7509459766e9be35b7b61baed5d8be544543fb7152381578243cd80ef58bf31b0ac92cc130455cf0f1fdc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312035, "uuid": "14514827-c502-4e83-a26e-fc16cd494378", "value": "T15F46B0B876047CE6A67F537BCA96ACDD03B626639ACBA4CD406477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312035, "uuid": "28e7d6ab-f42a-4bae-9560-0146ffdef94e", "value": "6ae3a9becf7375fa33bfeade501ca778", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312035, "uuid": "b59311d1-3721-483c-bad1-901638fb93c6", "value": "24576:G27bGw9CGSAWpgAGskV5/hpTmq59EW0sSMBabeZ9SFGsxZZsSNzqmqjfsOec1x+y:tGw9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312035, "uuid": "7b7794f1-7204-4479-a072-cceff4b4be58", "value": 5636608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312035, "uuid": "de1e1a7e-771d-48e3-bdf0-b975f4020964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312035, "uuid": "19095a35-8839-4091-95b6-7654c5cca0e1", "value": "x86cf3714663b45d031c6ce0ba00e7c572f89a1b233efca12de3dbd5d7cc8f7c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24089525-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342895, "uuid": "a59d57f6-6185-403c-99f7-20a498ec4442", "comment": "Malware payload", "value": "b645aa01f751f754ce9c358a400c6cf1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342895, "uuid": "0c00e18e-40f6-4afe-b11b-90155e2e646e", "comment": "Malware payload", "value": "8813c22f932efaf50d1d17c03aed6d6802c9f653dbc0ae801b57dd18b804d3fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342895, "uuid": "9766b889-5323-41f5-9591-69f4ce7967fb", "comment": "Malware payload", "value": "d698c89636aee06cd9ce29e8c2a06544c055ff1e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342895, "uuid": "ed5c40f2-a940-4c89-8478-140efd6ce353", "comment": "Malware payload", "value": "a632019dfff0318dad0907d8cecfb59a0e2a9143070838ef6f54bb4ed5260968e3a63502ca4a9096dfaaa6fd05bc8d9e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342895, "uuid": "22856723-1436-4465-8232-eea5056f1d9a", "value": "T139F2876A9BC77A44A7C0463E8EA9974EDF116D1F4DF2E2D7CEA33C899092A00FD1501D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342895, "uuid": "a56b4654-0d15-4767-bacd-8cff763aaa88", "value": "768:f5JaZEIQJwpy4qJKR6NCjYN4mkvmj0XLc1j9HIz:H4jS/u0Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342895, "uuid": "53733fe9-3d32-4ef9-b484-2633199e5946", "value": 36768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342895, "uuid": "35249719-e5a5-4f1b-bbd2-74e72fde9417", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342895, "uuid": "b4821cb0-efdc-4bde-b04d-3557198c06f7", "value": "documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d70254-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309162, "uuid": "afba4588-acb7-4824-b24c-be0a1dcac97b", "comment": "Malware payload (Mirai)", "value": "dc47c70a493f63214d9096af2a2cdcdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309162, "uuid": "79f4387d-29a0-49cf-b84b-06fcb876a4dd", "comment": "Malware payload (Mirai)", "value": "88683bda10a8e51d73a72f596a3f05ed6b44aa1a56fc758db66cdc55fdbda4c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309162, "uuid": "0130f14a-ac0e-48ea-bc76-4500c318160e", "comment": "Malware payload (Mirai)", "value": "fe4d2d0c7acb3edd814ca51074449cf155e3e868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309162, "uuid": "e3601ed7-1f36-4a8a-8793-f28b45c58edc", "comment": "Malware payload (Mirai)", "value": "0e51ac03019fcd0990c3ef1c488989e005931c78ba899a1cc94628e978aa271a79d7329cada43afe90e62ea939482c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309162, "uuid": "f5238af1-b0da-4362-9e19-cbaef1555a7f", "value": "T1C2833A55BC818A22C6D112B7FB6E42CD371653E8D2EF3207C9255FA5378B82B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309162, "uuid": "780aae6f-64cd-4dc4-88bb-c8f0ef0a71fa", "value": "1536:mUjGYM6OnSEr9VzdICfkW9KGH7OsvrulCqMqPr5X1SToBHoPVuqX0TaOkIqm++OJ:mUjGYVOH9BdV7bf6gqrr5FYoBHoPVupE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309162, "uuid": "e907331e-248c-45cf-98e0-cf43e151f021", "value": 87364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309162, "uuid": "09c80ff6-1299-4415-ab0f-9e6ce54bc3dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309162, "uuid": "80bd1a87-22b2-4c76-9add-8229beb6f028", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d000d540-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352632, "uuid": "bd1297ef-2a0b-4efc-88db-573bf398c0e3", "comment": "Malware payload", "value": "7a38fd0fcbbcd7e1753cf34396e0b628", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352632, "uuid": "93ab5b25-802e-46b5-bf8d-76087e83d591", "comment": "Malware payload", "value": "8878c2559ed4cde56621c39ec505a6f0cd93a420b5750f14ff85e67458172494", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352632, "uuid": "a379a83f-72a7-4c6a-9b2e-bade8cfcb139", "comment": "Malware payload", "value": "d74c119c03ecbbdf440ba319ef337a2d7ea8bb79", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352632, "uuid": "be956ad2-6b03-4330-ab44-2b5b970cba10", "comment": "Malware payload", "value": "12d49604ccf741502b788900a31bcf8ed3e745b49483ccb0f48b2354993834589a5e95cb7f19947b800af041f6630db1", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352632, "uuid": "bd62f2f6-9085-4d7f-b9b1-51a86d51457a", "value": "T12B562332FB42686BC9818371702A1E613F7C77139588ADC278ACC59B774AEC4D63F469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352632, "uuid": "a043568f-2c8e-4766-a315-e0f544230272", "value": "49152:/709CMJzmQGYK1cpSJx3QXDGBjRTaQp1QBusfOIg6QaII1nu8AvS3gZ8IWjrzgu4:n9uim3YgmUAyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352632, "uuid": "9184bfc4-ddb9-4fa6-b9e0-8afdf03a6768", "value": 5949440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352632, "uuid": "8e383c6a-afef-411c-a14d-2e0ff789d5d0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352632, "uuid": "52b8c0b5-715d-4c86-a9b1-2d67a6d6c41c", "value": "Trm2LX8K-8342KMJKJX0E5D7_Expe.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6920276e-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311658, "uuid": "efc72589-9d47-41fe-a9e4-4e7072a04872", "comment": "Malware payload", "value": "a0c87d31ef81f6ad98e8865a78b61b2d", "object_relation": "md5", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311658, "uuid": "62d890f8-b130-4248-ab5c-d3afbe82e436", "comment": "Malware payload", "value": "8973fdb7bda16d8aae271c1578d481584560c0c47fcb572083ab06f7b569040d", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311658, "uuid": "9eb2b72b-fb55-4d25-93aa-22809c97d0fc", "comment": "Malware payload", "value": "49271ef7dabe643639087fd461ffd88f9e62dd8c", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311658, "uuid": "a5e3e8eb-9cc0-470b-815f-58d93eac9ffb", "comment": "Malware payload", "value": "34e387b59920347529afb187cdab0787743c0210963fb01db2e19e5ea1822d30631a776e36d2e0571e2788c3344ed878", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311658, "uuid": "e9bde243-3cfa-4d67-add7-5585e83b3d71", "value": "T1BCF08B3983BD9F4708C53816FA4E37829DC317322305B8B151B1D6853B9CCBA992A082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311658, "uuid": "bd9f60fd-6e2e-4383-a6f6-d0f08ba12248", "value": "12:ug1fPP5xHEzi0JksR8WFZgns7Y6N7Wo0H7bbpJ8WAHvE8Y:VRVEzpR8WFAdcWoujv8WGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311658, "uuid": "b587997c-686e-4a0e-95b1-8df0ae30bdc2", "value": 566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311658, "uuid": "a05714a5-bc20-4ad1-888c-5172e0e5104b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311658, "uuid": "21663649-fec8-4338-8ef5-07bc909a3153", "value": "8973fdb7bda16d8aae271c1578d481584560c0c47fcb572083ab06f7b569040d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da1511f-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300847, "uuid": "efcc32d6-81cd-44cd-9765-3f67a13cc530", "comment": "Malware payload (Mirai)", "value": "06bb85db0314ac3a91ed506d8e3d0647", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300847, "uuid": "9951e780-db04-4a98-be51-b6ca7740081d", "comment": "Malware payload (Mirai)", "value": "89a9f7d68ba02be11cda2cf8f668afcd879265339b1d50573401cf0caafae9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300847, "uuid": "1aaa16fa-54b1-4bae-b576-372754c08863", "comment": "Malware payload (Mirai)", "value": "29ee4346edc8770894ae15a7b4aeece3b15e32bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300847, "uuid": "eded403b-b757-4440-8ef1-7c0ce4cefdaa", "comment": "Malware payload (Mirai)", "value": "c7c99b11ada9c48c0e0abb70d3a7cd702c949f856d3e0e34948efd6069a1b14fa46b5a1adcc812af4e6c8ec4c819959a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300847, "uuid": "7756b1be-b3f1-4625-b7ce-aa1efe42a3e1", "value": "T16163B81E3E318FBDFBAC463457B75A259358239A37E1C5C5D26CE6012E7024E241FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300847, "uuid": "fa6455c9-2c0d-4050-8d86-f9d0c623c8c2", "value": "768:Dq7kbHlAvs6zIi+z7pcKHt006+X4AtHo8ucyNG8uwA+UHJUQBnlaiXJHmwx:e7kx4s6ELZHt9X4YlwA+UHDzHmwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300847, "uuid": "7d15687a-0dfc-4dd1-a5ee-7e5839cfb5a7", "value": 67988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300847, "uuid": "3a5b908b-bae6-425f-a110-dd31594c6060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300847, "uuid": "0b05c117-2b19-442b-b28e-9212ec415c6c", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82490519-0c00-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771333175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333175, "uuid": "955b0e17-3c87-438c-a098-1b363e98e94c", "comment": "Malware payload", "value": "27424e606652b93bcc6f07c423d3595b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333175, "uuid": "22990fb7-7550-4ff8-915d-3fa06086df0e", "comment": "Malware payload", "value": "89b71be2e681ed5a10e5e3ba29d9a597e01fdbf1d9d9cdae26c3cf993759bfda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333175, "uuid": "52cfa493-c854-4945-8b6a-5f986422de1d", "comment": "Malware payload", "value": "099cf55ffa39c1aa39e22f8366770d85d0f356dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333175, "uuid": "297a7baa-dae8-45af-861d-ea3f767382f0", "comment": "Malware payload", "value": "b43d2a38e8d210d920f3635e83cb7bfd24fc29153fb96027c77f413e92197364ba350710edca9eebcd8382be5f524f62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333175, "uuid": "9920641d-78df-499c-9f49-27ae20da1244", "value": "T122B42320B73165F3C3B45D9C05CDFCEC9A66868011962ED7E9A005FE868AB435FC9DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333175, "uuid": "d9ba3353-5484-4259-bd67-f3eee8fb1ab7", "value": "12288:Cq3fzffTItBUXwVdDPOjS1tbozv/pRxKGAQeA+q:hzfEtBkjj8t0D/p5fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771333175, "uuid": "9d669e43-5e53-4abd-8bd8-90a668e06278", "value": 507644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771333175, "uuid": "423813a0-293a-4536-98a1-9ced9305f8a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333175, "uuid": "0cbc9978-ae59-4e4a-aacf-c7de38fd7516", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e276efba-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343214, "uuid": "abb12b2f-51ea-41be-8717-2a37bc43ce4b", "comment": "Malware payload (Grandoreiro)", "value": "38e03668261eaf8e4cae4c79d5924fa0", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343214, "uuid": "f8387739-6a6a-4356-b08e-59637a587e98", "comment": "Malware payload (Grandoreiro)", "value": "89f5f7863df1b98da6895bef218474eb02cea923ac713ae107bf19a223ea49d7", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343214, "uuid": "95d17672-a040-4c1d-9f75-2b5b4c3babcc", "comment": "Malware payload (Grandoreiro)", "value": "dedb8faeb3c5173b713cc30f8916afd8c92e27c7", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343214, "uuid": "5c1ec835-5353-40e0-a4a0-d69f62eb8cf4", "comment": "Malware payload (Grandoreiro)", "value": "cce2acc68b4093e1dac8421ec2423ec7e213ea3ac6749628141c0f3f228300d3624196206b5f328ce2337d0b057056bf", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343214, "uuid": "7bd25696-b410-4342-b4b4-47eaaa5a97a7", "value": "T118562331BB069C7AC6A10735703F2A372EBD7607464DAAC2A5ECD163730ADC1497D8A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343214, "uuid": "56e06192-65cc-4687-9538-cc1fb807a655", "value": "49152:+sgeMsLy+jbwOqHPIYQaSkKf+kYL+VNmzSn5ihqRAZFTKP+FmTrk+yQxq7uim3Yk:8uim3YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343214, "uuid": "d2098ec2-df88-4c26-acbc-ebd8455936aa", "value": 6027264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343214, "uuid": "97a21a1d-7be2-4d0f-9bcf-f900da23fdac", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343214, "uuid": "6d88ca9a-3c1a-4bc0-b33c-d8306a905ae6", "value": "FnzHVHSFX-51878A6V8RDMAGT.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8884d1-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311074, "uuid": "1c70a9de-7225-4e9e-83f2-3d356455f247", "comment": "Malware payload", "value": "590c467db3975a0501d707c0ab2b3845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311074, "uuid": "06cd449c-64c3-4544-a172-9ebe1c1f07d6", "comment": "Malware payload", "value": "8a11c147e5607a19a11cc7ce1a1dcf34fcbcff8da7b5e538c4add5c31e321a05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311074, "uuid": "04f9d92e-2511-4f5e-868b-b33513ae3f23", "comment": "Malware payload", "value": "acc4bde1f152033d7e20bdaea9ac8ab902738ca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311074, "uuid": "0b2fcba8-bc3e-4b3c-b79f-f50909947c02", "comment": "Malware payload", "value": "a0f5a5ce38af03a22d1f97975a3e41509b3b6c3fac3c6dc16d3ba2d15203d5ac5baa6702620dd6c15b9d7dbe0a5e2bbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311074, "uuid": "a804e062-d31c-43ec-98f4-bf979a59dee7", "value": "T16E63095ABCD19B1182C417BAFD1E528E33131B7CF2EA72129D106F64678B96F0E3B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311074, "uuid": "054c7a64-35e1-4528-84f9-f0aedc97f613", "value": "1536:E7nAj3snvZqD/i6vxqHZmOmiz9oSFcY1rU9f60vaKsYX3uV7l:XbsvZqDiwzipof7t60vaKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311074, "uuid": "74f8971f-e570-4ee4-b3a3-230f71dc6d4d", "value": 70158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311074, "uuid": "a8b09b98-5473-43e3-9635-95f3378ce101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311074, "uuid": "1ba6dcfd-3cc8-4fb1-a0ab-822e945e3508", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67412402-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341719, "uuid": "40554686-f87a-44ea-afde-0f1bb1ce42f9", "comment": "Malware payload (Grandoreiro)", "value": "2470eb15a211895ea2cd3dce6dc1b705", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341719, "uuid": "f6d401b6-bb63-4d44-9770-2c66e43ade1d", "comment": "Malware payload (Grandoreiro)", "value": "8a1caff09f7142f6603866e4f4fae917949de6816590a97601b8ebb9f7358142", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341719, "uuid": "0275a2e4-c5d8-4e02-bab3-1de9646233cc", "comment": "Malware payload (Grandoreiro)", "value": "4497b72c3cacf8278fd6aebb3945ac57fc5ffe3d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341719, "uuid": "a36c3cbe-bcc2-4cf8-87ce-5d3a82066fde", "comment": "Malware payload (Grandoreiro)", "value": "c207dc5d68217126fd2a5d21d9506492b1e2591778d4e13e0a6e0079baca1fbf97b45fb793fc88a3aa387f409a7e3dba", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341719, "uuid": "5355c34e-8806-4dbf-9282-3b03605de949", "value": "T1CB562339FA865D1AC5404372793F2A325E3C73178689A6C278AC81833F47FD6663F865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341719, "uuid": "9afd9763-e5d1-4d0c-bedc-1058b9e90386", "value": "49152:MBWsWU6w28R7h1H1sL356JZG1gBDYXyjj7aUCpsTd2v/ofhA0Ug5Bez00GlgyrvB:czq49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341719, "uuid": "c2d35c7a-ddbe-4b91-934b-3f88155257bd", "value": 6391808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341719, "uuid": "ad00079f-abe5-4f1f-89b5-0b66eec16b17", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341719, "uuid": "00c210e2-2ed7-45c2-869a-fcb4d85f6bea", "value": "0Ord05405_ATJYX06DX-Judi0367.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8e4bec-0b9b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289709, "uuid": "000b20d6-7276-41e8-9b4a-e4d02fcc3c09", "comment": "Malware payload (Mirai)", "value": "1ea4d5b78481dae6ef7c65ea0bcb94b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289709, "uuid": "9e2baead-c977-483e-87e9-52aa1c22b930", "comment": "Malware payload (Mirai)", "value": "8ac4ee7362fa7a9f3104986d568842e795b2a5bbbc9707e43da0a0b01a0eac84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289709, "uuid": "fc233a4b-be72-46fc-8d15-7f0890825d46", "comment": "Malware payload (Mirai)", "value": "5920fa9a21c17375d3dbb6b88016b0b8e11d0e04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289709, "uuid": "5c1fa041-0287-4920-b0f0-bcdee71c3620", "comment": "Malware payload (Mirai)", "value": "44178868ddc38e065a9a2e23224b5a16be064f25d5755dd95455a5fc59c062849361abc6014aefaf49377bf99ec21d31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289709, "uuid": "306d1112-4555-4718-8be0-02468fd65984", "value": "T13BD47D9CFE5E3C42E2D7E2789A4987E1731B71E4D32391A33982430DD5CA9E9CBB1512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289709, "uuid": "0eab6df2-cd60-4976-b674-d96c073da641", "value": "12288:qX1WY/PthMOM5YTxYYovqcWQZA0rAfFsaFqZEAnFw5nzUB78n6WM:m1W6PthZaVvqzQZxr+wQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289709, "uuid": "e47346e0-f7c4-4dae-8a2b-9c96b5442c01", "value": 653632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289709, "uuid": "b7a559ad-0786-42e0-bba2-e236d796e529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289709, "uuid": "b570e5a2-d382-49f8-88a2-b6c0b9b72a05", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fe7829-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343969, "uuid": "91fe1c55-60f3-46b8-a091-dbc475435796", "comment": "Malware payload (Grandoreiro)", "value": "579798b3e01ca517be438da078a54efb", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343969, "uuid": "7bd48008-da1c-40e2-b012-dfc475accf7c", "comment": "Malware payload (Grandoreiro)", "value": "8aed73ff0c2e2f366d7257659897deb99bf43a87b1b412f59aa913ef91a17fe4", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343969, "uuid": "66677c83-cf91-43c6-8fc9-1aa8f54fdd5b", "comment": "Malware payload (Grandoreiro)", "value": "7b15e8389fcc18e70b8fdbb246985602de4eaf99", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343969, "uuid": "5901b354-482e-454c-b043-e9b2ecabcc3c", "comment": "Malware payload (Grandoreiro)", "value": "4092b48f220e39c747acf952f22c589ff74cf635ca595c98e7710e7df16ba6f7a3b3576f73b6f3f2831020b4f1f72267", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343969, "uuid": "498c1f6c-7d47-4f9b-9962-d2347b39ce75", "value": "T100562332AB12886BCA5482B5B02E7B325F7CBB539649D5D63C8C90473743FD1D5AF8A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343969, "uuid": "06bab893-c3aa-4530-a0bd-3310e4d841f9", "value": "49152:3+3FT3Hf9uxCrmdaNzVnl8BCxL2YyV0Pom2affpr2SDFBFsco2GGeJiFx2unnfgi:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343969, "uuid": "9253c745-cacb-4cd9-858e-f81a3af5051c", "value": 6305792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343969, "uuid": "8fb5c87e-ec56-4799-9a54-cc7fb1b4f343", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343969, "uuid": "f8e9c609-7b4c-4e34-8ac6-1d68d832aca0", "value": "P1Y1XKUHJ_Acr560627-B65S88.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f927af-0c33-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355028, "uuid": "f0952f70-7553-4928-86e9-5645c9114905", "comment": "Malware payload (Mirai)", "value": "c4306b6b4f3b9e8698966dbf8bb36787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355028, "uuid": "b0568651-f052-40f5-9e97-052a9099eaf8", "comment": "Malware payload (Mirai)", "value": "8b19def01d52bd811758c34f1fd875b8edfe28bc16118824f9c5347b8e725a77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355028, "uuid": "d69847c7-9dca-4427-912d-686c6b754546", "comment": "Malware payload (Mirai)", "value": "baea6d2d6da6b61b6a9312306fc511f2724db875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355028, "uuid": "b3e581b1-0c34-44f2-8fd0-35c111499521", "comment": "Malware payload (Mirai)", "value": "7cc02bd6497185169ac1a838fe32307ec468107e5bad34f3067bb2adb1fbaf1a6c16496ab45d2c3ff2a8b7129773c9b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355028, "uuid": "4356fd9b-9a9a-48d9-bbd4-a60eb6092516", "value": "T192D3D706AF610FB7DC6BDD7706F90B0235CCA85B25A43B757534E828B60A1CB59E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355028, "uuid": "d4943500-0588-48a2-a528-df2210122319", "value": "1536:kPEmUFbJ4a20Zfkv1HizhmJ0oNkGOrIzWROjJ5I6S1murbdc0+eZlHBW73RcLnJ2:46AwByoQpkGOtB1mz0+ev9EZFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355028, "uuid": "2d5cf996-86ac-4f22-9015-5e2d2a6531cf", "value": 134936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355028, "uuid": "cdf65ae0-5379-413f-b95c-34fabf202913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355028, "uuid": "5f9ba27b-eb91-4278-8ea5-52e50594b140", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999db2c7-0bf7-11f1-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1771329348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329348, "uuid": "3f7bd7cb-8382-4ee2-842b-3e87b9a3b3eb", "comment": "Malware payload (Meterpreter)", "value": "d660c2cdd520c5e64585b04f22cdcc9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329348, "uuid": "7439e6f6-b9d8-4dc2-9e37-6c13154df283", "comment": "Malware payload (Meterpreter)", "value": "8b383785a944cc245cce7dacf05dac6ec6cfc0ed5798959b9a6c230a95e18cd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329348, "uuid": "f919d822-6e67-40e1-83f4-4b5fbe838d3b", "comment": "Malware payload (Meterpreter)", "value": "e02daa2cb652915641aa59ad21f4c0f6c5822e9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329348, "uuid": "5bae0e31-090a-47c6-8bf4-4c0406aba485", "comment": "Malware payload (Meterpreter)", "value": "fdebc270cd4d001c8933948c5785964950add0659d02ecb407a7fc2095047ef0235d19a81ca4ebc26a80016a394c02c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marte", "colour": "#72DA54", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329348, "uuid": "6462ed50-a45f-4266-9520-6591e076cc88", "value": "T1BFF1459773155CB6FA390BBF8643CFD693FC7B345397071A0168011A615152A7930F82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329348, "uuid": "9509fab9-6009-4db5-8e6a-c589714de1a8", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329348, "uuid": "2b06c27f-2b34-4095-9976-a0f331c0e2ed", "value": "24:eFGSGT9EpFaknehtht6dp5R86WY+AwKZq5eNDMSCvObp:iGT9EfnehthEdGi+Aw7SD9C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329348, "uuid": "e042d367-ebef-42ec-b74e-78e20d7a60a8", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329348, "uuid": "c1ac55f8-11b3-48da-a379-d9b12dd97fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329348, "uuid": "6da0d58a-8ead-494d-a449-aa9f57108118", "value": "svc4444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393bc60a-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309000, "uuid": "01415ddf-6669-44c5-b453-cc13819fedf5", "comment": "Malware payload (Mirai)", "value": "6b6a28c8828b1eb6ce3adeadeab30800", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309000, "uuid": "c950eee1-2f5a-451a-81f6-00a27a4115f4", "comment": "Malware payload (Mirai)", "value": "8b4fe3b1ca07a3fbfc7d0ba233b6cdcefa2528699e06687dfc4dae8db66418e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309000, "uuid": "33783c99-7207-4c3c-a272-72874bb81989", "comment": "Malware payload (Mirai)", "value": "9b44897ca78b0e22b3c822605fa26ae12b9f0454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309000, "uuid": "14223196-2656-432c-af81-6826a278d32a", "comment": "Malware payload (Mirai)", "value": "ccd26f9f25f9740d982728a16a7fa5489eb8888de82fc1c7a32f4a41f3d167a3871798cd8d2a8a6fbe8778ccfb7ca1c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309000, "uuid": "6d7d87b3-79ba-47c1-bcef-0423ddc3542b", "value": "T1CE332AD6B5029DBCF95BEBBA8413460AF531B7561083063763BBFC53AC361A44E23D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309000, "uuid": "d1b00367-c56b-44ef-8ed2-2053ea9489c4", "value": "1536:qN477eh2D9fV7HgEgc8eh1gBUxCWQ1v7d:qU9fFHgxGu5W+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309000, "uuid": "45850cfa-524e-45be-9687-d35169489b39", "value": 53024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309000, "uuid": "2ae1f41e-5eb7-41d6-9bed-0ff169f08c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309000, "uuid": "04b051de-bedd-4971-ae73-4cbd6f93d807", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2d73db-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1771312872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312872, "uuid": "06b17827-91a7-42ba-a5ac-237b2740ae40", "comment": "Malware payload (XWorm)", "value": "a3397025b88320ac39758d8eba446f63", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312872, "uuid": "1e1c9c25-8fcd-45f1-9587-c35ad2710c0d", "comment": "Malware payload (XWorm)", "value": "8bcb49d7c3bb3d5e54671f4e347f93ef660ee3a9f26795d177c49cef8900e7a7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312872, "uuid": "a3a5f09c-e4b9-4860-aa42-b45d69335f3e", "comment": "Malware payload (XWorm)", "value": "b786d596718e3bfaa40bd31b99d7d8221f4c33b9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312872, "uuid": "ad77d883-2331-492c-826d-dad7c9aea8de", "comment": "Malware payload (XWorm)", "value": "08741a86f092d6506e3657c7756a12211b5fbaa03bfb31165a484e835ee45c69f5731331e82764d1766a085aa130848a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312872, "uuid": "4dfb9233-579f-45b3-968c-aa09afbc6119", "value": "T13B7512BAE1E1327B9077333BDCEA818886B316CACFA72D143A7137C96655D084D53D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312872, "uuid": "6c74b107-2a2c-497e-a797-3d52c1cdb42c", "value": "96:PuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuT:TUfU6Y00yjXRApsjhhLJk4C9SdJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312872, "uuid": "0418515a-a044-4e2f-9ef0-b985188ea783", "value": 1561017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312872, "uuid": "09f5d829-416f-421a-ad4c-bbdbb710f117", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312872, "uuid": "4016a7c5-52d9-4dbe-b1a0-a2af7ab35880", "value": "a3397025b88320ac39758d8eba446f63.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91e41c2-0c49-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771364700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364700, "uuid": "37d25d0f-4553-41a1-bdb9-611f324976f3", "comment": "Malware payload", "value": "b09cd68771785785316025d7faffe363", "object_relation": "md5", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364700, "uuid": "8e2b4a19-ee45-454b-a20d-e67753dab363", "comment": "Malware payload", "value": "8bccda3153ba7e10950c4b24b84637daeb8f8a54c2311f867d5634a060f7de62", "object_relation": "sha256", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364700, "uuid": "8c5d563c-78da-4390-802a-9cef38bffb87", "comment": "Malware payload", "value": "9f90d13d14fbc9c21ca6786ee96a3a7d28f56537", "object_relation": "sha1", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364700, "uuid": "d6085e70-9b97-4f11-9f1d-c05028120b5a", "comment": "Malware payload", "value": "0aac84391df5435c2200e2589e26fe016a7ef1ed5bd7209c039fc9e1beaa7b184e7d20da3b6105c1367f43ee5f30981f", "object_relation": "sha3-384", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364700, "uuid": "2d627e9f-6d41-4840-87ef-51bbd2c5f044", "value": "T10C179E201F5CDC96E4F26807D78EFB25197BD601A74FD09893BF18F9AD11E26A8CA1C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364700, "uuid": "dac9369b-708f-43cb-96b1-b9d5fc5b1f7b", "value": "196608:npWGZQdcZS64vOkWtUVbteGISCZLQNRhX7Hz+gZPaGPRu+ZOdSdIAGhOjSWmbvhh:nPbZ0h7z+mrI+ZOSGhmkZtBgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771364700, "uuid": "7822cad5-a853-4762-a086-b097485cc5fa", "value": 19333120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771364700, "uuid": "3351c034-0e9f-4a37-9362-2903c549bd2b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364700, "uuid": "62669578-755a-4dd4-8b6a-29f9321f11bf", "value": "logo.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdae69c6-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348414, "uuid": "9df683d6-77b9-4eec-a8e1-bb193ad7bf1d", "comment": "Malware payload (Mirai)", "value": "f6e995070e689dc58a0f2a1638f48b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348414, "uuid": "2f65743f-5375-40c2-9dfc-da92a028be5e", "comment": "Malware payload (Mirai)", "value": "8cda1dfa15e1a681a49e05ab5c5011aa034f6a7fd0b67bb6887fab1f7ccb1aa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348414, "uuid": "80731a37-f969-406d-9eff-9d1173ec139a", "comment": "Malware payload (Mirai)", "value": "44b2bcb3b844eb10b88e2dfd2b6d2cdcf0a19b9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348414, "uuid": "4bf68e51-cd18-4571-b848-c42a4d694199", "comment": "Malware payload (Mirai)", "value": "47197fcbc9fb3daf1414dd282dae9079ec00f3375b430239d38a27733d75419a4d14ddbca9f89bedf92da297ff35f2b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348414, "uuid": "ee9fe125-ddc4-4d11-a08b-62afd270ef5a", "value": "T1E7633A91BC815723C6D112BBFB6E028D372A13A8D2EE7207DD266F21378785B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348414, "uuid": "0631600e-5c96-4f2e-ad51-394f06d41269", "value": "1536:LL9Yr8DO0y0EUNJKWCMuJvuuKDjlPO12vMs/Fx:LL93OeCMuVMzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348414, "uuid": "4e58030d-a91b-486a-946f-795e3130346a", "value": 72688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348414, "uuid": "11d47b3f-b46e-487b-b9d8-1e056917e8f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348414, "uuid": "648fabd4-6b45-473f-a581-4aa39c0da14a", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b4a9cd-0ba4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771293579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293579, "uuid": "cc6c73f3-2de5-4169-8e32-ee28fcf1773b", "comment": "Malware payload", "value": "7d037ddc42d493003358e28fa3f9326b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293579, "uuid": "42cee6ff-ad64-48d9-9d5f-f31827c00451", "comment": "Malware payload", "value": "8d577a095d2dcc693ea232afc45c6c23dd83755496151ec708acc6216456032b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293579, "uuid": "7c6ae4d3-857c-43a4-abea-589e7b27dd3b", "comment": "Malware payload", "value": "af9c3f197d1d8ea941e2ecb418a4cff5890dc902", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293579, "uuid": "de2af1cb-9114-4931-8cc6-56bdc103fefe", "comment": "Malware payload", "value": "7f936a8cd090b4c0bb0a9937c0069244d2e434fd12f543f774c7ed1d0f90cfc68b1a7e9415351c27a24c4960bb3231f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293579, "uuid": "535d3aa6-e642-403b-9125-c421f6bcdf6f", "value": "T1F05423A39C520A7BF7C0667E991411C7E3A06EB50D2DC6189AFD97FC48924B5ACDCE30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293579, "uuid": "360b219d-7523-40d4-9afd-9320fdad372b", "value": "6144:ju//HKcG2wchSnsUNMzdaCCDUox55Qw8wRe8VoxI20cU01zUN1/Og:jEKT2wcEt0JCgox5Kzme8GxVvUff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771293579, "uuid": "166f9602-47a8-456e-9769-26a3630daad4", "value": 294652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771293579, "uuid": "c451d082-4259-493d-89f7-0e6214ecd1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293579, "uuid": "5a7f537f-f1da-412a-8537-ae9fe4578207", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fd0101-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343118, "uuid": "78dbc16f-20fc-45c6-b872-eca3e9ad83dc", "comment": "Malware payload (Grandoreiro)", "value": "bc60220478fcfe968354c7cc3f7280b7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343118, "uuid": "dca53e45-a0f7-4ee7-a6df-0ca274b5d1b7", "comment": "Malware payload (Grandoreiro)", "value": "8db3aa64fa5a4577a5466053c031144173576e51eaa44b378908baff10203796", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343118, "uuid": "29a7d3dd-d184-43ac-8d6a-944add2290cd", "comment": "Malware payload (Grandoreiro)", "value": "6824159a6912714c04cb2a2fae77ddea8221e650", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343118, "uuid": "651ad673-23af-47d1-b09f-26b0839c6d78", "comment": "Malware payload (Grandoreiro)", "value": "00af50caea389a051052a4cba97f5230d9a9cc1c7b68d00ebdfc002f688df927785cd997145acfb49571f9a763d65e66", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343118, "uuid": "81e23c80-ebb8-4934-8f2a-5a64fbf349dc", "value": "T1485623335E41196BC6A0C339B62FAD256F3C7B1356CCB2E2789D6542278BF80C86F465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343118, "uuid": "17429f31-156d-45e0-92d7-dbb4760b4d68", "value": "49152:LJuk+9Z7mIPtrRR0vMv0vnzxcpswPYx8h02s4dnTb5xzGfSG+DDHmKGB4DjG4Z+H:ZAAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343118, "uuid": "24dbe004-0513-4d5d-9d77-19e439483c73", "value": 6158336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343118, "uuid": "56d369c2-5f43-4329-bdb3-6d4061a23855", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343118, "uuid": "b000260a-8fae-4fc1-8564-a1348ec92a18", "value": "Bal-AnY49TEOBJED33845_60Z75T.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24392dad-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349338, "uuid": "fbdad266-1192-474a-b515-9a25e24409f5", "comment": "Malware payload (Gafgyt)", "value": "ce005e372612c30d0f170bc23f9efd35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349338, "uuid": "efaafce3-78aa-4b52-96cd-8e2318ab7417", "comment": "Malware payload (Gafgyt)", "value": "8e168858477261e04bd99da359fe7cf5278c30f42f67b14d2668282e9b8c6f58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349338, "uuid": "41b1955a-27fe-4016-8988-a4a3dcd45451", "comment": "Malware payload (Gafgyt)", "value": "53afecef0dc4611f8276df2757b2f44055d46887", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349338, "uuid": "f3adc93d-1070-4860-9af0-95566f1b8d8e", "comment": "Malware payload (Gafgyt)", "value": "68905ca993bed3326ce7f2a13b137ee0f21f2dc114ec1b3c2168721944444488d61c74454a18675b7601dcbe128342a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349338, "uuid": "7f800151-d9cb-4d53-aa6b-a53751d1441c", "value": "T114A32943A71D0F83C4DB99B12DB72BF1876DB97112A361C1690BEE900373AB81517FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349338, "uuid": "19a99811-3a9b-469e-af7d-6997a368fa61", "value": "1536:TQQfc83mRkvoP9OJcegUN1cXD3z+FavgG/nrEmL49VqFjtUfkjX:TxT3rx1n1cXD3mYfrEmU9VqFBUfkjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349338, "uuid": "0d97eefa-e8c2-4df8-bbc9-fe82c5ea63c7", "value": 99023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349338, "uuid": "d382d090-3eb7-4e7c-9e35-d08de902ec19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349338, "uuid": "4862a567-2e6e-44b6-9d0f-9fe193851dbc", "value": "i686.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2177e82-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343965, "uuid": "e2832fee-eaad-4b9e-896d-ca2bfc32a4f7", "comment": "Malware payload (Grandoreiro)", "value": "69a7bf6c1bec9bfb45416ee302a6b12a", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343965, "uuid": "79d8f8d0-71cd-48dc-92d1-7b2e99c64150", "comment": "Malware payload (Grandoreiro)", "value": "8e287747dba49ec19d67192eb172fd66297eebca8bb01dd733415a8d035309a4", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343965, "uuid": "ef9f6562-b8cf-49d9-961f-0fa929e631f9", "comment": "Malware payload (Grandoreiro)", "value": "9d983cba73cf8f266ef21fe0559ce60f835fcc25", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343965, "uuid": "4aec052f-95e6-47a1-b454-e55906c33f24", "comment": "Malware payload (Grandoreiro)", "value": "4a0e188b2eaa779a20986cf7a6bcf0eb4cee0f85338c1f2ced663998d5ea1ac468a02741ba7196bba0aa46cac279ffb8", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343965, "uuid": "89afd62e-ffff-47ec-8598-cc58e663a980", "value": "T189462331AE8A1D3AC6404776702B7F3A1F3E6A4343CC95D335AD93876B47AC2463B856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343965, "uuid": "ae4bd562-bcb1-4e02-86ca-ea13cba5158e", "value": "49152:JuY4OBDGF+l4oArD90TOpgVccMFUe7pCfkA0DG2U/n4xNEDqcUo2EimccWcPloeu:Mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343965, "uuid": "19b76497-ffae-40f3-93bd-54d3bc2597a3", "value": 5453824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343965, "uuid": "21294404-4c05-473e-89cd-7253f5a37655", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343965, "uuid": "9a81bbd9-613e-4799-888c-7d854f1fab05", "value": "P0533013Fch_ASTM68567HDT1H4.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16df9f8-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348367, "uuid": "7606e2f4-ff6f-4d50-a4b5-beb8bcd09332", "comment": "Malware payload", "value": "7c0c80a7be710cd9d70233d0e9f27ebb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348367, "uuid": "2d365e37-5313-4fee-b527-0ff89fe8b877", "comment": "Malware payload", "value": "8e5263851b1c747f12605cc88eb2475bf0c670bda7ecefbfd9ec8947316df67d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348367, "uuid": "cd2f5938-dd33-4626-94e5-fee50ec54273", "comment": "Malware payload", "value": "4d817ec27b78fdf4141d26ff013cdb398406f6d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348367, "uuid": "7905c445-494a-471d-9325-b654c9b6a975", "comment": "Malware payload", "value": "c424b0c07a22fc13a38c6df4fe7580f730ced9b0c18bb3a646ec5a3aeebf5af90581b6b3f316746e7589347b0548be66", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348367, "uuid": "b0e3fee3-7ae6-4151-ac2d-c3184b1ace4b", "value": "T11501E1CF2BA1F1458E0CAE10F16A06597945E7C032B45F59ABD47872D8DDA10FCE8F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348367, "uuid": "4cd4d168-ee4f-45ce-b61d-93e64a68d353", "value": "12:u1eLq/cj/iNIl5zA/P0LKj/uOs/iC/c//6cSE/otaKA/K/iA/KtfAn:lbmNI7dKS0R6cAtB//MhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348367, "uuid": "a7517662-87fd-4455-9537-069964bf10f4", "value": 707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348367, "uuid": "545ec0c0-fea3-4b4f-9762-614fe4ed6769", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348367, "uuid": "31415db2-ec96-40d7-a65a-e5ea7c999e25", "value": "abc2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869609bb-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771343490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343490, "uuid": "26dda8e7-0bd5-40ba-8622-37008201e438", "comment": "Malware payload (SalatStealer)", "value": "08557a9939639635e0e156699610a900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343490, "uuid": "2586cdea-736d-400a-ab66-48473b2f9c11", "comment": "Malware payload (SalatStealer)", "value": "8e8a1de79d58ef3c3802badc394bc93e216a5f2c0b5e05dd4b35162f6076265c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343490, "uuid": "084edf7b-e85a-4cdb-b153-c30a09f8d39c", "comment": "Malware payload (SalatStealer)", "value": "4bba4b39d178991ed36e5d0ef139c186cf34b129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343490, "uuid": "daec149e-ae21-4f16-8567-0c567e8f4bf3", "comment": "Malware payload (SalatStealer)", "value": "1beb0a41dd0a4cc8553e91eb210ecb94b72c6773773881b5c2bf4da2acde8e7715d5270f10ef77f9b82b6c585b4399d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343490, "uuid": "61f11d2a-9935-41c0-9d35-cdc1e75ec93e", "value": "T177F53301E26264FBC097E378898F52F1CAB0F8311436E69D8B9CDF7A1F598704A79749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343490, "uuid": "1cae20e4-3d26-4c86-99c6-c348b56bc227", "value": "0078bab5d0ef1149e0abbeaf2ebaba86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343490, "uuid": "0194d1cb-c6b0-403e-b269-1a198b68bda2", "value": "98304:afRAWXwEeePCyOpWmI2GAGXacUFPnmvXaS/v:afRl1R1UFPnYKWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343490, "uuid": "df3e8575-4ab3-4589-a79c-eefa719001c5", "value": 3408384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343490, "uuid": "2aa6a91c-9a5a-49f0-bec7-c6b4534ee8f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343490, "uuid": "e1746e98-51f0-4483-89dd-a353b95318bf", "value": "8e8a1de79d58ef3c3802badc394bc93e216a5f2c0b5e05dd4b35162f6076265c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cac6c0-0b9c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290115, "uuid": "2f092f34-ea55-43cc-bb65-7c2a7c6916a8", "comment": "Malware payload (Mirai)", "value": "7579b7a1431082f487fb642ea678a91b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290115, "uuid": "96e2c5bf-f85b-4ca7-bb2c-08d011306ad4", "comment": "Malware payload (Mirai)", "value": "8ef45b9b5130ceefad36e943b9083515d91219d0f91eabde26d5001e2224718d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290115, "uuid": "f9bbd487-1b62-491e-a079-a55b26035907", "comment": "Malware payload (Mirai)", "value": "77fe34bfd12d649ce8fbdc8b7e11933474c3db72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290115, "uuid": "ed8f570b-f566-4308-8fab-8f63cde1ed7a", "comment": "Malware payload (Mirai)", "value": "db4f5579d43a7a9b9367450aa8bb857d17f40bddf4c2de8b1f9c16c63270889101456e85481adc2616e44a0e0690ac3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290115, "uuid": "73a84cb6-b5d6-4b86-82ba-f67035bbbeda", "value": "T18C335A22A8791E1BC0D0F87A62F78729B2F50B0F25A88B1E7D620F4EFF215D0555B1B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290115, "uuid": "c9b48dca-d8a9-4724-af16-1551de37a224", "value": "768:g+oSy7lGvzbq9Ghc1SuA+/5DugQk71JqILfuO+hhQSRF29:g+IlGvvSGhcQuA+/5DVP71rchw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290115, "uuid": "5e3030c3-f076-470f-88b6-661c95c106e6", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290115, "uuid": "24493992-ebb8-435c-881e-40a59d6f1f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290115, "uuid": "de18445c-144b-4dff-9a20-23dd23881396", "value": "miraint.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfc0713-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341677, "uuid": "7d77383a-3f8e-47a0-a46c-cd4b59f778ce", "comment": "Malware payload (Grandoreiro)", "value": "bf641b025463678c550a8cdf5327f181", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341677, "uuid": "91063456-ceec-4926-9ea2-9d5835c946ba", "comment": "Malware payload (Grandoreiro)", "value": "8efb0d678858321280d44fd74a1ca404541ed60df8eb19033cd43be0a06c4078", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341677, "uuid": "2a65c490-880b-441d-9abe-5213b34d8f48", "comment": "Malware payload (Grandoreiro)", "value": "4288d9720a3e222b2e13c879b8834618fa87cbb8", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341677, "uuid": "288c729b-cab3-484a-a3a5-89f03f9ddfc9", "comment": "Malware payload (Grandoreiro)", "value": "5c3244dde4093e72c92cfeed364f4ea0e07f618234750798f952728c26d7ad868e950d6bc63082a00a2b65ef1275db6e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341677, "uuid": "a06e24c6-c921-4a1d-bddf-ab8b92ac7be7", "value": "T1F4863331FF511C96C5948339747F2B384F7C764B848AB4CA789EA083374AFD54E2A866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341677, "uuid": "4c88c63e-4d0a-41a9-9e2f-335fc4841cea", "value": "49152:2Y9W6c96xdNksJRhaZOBLySotqil6qlRrz9jhuv/kWP1bE2/z5Nix08+VfD9phTN:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341677, "uuid": "5f38427b-204f-488e-ba84-bb663d4b58e0", "value": 8239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341677, "uuid": "15afa2fe-c4c6-4df0-8b45-a6ee631bcae3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341677, "uuid": "e1286b66-77d0-481f-9516-e15d9e69bb51", "value": "0Mov8404-GGMQYT68SGS20733SVNM.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1fc8f7-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311855, "uuid": "8f60d18c-8e1b-4abd-aeaf-7f930402bea1", "comment": "Malware payload", "value": "e108f5b63902e62718f4575dc731df98", "object_relation": "md5", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311855, "uuid": "a24aa091-1946-4715-9db6-f9a07f7af937", "comment": "Malware payload", "value": "8f0c9f900defc6921a186f75aa0efa81698811479bbec74b1ccc5286741a079c", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311855, "uuid": "35649fde-7886-4da6-9e1b-4c091b78562e", "comment": "Malware payload", "value": "eb72a98b73e429abb0193ac1de35b1915a6c5955", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311855, "uuid": "1701a2ef-3b8c-468c-93e6-f2f4f3f2085f", "comment": "Malware payload", "value": "1e457dae4c8cf565079df6ca5188036c147fd5c882cab4eabf24e9b23576fe4bc55e144237f28fcdbdcb26c263d3d5c2", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311855, "uuid": "09e54400-5eea-4a99-9e48-7f988d81311f", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311855, "uuid": "0a5f11d2-7fe3-4924-997b-4673e037e3ff", "value": "3:BPMJv3cb3ExyOG8:ZccbUxzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311855, "uuid": "481820ee-4a46-4f8b-9123-8dfd5a7b81b4", "value": 45, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311855, "uuid": "0b8af438-cdcc-435a-894c-cffdd1773242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311855, "uuid": "0713ce92-5ff3-4f7a-be58-4cfcf2ef05bf", "value": "8f0c9f900defc6921a186f75aa0efa81698811479bbec74b1ccc5286741a079c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63270c18-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341712, "uuid": "a62496b1-a3d1-41df-b33b-dcf0c9e1d960", "comment": "Malware payload (Grandoreiro)", "value": "2db3d50a2931580a30bf4c4ce8a71b2e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341712, "uuid": "6298856f-0774-4596-be98-c755110817f5", "comment": "Malware payload (Grandoreiro)", "value": "8ffc144d914102e11354740f1711892219073193e3159019c743fd382fe76d11", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341712, "uuid": "e47e86cd-e7a2-4f11-9000-753431ae5351", "comment": "Malware payload (Grandoreiro)", "value": "4d87f9fb4c48c736493a3ec1a413ada7c8dd39fe", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341712, "uuid": "a2656181-b1e2-42e6-829b-af16150b5539", "comment": "Malware payload (Grandoreiro)", "value": "c5a918193479b70f086f2eace51b33bf3fd0443ef2705aef1c661ff8da1094831d4c34a2d2a94fed83ea4f6417d8dda0", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341712, "uuid": "6bb97799-c420-4e36-9dbd-38a50318436a", "value": "T1A5562332EE61487BC5C54376752E2A3A1E2F76134BCD50D3A49DA28B3B06FC1863F4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341712, "uuid": "ce7c2b7b-f94f-4dab-806c-af15926751b9", "value": "49152:ErhtQKnEGGONTM6tEHAuWlSkPf++ZjSmNSpYGYdSY1fqzM7lDzpSOJXIw4YdwWge:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341712, "uuid": "14b62dc9-1602-49dd-af4b-57a5ddf69aa2", "value": 6205440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341712, "uuid": "4ceee5be-8a95-4f14-b3b8-e6b2f05bb7d4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341712, "uuid": "b1b1e7f3-d66c-491d-8cac-9a7500db0172", "value": "0Ord0107_IFRANJR91N-Judi652898.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c95bc1a-0c51-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771367820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367820, "uuid": "d883811b-8ef4-4a8c-9fbb-fb61eae7573e", "comment": "Malware payload", "value": "7346809cdf85b476b4c170c4d473475f", "object_relation": "md5", "Tag": [ { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367820, "uuid": "b058c1c2-e39e-4879-bf65-0c825ca97415", "comment": "Malware payload", "value": "8fff3933562ea21ec51b4926026522de775e3f45d4c37b18e391c531aa76892d", "object_relation": "sha256", "Tag": [ { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367820, "uuid": "2ebe70a0-5eb5-48be-90f7-fb5eacb48bab", "comment": "Malware payload", "value": "b11ba850524c608df62b0e1b192d829975811ee9", "object_relation": "sha1", "Tag": [ { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771367820, "uuid": "615820f9-799f-454f-8360-02b2fd54da4b", "comment": "Malware payload", "value": "78509ec00adc4f2b09c00dbf926ca5ddc98d6af403dfc4456aacf31d1b76bab2e6bdd3441d6d2edec2664e08b4baabc7", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomCore", "colour": "#BC9C8D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367820, "uuid": "8265b813-63c3-4bfb-98c8-375f401bda8d", "value": "T14453F1F13A420E28A845F67C21C445327EB200D7668BFFADFE52165E3857FBF9A1150A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367820, "uuid": "060dfe74-3fd9-4104-9cd7-9569cfd4f904", "value": "1536:vWTx2jHqHb96nbvlI44st0RTvS/fq6wNnQdmPTvYawgxznP+S3o:uTAjA96tsvQfqRnQkbvYaZnP+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771367820, "uuid": "515797d9-5694-4cff-be55-dd4e243b945c", "value": 61580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771367820, "uuid": "ee1f866e-cd80-470e-be77-3325f983b157", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771367820, "uuid": "58fc96ee-6a9a-426e-bea4-0743d59503e9", "value": "\u0422\u0417 \u043d\u0430 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0431 54 \u043e\u0442 19.01.26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6543749b-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341716, "uuid": "c16ac414-27e1-4928-bb32-8c788e128957", "comment": "Malware payload (Grandoreiro)", "value": "798c4cd76ded6d6b5c470e1adda8c656", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341716, "uuid": "237b3ef3-6564-43a4-b9fe-d78392c2ac63", "comment": "Malware payload (Grandoreiro)", "value": "90175ac6883821b1bd4d544b4560937e5be208a915cd77b18531c9f0ad35d2db", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341716, "uuid": "1aa28228-7732-4499-967c-d0c2298368a4", "comment": "Malware payload (Grandoreiro)", "value": "e1f4b4e76d49dd55554337a46f15226d6e96e0c4", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341716, "uuid": "99df34d7-3401-444c-9a14-39ea27ada790", "comment": "Malware payload (Grandoreiro)", "value": "b2a11c7878b682b236fac1a6ccfae8d5b2cc8ed93288e7ca6cbd7d65271fdc886b994a9417325bac694c6138d0d1b4da", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341716, "uuid": "efc4a168-8bec-49c3-bebb-d9fa40750836", "value": "T14BB63330EE591D2AC6608335707F7E395FBC7A0349CCADD6748DA1866386EC18A3B469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341716, "uuid": "f7c7fd9f-0b1a-4d70-85f7-be3632641be1", "value": "49152:1zfp2NP5w3FRMeitNZtWUupHNwnOAGr5m57CE7q6FRkEBIxzcxtGYNNtix8jmnWl:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341716, "uuid": "9c2130ab-9d64-4b61-a030-c00c4c73b0f5", "value": 10659840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341716, "uuid": "0fdbadce-0747-4b7f-894a-cd31224ad12c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341716, "uuid": "905e97be-4d81-4e5f-85e3-ead85f3df14a", "value": "0Ord0232_UXHNX2L35IB-Judi7753.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1b9080-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352597, "uuid": "6c44d6ce-6f50-451f-bc6a-567fc6608472", "comment": "Malware payload", "value": "7e65c03073bef010b67901bd41412314", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352597, "uuid": "33e769ef-ea82-42b0-99c0-66a7e0a4b196", "comment": "Malware payload", "value": "90282055b8a7dcd168c64b5ac34c65ba962a4a34a7247cae2a5dcdc3f7ab3e8d", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352597, "uuid": "c3545130-bf2e-45ea-a505-317377786575", "comment": "Malware payload", "value": "0714a1efac148fe43a725011742e83795dca6175", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352597, "uuid": "df44213d-ffeb-4d18-9635-415a22e70cfd", "comment": "Malware payload", "value": "5159d65de7b7c8092f74856f6c8ed844b7e9a33bca895ed12b09d086d1c53f92f8c60ae30bd9dbc5b263bd52ba886255", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352597, "uuid": "38748d45-a037-4c35-ac2c-73e22363cc2b", "value": "T1E2562330BF590C6EC5B04330701F2B266F3D6B03478C69D7698C959A375AED1A93F4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352597, "uuid": "df01f9f6-9092-4caa-9718-a34b9778c5c8", "value": "49152:whfDIK386H7GAmTYV+8IKhwXgz1BOi93cKV/gheTpD6Zg6GIc8yVGwIpADu4gpBG:OJuim3Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352597, "uuid": "a5615a57-b03b-4068-a2ca-dea356e256c2", "value": 6422528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352597, "uuid": "50b91af9-49c7-4ee3-b6ba-4f69b82a5d2d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352597, "uuid": "786085a3-bd80-48d6-b753-ff7ae44502d8", "value": "SM9QI_51293JMLLGV-Reg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5047c8a5-0bc9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771309468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309468, "uuid": "fdad8948-02ec-4011-bbe6-5537f41eb9c0", "comment": "Malware payload", "value": "37614beebca37932551f172ff3fea785", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309468, "uuid": "8292dde1-ac95-4528-b3b0-032fa3ee07a0", "comment": "Malware payload", "value": "90ce14da75aa8e0197a49afffcc170bcd4c22f5c8e1a800d674b7aca3e193396", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309468, "uuid": "5b1f4050-420c-423c-ba21-883197786b39", "comment": "Malware payload", "value": "c3c85c4200c7c16477be99a2e50d3bfc64f1a381", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309468, "uuid": "b26de72c-c3c4-43f2-baaf-edc70981eb77", "comment": "Malware payload", "value": "15e82c1c1237cec2ef7d268465e576f2d228acef099830d8e7f6ec13d1cc7e128f329954452ee91b604c56570e052b09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309468, "uuid": "8a13ca49-ef2e-4d18-8ee7-c985e0ac2440", "value": "T1E284F89B689560E4C1FEE134C66AB112BDB13095073827D76FA146F10F22FF96A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309468, "uuid": "44b55d26-d670-4b77-a960-f651c61b5f98", "value": "6144:nY5r4FnF51TqCC/F9gZiz50dnGtVK9M5D:wkFBTS/rednG3q6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309468, "uuid": "bf70be09-2929-4cfa-b127-b2740c87cfe1", "value": 372028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309468, "uuid": "c2db7ec2-82cd-4b5b-a397-02ef5d25d220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309468, "uuid": "9700721a-2eac-426a-923f-bf691e5f622a", "value": "kinsing", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc967f0-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343314, "uuid": "4e167cd8-9456-40b7-b7c0-6eb38e253821", "comment": "Malware payload (Grandoreiro)", "value": "fcf6c5466f6994db170800d3a31a6a10", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343314, "uuid": "ee05c06e-e785-46c1-8d67-13b7011e6b40", "comment": "Malware payload (Grandoreiro)", "value": "90fd8d297036b9eaf3f246668b06149e8f5438ef784356557b0c4a158c41c3bf", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343314, "uuid": "0d8b5ce3-61aa-4ccd-bf86-9b08d67d07d0", "comment": "Malware payload (Grandoreiro)", "value": "a87cfe482c1c6461b93f61b29b44ec19e355e20c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343314, "uuid": "73295d54-de33-483d-b17a-cecd36cb2890", "comment": "Malware payload (Grandoreiro)", "value": "79adc1c76bcd2248531e22f82d787ba3c593a4ad9009929a0031faa5598681a451eb6971a8cfc0bd83c287ae7cab960c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343314, "uuid": "ef9b30b6-a887-4099-81c5-a9f71effb0c8", "value": "T131562332AF495C6AC5504370B93F3F3A2F3D3203048891D69DEDD697674AEE6992F812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343314, "uuid": "e9e1552e-6e1b-4223-8317-b36763ffcc0e", "value": "49152:njGIAUJJcqKC51E0SuIN1zySP8dLquRXtmjOvZebAuPrLmP2g3XyYpF3Z/3N:PFJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343314, "uuid": "419cea57-5c18-454f-91d2-590cda0ddfad", "value": 6443008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343314, "uuid": "64f2323b-0a1f-46ae-b8a0-57403b9b55f6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343314, "uuid": "cca55b4b-87d6-4447-86aa-92a7bf287dba", "value": "Nta-CrYII6_718098AOZYY1GPPJ1.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0287a5d0-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343268, "uuid": "b2cfd673-966b-4d25-970b-7e130817e38f", "comment": "Malware payload (Grandoreiro)", "value": "7b9d3ea4f6d09f1493871dc6e2a5169c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343268, "uuid": "fa01b80a-f432-4b7e-b442-cd4d87b0ab3e", "comment": "Malware payload (Grandoreiro)", "value": "917bc4d24e1f32af73c3dd19fcb696b172d112064d9a17be4f2851505059811e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343268, "uuid": "7731a3d8-62e2-4099-9868-0c970d8a3060", "comment": "Malware payload (Grandoreiro)", "value": "eb3b5452dac3cefa98d25b0362819ba7b0ccc296", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343268, "uuid": "0c88d423-da38-4570-a90c-5d1f4f597258", "comment": "Malware payload (Grandoreiro)", "value": "a8d3900bf1917fff345c5a16c8e66126d26ccc37670c2db4f7707df6c2b02f4f9961782bcded95c59be249584c91b2ac", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343268, "uuid": "45ab253a-18a5-4e90-883d-5ff11e8d6b3b", "value": "T113462335EB85285BCA900771713E3B21AE3DB20343CDA2E2B85C92573746FD6963F499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343268, "uuid": "8ae2dc8a-f57c-499f-aea5-f87fade7af65", "value": "49152:V3nfSyn5bYs9SaU1F4V8zh6NUwk67umJT8SVb2+2K5ZKFN8tR9sarhSpyl0Vmges:dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343268, "uuid": "dc2f3b07-c27d-47cc-bd95-02c521d84bfe", "value": 5591040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343268, "uuid": "94b7e166-f20e-4a8e-a5c7-e2d2c57385cd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343268, "uuid": "7d6736fd-80ac-481a-8df5-57becdd056db", "value": "NmclFBSPK0822095_OFGVC.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8c50e4-0c08-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771336524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336524, "uuid": "8c1adc9a-ea70-4f95-9a87-e7387e1430eb", "comment": "Malware payload (Mirai)", "value": "8264aed54a19e17b1aa52eeab1478c03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336524, "uuid": "11b76630-60ab-49db-b261-36e2fde2c12b", "comment": "Malware payload (Mirai)", "value": "92257bde526000fc57ca7261f72c1bfafa815d72dc9c612e13935f8ec25fcb70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336524, "uuid": "f9f6954f-0d47-40ac-8d9e-a8d890957561", "comment": "Malware payload (Mirai)", "value": "8992754bbf6935f6a60150576d4ab6adbe453a79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336524, "uuid": "28fd9dc2-0af8-47ba-bab0-3aebeb13b20c", "comment": "Malware payload (Mirai)", "value": "700d843b10c4aa70e67db5605a377cd86a85cfa8dec1c86dc3606d7a2ccd92c2781589702c2077c62dcbcd250d1442a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336524, "uuid": "90935172-10a6-449d-a375-8129289e11c6", "value": "T186333903B98481EDC55AD03453BFB236C473707E123D718BA7E8FE2BAD45E501EA9989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336524, "uuid": "30dbbfba-6c5e-4642-aea0-793b971c3064", "value": "768:mcdIiw1fSMajWHBojXTQkj5EZw3XevKSVG0aFNBcFEALQ/wE:VdIOMajWhoLTT5qrySVG0BFEALQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771336524, "uuid": "b1c5bb27-1a14-4d94-9aff-151f77813fae", "value": 54688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771336524, "uuid": "d1253d0d-1b9a-4e47-9e42-3f9adbbbee52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336524, "uuid": "93a4d082-cd5b-4d46-85c9-76bd8ba384dc", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9c8471-0c34-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355683, "uuid": "742055ba-4839-458f-882a-10781404d3eb", "comment": "Malware payload (Mirai)", "value": "633274aa9a46707cc70e035413730bb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355683, "uuid": "6bcd5cbc-d37b-41de-8020-9d62c44874e3", "comment": "Malware payload (Mirai)", "value": "927bb9d6ff158dcd6555df39054ec1223e1d0cdb15d3dfe14d3597d09fdafcc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355683, "uuid": "bcf72197-044a-4b5c-8f50-ecf347c44575", "comment": "Malware payload (Mirai)", "value": "0e399ecaac03940a472090f0defbf4d81705951e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355683, "uuid": "db47af22-d497-4bfb-a575-86396da2b493", "comment": "Malware payload (Mirai)", "value": "871cbf4a10b01007fad2bb50b16e2db9efd10f2c343fa5cbc1f461daee5a9bf90777cbbb1762db2add90f9f5fe4a8de8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355683, "uuid": "bc3b805c-2f21-4fd6-b8e2-aaf16a89761c", "value": "T11A334B21FA391A27C0E4B47A12F7832AB1F6479F90A8C74E7D320E8EFF1499055975B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355683, "uuid": "6f6fd9ed-425c-4e3c-8d0c-9bc76c9674ed", "value": "768:yoKR+dWhoDDkFm7nMGWU3NAIZotohCJvM+AEMO+VziNxd:yFvhmkFFG33NAIZotUXVWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355683, "uuid": "73509909-d6e6-45d6-b9c8-618eb00eaa23", "value": 54184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355683, "uuid": "ad12ec18-63bf-48af-93be-d25417f01c1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355683, "uuid": "e9063c8d-58b1-4c9d-bc29-779fb9e1177a", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5456ae-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309007, "uuid": "9902df5a-09da-4af7-9941-7954f3e4ffcc", "comment": "Malware payload (Mirai)", "value": "f3ef79e0362da80ee4cf80772289fe9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309007, "uuid": "bb6edc4c-1bfa-4e29-a4d9-11dd927d845a", "comment": "Malware payload (Mirai)", "value": "92de3c6fa509863267a3b4234e74d9cc3b919db90df44dbbf9bdee6d83fbbce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309007, "uuid": "116a0484-342c-4164-a48c-ff86a97921c0", "comment": "Malware payload (Mirai)", "value": "5085b8a1cfe7fcbeddf171ffefe1116ad30b2f44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309007, "uuid": "9b01774e-f784-4e41-bd4a-43bed4037a53", "comment": "Malware payload (Mirai)", "value": "42da020ae3ad7e74d5fa3432355054eed115b6a433fcfceaac719383ef310a167659a2722c5fc8d1d89caa125914c0ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309007, "uuid": "b7189b09-aa2d-4010-a295-1c7834551d31", "value": "T1A223AE23DC3A5C98D11C08B4B5699F346713F10AC6932DF6660A8AE5E417EDCFA5A3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309007, "uuid": "90098037-1977-431b-aea2-02a697ba6fd9", "value": "768:9a/P6efjfUxSeocJf+saDzEubu9SI6VC6b+oUuDSXCf+:9a/P3UxSef45EH6V1UlXCf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309007, "uuid": "7ffe6a94-c7f3-41ad-a947-4749dbff0169", "value": 47876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309007, "uuid": "ca8093ee-e315-43cb-a532-51ba21432785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309007, "uuid": "6b4ab720-431a-46b3-a8df-4f0829ddf57f", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca14eb0-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343124, "uuid": "077bb43c-30b5-4275-a7a4-e3c1b0a05a0b", "comment": "Malware payload (Grandoreiro)", "value": "acee2384c1f7543789fb6f46b82f42b0", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343124, "uuid": "ef5ab6c4-4378-443c-9fa7-dd67f440a5e5", "comment": "Malware payload (Grandoreiro)", "value": "932fb05dee3fbde435cde8f7a5d918e7543672fa6a1dded9d5f6de1ecfcab1b2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343124, "uuid": "0bc7b485-4642-47ac-b0c0-cde162fd8d4b", "comment": "Malware payload (Grandoreiro)", "value": "2505ebedb233ca17d470159a954eb092914ef4bb", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343124, "uuid": "5f1f8170-2735-4a3f-ba3c-1ac7e40c67c8", "comment": "Malware payload (Grandoreiro)", "value": "1b5e4bbd68d9de1aea96c66679544edaaa7c47b606a9ec4e1472d30518b2782d789eab53f8a967cad84b5213b14b9724", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343124, "uuid": "f32a8bd2-994f-4800-831b-7c5b581d67df", "value": "T196563332BF945C1EC9904735702F2F291F2DB983C68CE4D2796CE0C6339AAD5962B479", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343124, "uuid": "696892db-61a7-4683-aa17-257bc7cebc18", "value": "49152:v/6fqQcIdRiBcRMWKgjwvlqJI+P2sfa53I7eCJj5NjP/9MqD/u3eQFoLrrQD5T5E:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343124, "uuid": "fd03db27-662b-45e1-bee9-b4d5928ea23f", "value": 6256640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343124, "uuid": "b8374819-9282-44b0-973d-ef91130d74d7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343124, "uuid": "767453da-baa2-43f4-be64-e412c7998ccd", "value": "BG1D1BExtr_4502FRQLIG58E4M.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557e8bd5-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342119, "uuid": "b5acecae-3470-4fc3-92c7-c32208ac395a", "comment": "Malware payload (Grandoreiro)", "value": "3c2f85f39e582a4d9272644e642b5379", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342119, "uuid": "438141d0-fbb6-4f27-bf35-a2f83408d77a", "comment": "Malware payload (Grandoreiro)", "value": "95645c2448608d9c3a8049fde7544dec2b8c73d402d5a9d9835eb25ddba194cd", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342119, "uuid": "9db59282-3050-4006-bffe-609099044edc", "comment": "Malware payload (Grandoreiro)", "value": "5c4ab0190f447e3ec92a24866932ef3cdcb5b211", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342119, "uuid": "680fdc19-5ee9-451b-8d6c-3fd6b6e89b64", "comment": "Malware payload (Grandoreiro)", "value": "4a29180659cd4211a01cff0441350a17681d0af4cc39598814889d36dc94ed00e473d403a68c2d411e8964b62ba343a6", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342119, "uuid": "fd1128b7-9c88-4425-b519-9eb1eb0e0a40", "value": "T1A3562330BF850836C5A00331B12F2E362F2EAA03454F9ED775DC92977B4EE96C66E459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342119, "uuid": "9f1166b2-df03-48e6-b038-d0389a1c3319", "value": "49152:Rm6aSNUizhxtl3q/+v3oUK31ep03LJp7tPz8ZUVoTcA8WD4Ev0aO9ouim3YPGfi:tuim3YO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342119, "uuid": "2ea49236-7f03-491b-9a47-29aa52b3c2ea", "value": 6164480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342119, "uuid": "78666ce1-90ee-4f99-9ea1-47ebb72a99c6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342119, "uuid": "b5ed513e-39f4-4215-89b2-c0321dbb8bed", "value": "3564TYER_Arbi3QJ2S-1562lhdkp.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cb4417-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348372, "uuid": "fbc767f8-45ee-482e-b2fb-4161c5100228", "comment": "Malware payload (Mirai)", "value": "02f2a2eff467ec44993fb88edb1817be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348372, "uuid": "84dae329-8e94-4a27-ad46-9cca08ff4893", "comment": "Malware payload (Mirai)", "value": "959e09c055b674f9aad3ce391cd01564c39477dcc329f62ef8f64ab79de12212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348372, "uuid": "322ed1bc-a409-4628-a637-7a3e8761d91b", "comment": "Malware payload (Mirai)", "value": "31d0964016b91d862f593e83cd2d5c07024ee3ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348372, "uuid": "adefc914-ba5a-4d96-a98c-6d61218e8e22", "comment": "Malware payload (Mirai)", "value": "3b7e67ca005455ccc1a23c106090b3e3c326506d8a88c427347a37d969b7e683fb9ec391ca26d29b483e5dd0aa6d3ea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348372, "uuid": "e6ef8f04-070f-415e-89de-d21eeb58fedb", "value": "T103F2E175D1D46010C8E1C033E83DC541661A08B4D7A3AA6277869F7DB5E2488EF3F96F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348372, "uuid": "27e003be-2ba3-4384-80fc-f78c052bf53b", "value": "768:M+QNAu1VmS5o5ASksTl5ld+PBpGAEy9I1o2DjaLH8RbEfht1yZbdKEMHP3UU:2N7nmqo5usproPT3JIKLMbEJnWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348372, "uuid": "39b4be20-a804-415a-aac2-a6d2e37195e1", "value": 34684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348372, "uuid": "a68b07d4-b8a9-4b77-9c42-a834d0e0bdc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348372, "uuid": "d74f45b9-19eb-41c7-8723-26769cac6036", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d21c94e-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771290619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290619, "uuid": "f7f58642-5e6b-41a1-b3c9-ce7333982484", "comment": "Malware payload (SalatStealer)", "value": "6fde7a2040b6bfa3a8f84a00539aa2ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290619, "uuid": "4949caad-0690-4c97-8aa2-723a7c8ce0f3", "comment": "Malware payload (SalatStealer)", "value": "95c7967cfe51c64656f07e14b5ea3c59ddc0ce36d02e38cd57ce415a82238928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290619, "uuid": "dcc295dd-48e1-4c3d-afd5-7958da2c316d", "comment": "Malware payload (SalatStealer)", "value": "509751ad0b44d4a81c60bca99836f12ef1f8d5c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290619, "uuid": "213c064d-d712-432b-81b0-b23dd27c95e8", "comment": "Malware payload (SalatStealer)", "value": "1d9e3fdce24f0de900ce78e14790048083aae6a283159ecaaad5fbe54bbab1e4db746965d21057fffaca2042cf9a0f13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290619, "uuid": "88136768-f208-4730-9ee4-0cb63dcd39d8", "value": "T1DFC65A11FA8B58F5E9031831415BB23F63315E048B68DBEBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290619, "uuid": "50a61045-f670-4278-8852-466b9303032b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290619, "uuid": "4dec5f26-ea43-4a5a-a29d-2d56fb48791e", "value": "49152:f0zLtmLN39VeVGYiYgOUzR5xwIUuh1pNRNDRMAavqNj+Qn7kQnVCWEEuxq594Lyr:c3tmLUVF4qAac+QA3Dx46LNmxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290619, "uuid": "5aac5a83-126d-4ae4-a6b8-27722b66c0c9", "value": 11672064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290619, "uuid": "dac6162e-575b-4cc4-8822-fd7cdbcbb673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290619, "uuid": "a92f4afe-eea5-4946-a309-e88e5e3937df", "value": "xqxbvbdn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ae6478-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1771311835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311835, "uuid": "1ef07632-4e1a-4f28-81cd-4cfa508bd310", "comment": "Malware payload (Stealc)", "value": "a74df6997e9cdbf01908275105b077f3", "object_relation": "md5", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311835, "uuid": "cee750fc-8cbe-4fc2-b089-822595d5c6a8", "comment": "Malware payload (Stealc)", "value": "9632c843f25747b0c30cfc6388d2832413e7c2100c4d48e0d7bb9511117b82d1", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311835, "uuid": "2f3073d4-1794-424e-9733-4e0f3499256e", "comment": "Malware payload (Stealc)", "value": "656f3ab42591a8d07330470c8d469bd50ed28326", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311835, "uuid": "8db9ff71-3c85-4a0f-8721-7c12634af68b", "comment": "Malware payload (Stealc)", "value": "c28f5617c13b7f77dbd2be863f925921523531d1c55cae8c11f4ad996f41033d956558d419728e696412bb1c3ed1c6b2", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311835, "uuid": "98ed1754-ca02-4644-a9e0-26a833ebc8cc", "value": "T188F48D5AE3A502F9D1BBC178CE424553EBB2B8155370978F03E11AA61F376A05F3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311835, "uuid": "88e43c14-aff2-42da-881a-061e235e39b7", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311835, "uuid": "a795e718-971d-486d-b859-59575f48bbb9", "value": "12288:PU8VHX4ZPBuvzkOkW7UE+YTRqwJ4/zv3YZtF15kjHKA:jVH6BuvbkW7xXVVm/L3UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311835, "uuid": "43012ee8-c63b-4103-a1f1-dbe3d73dec37", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311835, "uuid": "ba6ba0fa-fe17-45f4-be83-cff0b4b64d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311835, "uuid": "484b8de3-6707-4cdc-87a1-df4fdef4c02c", "value": "9632c843f25747b0c30cfc6388d2832413e7c2100c4d48e0d7bb9511117b82d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377b1370-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771349370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349370, "uuid": "fc7b1ffc-bc78-4389-a917-33cef15aed78", "comment": "Malware payload", "value": "4538238d15f8bec2b05c033824901455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349370, "uuid": "e8bd2cba-3933-48e0-ad91-48a6ad21e0e4", "comment": "Malware payload", "value": "96db07b30005e86da7f20c7494337873b9a8b36bc46113f60cef2107bbd8c3e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349370, "uuid": "591ce969-86aa-4601-9b46-164a424fb1ee", "comment": "Malware payload", "value": "9617366f0e1d345c39f32a2240cecb0549b0285c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349370, "uuid": "486a8e3c-2502-437c-b8c4-dd5fc1c365e4", "comment": "Malware payload", "value": "cf3611a973b935fa66f264c3d5949afa4e0b9db3f5470fc6b65d387f4366ea544d5fe3ce0a45facf021490ad3039849d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349370, "uuid": "482c7899-1692-4cf0-9b55-32f366c6f5b1", "value": "T15C83D682BB43CFB3D84314F142F79A354A31FC2A5C36DA99E725BEE5C6524C07A16364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349370, "uuid": "203345fc-1b12-45d8-9101-99279f3597c4", "value": "1536:iNg0rR3Qxh1Fe/WYowGRdUWQK68rL2/736QcivNgj:iC0rR30h1Fe/WDwiJLfrL2/lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349370, "uuid": "ef01f3b0-45df-45e0-8eb9-153de668fb62", "value": 84836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349370, "uuid": "738c8eb3-d335-42d7-9607-aca2e494e87d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349370, "uuid": "e429ba1d-863f-4f90-98a4-6b350c5e3931", "value": "israel.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337de3be-0c54-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771369120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771369120, "uuid": "d8440ea4-e1e6-4cb0-9bb5-c0a678d278c0", "comment": "Malware payload", "value": "45d4e094e425a45a39a60cdea4ac64ae", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771369120, "uuid": "de6f5f2a-3d3f-4332-ba3a-f6efdd728be9", "comment": "Malware payload", "value": "9731174b706d0329cacd6fb0c046dea3be951b7e5349a0101d393900ba678db7", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771369120, "uuid": "59604bff-1320-46b7-9a2e-68969638423e", "comment": "Malware payload", "value": "f32fa470a3d75d342939c77f3afad82f63173d17", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771369120, "uuid": "74c1683c-ca95-42cb-b4b2-bfd175fc38c9", "comment": "Malware payload", "value": "297f24969cd3a005f64b213fb083fe48f07385733c2ea30c568bffd4a23627b121f330eae1fc4751dbe2c887b0bb7c70", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771369120, "uuid": "e74fa119-bde4-45b9-aab9-8173c5f81585", "value": "T140F6339493E448E9E967583E4D619012F3F2F86107A1DACF0BD44B672F6B2E99D3D320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771369120, "uuid": "c88fcf72-e5a7-4a3e-bdc0-0571a73add5f", "value": "fa28a256f23b68ab4376980fd1ab2aaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771369120, "uuid": "79b1f187-6abd-49f7-a848-9f771de35cac", "value": "393216:KVuEmNGYN1bPsZg2KeiCxK4BHsFhktlapPLbYYYH4a7o:uS/N1ILX3JtUpTbLYH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771369120, "uuid": "d68e97d1-8159-4582-a281-bfe0933f3612", "value": 15662080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771369120, "uuid": "b066e27b-8b16-48b1-8be2-8e4ef11c206d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771369120, "uuid": "2bcb2f3c-93cd-4e82-8171-4b236c9c470d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b07fd36-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349349, "uuid": "9766322a-4100-4e21-b46d-71a4b53765f7", "comment": "Malware payload (Gafgyt)", "value": "af311a0f4aee0db343268d4892c8d1a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349349, "uuid": "3c9ffa82-a841-4918-b4a6-3d906b543a25", "comment": "Malware payload (Gafgyt)", "value": "97b3c483bdb1891b24958925b5699ec40ac1943b83a298636945b73236804fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349349, "uuid": "4e0a2495-17ee-4023-bb29-565fcba239a4", "comment": "Malware payload (Gafgyt)", "value": "cefc81687f1e6ec32096bdef5298d455e0afb53d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349349, "uuid": "0640e60f-bd7e-4b2b-8f7c-aeeb1136fcee", "comment": "Malware payload (Gafgyt)", "value": "c85314387fcbbe78402fba815d6224a7a34fc52e4ba16e01e3b7f024aa81b472762dbc06bc2a6370442bf9eaa5d3aa50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349349, "uuid": "31afd06b-9e20-4a91-ad4c-67901061ffaa", "value": "T1B5B3083B7B270F23C0C9147112E31331AAB5D79934B947D7AAE07DAC6F0A98834667D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349349, "uuid": "fab31e49-75a8-44e0-9938-3fe9d7d96998", "value": "1536:9vXLTMY7OuPyZ6ZP2NM5m/mtGt0g2zefrCCDzKcmL49FqFjeOferQX:xLiZS2N8E9Sef+cmU9FqFyOf+QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349349, "uuid": "88da2f04-fbe7-4ceb-91c8-5ec909d5b7fc", "value": 112738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349349, "uuid": "4c878230-2d9a-431f-87aa-5cedfa2e9760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349349, "uuid": "2dbc929b-b016-4045-bec7-a45ffdb9f522", "value": "i586.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc65ea7-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348417, "uuid": "5530148c-6e43-4614-a489-2b0327738037", "comment": "Malware payload (Mirai)", "value": "b2b0b9fd2b267cf13d6acc842eba3a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348417, "uuid": "d62cb56a-a388-44a7-ae0e-9869ad3d546d", "comment": "Malware payload (Mirai)", "value": "97c926525c5a0f58f571c798c6707af18b75b24a8b8ca4065249e4c97ec55516", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348417, "uuid": "955313f4-d128-482a-9802-392cbbd96ca0", "comment": "Malware payload (Mirai)", "value": "e8d3779d0586c0cbdf9f5d0afb694c4a03d7e9bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348417, "uuid": "1c2bc881-eb5e-42e7-9712-2b5a549ae5ad", "comment": "Malware payload (Mirai)", "value": "eb4981763320acefe50db837bd304d23a1f3c84122a9edc88a1497fe817e57323cdc1d76ae3d4376840252edc4e9c6f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348417, "uuid": "43b2f58e-b9d5-4c01-82e3-ba299aa1991a", "value": "T113D39DA7B24F2450C82206F45BCB5B9D2A3325019E6B9AE77C5E373F2E735DA18063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348417, "uuid": "4cc1a90a-96c7-465c-9935-09396bd6c4cb", "value": "3072:1UXDvb2IMuo9rhMLo9ira+YgR1YggkC9DFq1D2dq:1UXDvb27nhBi2azYaC9DFqQdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348417, "uuid": "614c34b7-d8f3-4482-b62d-f7a904d297c6", "value": 132848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348417, "uuid": "736915a0-1a09-4532-bd01-7677f963d832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348417, "uuid": "fc0f5ef7-5bfd-4f23-9f23-9e88a582bf53", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98b5c53-0bcf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312302, "uuid": "54e135b9-1dbf-4b91-83c0-1c42a3a33752", "comment": "Malware payload", "value": "ccbc238010e2f018dfbec4c042d5eba1", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312302, "uuid": "922b364c-eea2-40c1-81a2-2752498b7b37", "comment": "Malware payload", "value": "97d0f03057fccf424fcde0ed7737d9209c0a8b1cb9e659f3d22bfd3774b14ca4", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312302, "uuid": "78c5b501-073d-4b1b-90c7-134c9958cb43", "comment": "Malware payload", "value": "549f44bfc85dd573cffcf8ff07bd6b054d6649f3", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312302, "uuid": "06519342-33ca-487a-9a84-73d5e7d879b4", "comment": "Malware payload", "value": "1bd98586305bb0afb60c347870776cc7201c0745342bee43e8d5d9389bea793005855a2d1f9ff7cc315547704a9cf80d", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312302, "uuid": "ad0f9139-6127-42d2-8e73-77c4bdd92d1e", "value": "T1A9D6339C83F00CAAD8AB643F69768163F3A1B4511761CD9F0B9893592F7B1E95C3E390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312302, "uuid": "78c66c4d-fada-4dac-b97a-1ab405f31a24", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312302, "uuid": "f8463733-1917-4690-86c7-d43b4f3f20a8", "value": "393216:lVuEu7O1DPsZg2KexzChK4XHsF5laSsZbYUeHS4:Xoy1wLXxzCEUS0bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312302, "uuid": "9a28a90a-3f47-4885-91de-aea000313f16", "value": 13091941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312302, "uuid": "6bd42663-069e-4b6d-8817-6050049c6347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312302, "uuid": "2a046a52-d454-4796-aa19-c0b1a586a3ad", "value": "97d0f03057fccf424fcde0ed7737d9209c0a8b1cb9e659f3d22bfd3774b14ca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a858d8b2-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353854, "uuid": "8ce924f8-3f88-4e14-9d65-ced99cec0c67", "comment": "Malware payload", "value": "5216119382edb7ebd204aee0ea10b7d6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353854, "uuid": "38f1b95a-2bf3-46ce-ad58-fd72fe9f9fa6", "comment": "Malware payload", "value": "9804bc6a02866c9d36a7d86aa7bb906a5736b312f4bc29281802b4460b6e71f1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353854, "uuid": "e97ca9bf-7c62-4b99-b522-b53c05383beb", "comment": "Malware payload", "value": "737d7dfb167e16467f9569439bad2f8d43e74b5e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353854, "uuid": "f3a72c7d-dee9-4aee-876a-c05f76fb8cdc", "comment": "Malware payload", "value": "e8874db674297ad0cec412fce5ba910b52e4d75d30017b2563ee7662c7a194dfbd00cb78a726a614c41941410cce5ef7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353854, "uuid": "e25890c7-d964-4f58-af5a-f20bfe70a28d", "value": "T10C4623336E440C23D6644775F12F6E362F2D2247828DD1E369AC90873B4BFD299BE45A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353854, "uuid": "2f82ea54-37de-43c4-b08c-cd61607f43c9", "value": "49152:yCfE8wfIt9Wr+RnZT+IaEWHckZ2U+mhE82ZHvic5xX+0Y2U8UJzyAEoDuaL:78B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353854, "uuid": "44985fee-e918-4379-a8fa-0da3f11245db", "value": 5478400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353854, "uuid": "cccfa798-6aaf-4324-bb8f-f05fc32249d0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353854, "uuid": "a38f55be-98e3-4ce0-9606-b8f279063adc", "value": "Rslu3760PYZGPF_V25CP.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da56144-0be1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771319718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319718, "uuid": "d5702a0a-2b4a-4360-bafe-bfc05af9c38f", "comment": "Malware payload (AgentTesla)", "value": "a54a89ec21e4a92b6f3a7634448aa595", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319718, "uuid": "2b8a16a1-80a1-4bbf-a2dd-b1f42e888568", "comment": "Malware payload (AgentTesla)", "value": "987aaa5140989d2218d729d0df052a19f81435cc6a2e92946d928b84ab1fa5a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319718, "uuid": "9d188c02-4332-4c1c-b8f0-e566296b0fda", "comment": "Malware payload (AgentTesla)", "value": "a18b45ec8a081f98f656e5b62b48aca0b26b9951", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319718, "uuid": "f22cfb05-e0e6-4cae-b996-0b97b6d64749", "comment": "Malware payload (AgentTesla)", "value": "eff6cf6261b1d6f52455e39d68c236c59b36ef129c8549a94e9b84cc948e1da8a7e8abbd039cff09e2134682b290ad13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319718, "uuid": "8bab56b6-9818-4db9-ac9e-400d0149e747", "value": "T10B64124A3632C05AC4951F712C29BEEA6F79ED052D34431FB37076EC79316A9A90D6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319718, "uuid": "a7bcbd9f-b43c-4bc4-8ae0-c20360a002af", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319718, "uuid": "f71776dc-2f0c-435f-8bfe-a619d21ed2a9", "value": "6144:84t6LsyAWYRsw3HWstc+AD5Vh5websYT55ZRzmdO83hwC42KSRm+Hswd8po:8kdW+Ttc+ADPhpT55Z4dkSRrsE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771319718, "uuid": "81806123-b7e4-462f-be6e-4f7d94ae7d50", "value": 321848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771319718, "uuid": "3463c683-d439-4fa0-85ec-d863b0d4201e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319718, "uuid": "52912bd7-e485-429d-89ec-8698723ae419", "value": "Documenti di spedizione.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a60b4c2-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352301, "uuid": "94c2391d-1166-40c2-82ab-40352250f4a9", "comment": "Malware payload (Mirai)", "value": "877404a2285e4d2752156c13cd2fd704", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352301, "uuid": "b007b057-0a43-4005-9ee3-26f5f3af5904", "comment": "Malware payload (Mirai)", "value": "98870a66df03788e6adb2cc24a7eee69ce0935a6e9b965686c3fe684ed228d00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352301, "uuid": "a4499d80-971b-40c2-b7fb-3342678e6281", "comment": "Malware payload (Mirai)", "value": "94ebf74b6776c65492083d33bc1bb6d76d15a89f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352301, "uuid": "73f0f724-67f4-495d-99d0-e258d6c696c6", "comment": "Malware payload (Mirai)", "value": "e1d7868a7323460edc2236de814d105637f9bb9f509421afbaa7a7ad3e40b77e29672d572fee89a9bf978c2f8a3aa4fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352301, "uuid": "a01da82e-81e4-4674-a932-5d6ab8560308", "value": "T1D6338EB3C42E7DD4F14A8278B9244B385B23D40696833EF5968ACA974047EDCF6593F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352301, "uuid": "f8087ef2-4e7b-405b-95fd-4336c353a04f", "value": "1536:DoaN/rpY6OrwtAFeocUFH9qgGDg6owCc:Do4jnc7ecz6ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352301, "uuid": "f782a73a-9254-41f3-ac58-f889a1923567", "value": 54684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352301, "uuid": "d90fd999-ab7f-4624-a78d-824605809e83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352301, "uuid": "5f9bb424-09e3-4094-b6e1-83fddd88d14b", "value": "mirai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb703220-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351766, "uuid": "2c26544c-ac14-4b10-89e2-478092b3d6ff", "comment": "Malware payload (Mirai)", "value": "1041e23522b3d55a5317d949fe751c78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351766, "uuid": "400cd635-6c86-4709-a51a-db6badde56ad", "comment": "Malware payload (Mirai)", "value": "98e97b33cd2930e9f8ed383b345855473f0d15330f295747ac67c3e585ea4105", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351766, "uuid": "0e0a4f11-5564-4326-be3c-100adcc89a69", "comment": "Malware payload (Mirai)", "value": "322e5b7bc526d6140fb012ec0aa81d5725a68097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351766, "uuid": "909dee3f-0900-489d-b7fb-4af3fef5491e", "comment": "Malware payload (Mirai)", "value": "1eaf31252d99580f0c7a5efbbafe61b96b6094220d1016c8ccd9498accec465dff92799d33fcab2fe031936500caeb76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351766, "uuid": "ead469ec-6232-4976-83a9-36b4a15f9de1", "value": "T1A9430852BC818A05C5D412BAFE2E11CE33136768E2DF72139D106F247BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351766, "uuid": "62fe849d-e749-4b77-908d-5de66d582fc0", "value": "1536:ZVnsP+SiPuXJEbiaNV82/rKGpoSEpLWIxibJgwKWFx:6kPcmi2V8M3pZJgwKWFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351766, "uuid": "adffca78-0248-4e25-9e7c-8f687db8f3d4", "value": 59680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351766, "uuid": "9d647f38-6f19-4d6a-b40c-0e74fa363905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351766, "uuid": "4fc60fbf-d0d0-42b4-80fd-a9f4e7ccf7fb", "value": "hoho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ed3d2e-0be3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320678, "uuid": "982390bc-2573-4bb7-93c5-ce221fbd819e", "comment": "Malware payload (AgentTesla)", "value": "c038ccdc98121bfc2629f11cba1c8357", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320678, "uuid": "4f82d8e7-a3d3-4989-8382-420759f14740", "comment": "Malware payload (AgentTesla)", "value": "9919b646562123265d27bb8b64db1048cc8833a76c377bcd15e8a221c2990916", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320678, "uuid": "7d2f8d84-f631-48ba-b99c-f8ddd789cbd2", "comment": "Malware payload (AgentTesla)", "value": "4e45bfa800992bd2ec927f0f297ea61f81d92283", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320678, "uuid": "6b23cfb5-296c-481d-b791-e3608c44b1cd", "comment": "Malware payload (AgentTesla)", "value": "7cdcc1e23e8aa3be4a13a98df18fc79f309b67f042ed1fdfa3c826522097d024b835b82b891a7e50e5bc63183e55f781", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320678, "uuid": "3858ffea-71bb-4071-9bb9-dd60dd26744a", "value": "T10A340E037E88EB11E1A93E3B82EF6D2413B2B4C71633D60B6F49AF6518516425C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320678, "uuid": "b91f3445-7117-4d85-86bf-24c3803701fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320678, "uuid": "3c32875c-1889-41f5-87ce-7d26e675122c", "value": "3072:qBz4yAumu2esPywzHvYs3h0P4SPEm5xrosSdKb:Numu2esqwzHvYWI4SPEzsSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320678, "uuid": "a01ec0b4-aafd-4f14-9f0c-e54c28e8bfe1", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320678, "uuid": "fd325b04-4d68-4b57-ba51-9245b09d6ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320678, "uuid": "01a531b0-eac5-44cb-b40d-5b018f1fe538", "value": "9919b646562123265d27bb8b64db1048cc8833a76c377bcd15e8a221c2990916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f565e0e-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342189, "uuid": "ab70ea2b-38ed-432a-8c5f-a3dae9edc438", "comment": "Malware payload (Grandoreiro)", "value": "ca9691f6f946cc8537d4eeca3f48413c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342189, "uuid": "1d54f08a-7e61-4fd4-8d62-bf5e3a4f650b", "comment": "Malware payload (Grandoreiro)", "value": "9abc8a88008952f7d0b4abd2b3803960b7eb5a68b2ca3d5eced5a29caa0ce4aa", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342189, "uuid": "66c59992-5b15-4fbf-8fda-3110388c2bc8", "comment": "Malware payload (Grandoreiro)", "value": "b5184c5786f379215c02e9039efc262518a0e6ec", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342189, "uuid": "65d94358-9363-4115-93e3-6380251914e8", "comment": "Malware payload (Grandoreiro)", "value": "41b4fb601c29a9b00e47edaeab4cdf82a077938eb33ec1668f5b798645d6505080c357978ffe850d90da1ff5bcf97245", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342189, "uuid": "06777d5f-ae2b-40c2-9476-168f087b093f", "value": "T1B3763331EF041C66C6508336713F3A256F6D771748CDB1CA38ACD2873747B96A62B8A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342189, "uuid": "4f1125e5-bfe3-481c-a4b8-8a0e890d8502", "value": "49152:+IZKhi/m5Xhu7NdS2PlNeIZhq9v3N9Tqm0mUkhh/68Kyt4KXzQXs6zDzw8efIZ/U:UUGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342189, "uuid": "f2216307-47b4-4c95-ac79-3a409acda9e5", "value": 7575552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342189, "uuid": "04b74f5f-836b-441b-bcbf-bde507a384d6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342189, "uuid": "3786420c-62af-4392-8c6d-7fef3f93c407", "value": "5U69Sntc-4325PTPCII4JIB4C.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fb4f37-0c47-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771363574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363574, "uuid": "27e30d92-865a-44bc-bba2-f5a2d0664467", "comment": "Malware payload", "value": "cb50fec93b547b0857769c323f4481ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363574, "uuid": "ff9ee82b-13da-483d-a52b-1c16efbc1fd2", "comment": "Malware payload", "value": "9b048b3327bca55d1153af4dc617b8a8b69f4f6752c4a9f3457a70a3ae085f9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363574, "uuid": "0c978052-8624-4e51-a18b-39bf63f5fd46", "comment": "Malware payload", "value": "61fa0a822307f72f479b3f830632d9e20a8a2d41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771363574, "uuid": "3c274162-1096-412e-b289-b80a376de2df", "comment": "Malware payload", "value": "45b632982a15e90f17fe7e62dea14cc8a4ccb5c93edf88f16499500038ebfe0e0e5feb5a97cacfe0a7f2d025dc10236a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363574, "uuid": "3814ff21-0173-47cd-abe3-86c87c621f28", "value": "T173873329F39599FECE33D0FCC0854487EA96B9E54385412717F085EA4E206E58A2FF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363574, "uuid": "531cac46-7f3e-4e5a-9860-7e1509a93c89", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363574, "uuid": "f4b3edf7-5fad-4bd4-bdef-f10e9946fb5f", "value": "786432:/rKU6DT0ucbTbMv22zAeV/X+0tdshTc3XyPteDeCOdeuKF1bX:/uRf+nAu2FuQd73XyFeDMnKTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771363574, "uuid": "5872ecbc-5aaa-4d57-af85-5e4e337b276c", "value": 38833672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771363574, "uuid": "9de49406-5e02-43be-a536-a003379634a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771363574, "uuid": "302cd12e-f905-444f-8399-3eda63c746a9", "value": "EVENTDlGlTAVlEWER.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a429164-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300815, "uuid": "393c61c4-6e42-4f50-8e91-0a0bb07641e8", "comment": "Malware payload (Mirai)", "value": "750c88cbbae89c451f4b2c1b64427f33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300815, "uuid": "fbc0ecd1-d440-4cfe-9871-1ce9e8c95ff9", "comment": "Malware payload (Mirai)", "value": "9b53d916fb47c03913b0eea4d552587fc288e1274ac590c15dd405559e218416", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300815, "uuid": "b3f25052-1267-4ddd-880a-938f1d02ed34", "comment": "Malware payload (Mirai)", "value": "4de0ea4360ae762371c3694042983b8db5e3b8b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300815, "uuid": "c9d359bc-4827-46d0-917b-451d0d5dab4a", "comment": "Malware payload (Mirai)", "value": "53ec73c84538c6888c2ba20e48adce5f37953cdf9d51e63eab34d25c0a103b43b7d1bb9df16fff0a05a7618f48666499", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300815, "uuid": "23256786-5191-4252-94d4-4f5dc82d1ded", "value": "T1F7B2C0684D8D496AD41A073F83BE0FE918E958D1CEDFDA3B97109FC8B28A41FA534904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300815, "uuid": "3aa7ed53-c9f4-4b79-a25c-9e7b475d0935", "value": "384:MkUDJWU4hrurTgWMUQovQDGEvgzHGKspxwioE9FYIvIfV2XKLPLv1Rh:qgFKyJoQGVzHamO3ikurh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300815, "uuid": "0c89757e-c777-470b-9c63-8493f766c9a0", "value": 25188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300815, "uuid": "94e5d923-5b2a-4cb2-bbb1-04d76e43c2ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300815, "uuid": "5e48c873-37ea-46bb-a9db-aded3302f416", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6601198c-0c10-11f1-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1771339999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339999, "uuid": "7523e2bd-b33c-4efe-870b-9dba7f0ad3b1", "comment": "Malware payload (Formbook)", "value": "8f38a4f10a1574a956a4653d913a9dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339999, "uuid": "880c9faa-41c2-454f-a6fd-736c65ae714a", "comment": "Malware payload (Formbook)", "value": "9b796f3ed25953c5f786a68211c50a08a630155949e36826ade8c91dd61b70b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339999, "uuid": "753796d8-d260-47ae-9e13-15cb04c056c0", "comment": "Malware payload (Formbook)", "value": "565bfbfcffe6cc14a6c58e275aaf4acb4c8b873e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339999, "uuid": "4a10da79-fdec-4a02-912f-e080cbf3d3c3", "comment": "Malware payload (Formbook)", "value": "1a7edf90e2948a4b5bb3692f507f1f46a61994690d3f3a1b341cf33e8bbd1b611b08f155c77cfd5b50f6583c47bfa670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339999, "uuid": "7979aeb5-3953-421e-b228-1108e06d4e17", "value": "T14D5512581729DD02D0FA5FF41AB2D37057B55E8AA511C3439FF7BEEBB82A3802945283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339999, "uuid": "38a2a863-ddc6-4025-aa46-1c16c9556617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339999, "uuid": "c580a939-6c32-4b7f-bd32-d7403fa016bc", "value": "24576:Lqu2VwjHhiG0rxnhLS8G9Lg4vEdMWm9nKlm8sLpPYJMh8wDJXRK:LeVwEDhR2gmEuWm9nUJkSGqwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771339999, "uuid": "a33c0760-e303-4267-8781-dd59ddd8ac0a", "value": 1322496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771339999, "uuid": "57a3b876-3aa7-4e0b-a615-b7b2404912c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339999, "uuid": "33fc544b-d12f-4ec0-9608-c85992d61330", "value": "PO 281803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50346877-0b9b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289711, "uuid": "5b8a07b1-1c41-4e5d-8767-90df82800c5d", "comment": "Malware payload (Mirai)", "value": "a2a7f4dedf39609d15b32fbfacda6795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289711, "uuid": "e75e38c6-4cce-44d6-9f0c-4a074b4e5669", "comment": "Malware payload (Mirai)", "value": "9ba736346978bf44972f6cb10430062eba95d9c25ff148ab2414da40ed281df2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289711, "uuid": "7d205a5b-c78a-4eb4-a488-b0218630080d", "comment": "Malware payload (Mirai)", "value": "d64868154c831a96ee229049f54e11d330d28307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289711, "uuid": "d0d2719d-0fd9-46a5-a69d-9341ef220a30", "comment": "Malware payload (Mirai)", "value": "48689e7a1cbdd84835d7444a1ab3ebbac63a3ff22a7d754686bb6665de0255c87cd13ef2fdb5be26cdb737d25171011c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289711, "uuid": "02e417b2-9d45-4904-8aff-1c0136907c24", "value": "T1F8C31856B9919B11D4C721FAFA9F414933136FBCE3FA3102DD206F64278A99B0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289711, "uuid": "49ed5830-f9a1-4bc0-bc15-ce9c43ceb9d5", "value": "3072:baj4dpin8kDKziXmUsaFrZTIMdxzsfweXL95LE108+:OyQnhKziFsaFrZTIMdxQfwMp5G08+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289711, "uuid": "e39311d5-cfa9-4b97-a7cd-863f36bc94a4", "value": 129692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289711, "uuid": "3980281e-3716-46a6-b9c3-5df79fbbba13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289711, "uuid": "3dfb9e54-d7ec-4dc4-b5f3-5bda2bc94f4a", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8a3f1a-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343072, "uuid": "4e53e5f4-fc38-430a-a79b-860d1ea190fa", "comment": "Malware payload (Grandoreiro)", "value": "72dbe8eed00629af9632b8374c1ef6ed", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343072, "uuid": "17bab389-2db2-4661-b0dc-58d7217c7cd5", "comment": "Malware payload (Grandoreiro)", "value": "9bec1f4e3398d32a591cc0bc92f5f1aa5aaba33da56bcd6b59cb186061a55e80", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343072, "uuid": "e8576346-fdb0-4bb2-9b4b-423713b47445", "comment": "Malware payload (Grandoreiro)", "value": "7480ce68db2d08e34b00653dcab4e76a4e8ed920", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343072, "uuid": "e055b28f-32bc-4eba-bd49-a3789416e7d5", "comment": "Malware payload (Grandoreiro)", "value": "6813d1265fa6799e8c70d8bbc1385cff890b28e1d0f68336950d700d3b4a0fb35044ccd512212d44aeff677e0b8d1dcb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343072, "uuid": "4cecc150-4df5-4b77-98f7-ce27d528a786", "value": "T179763331FB002D2AC6A48B39B43F3B316F3E2557498CA5D664DD928B7345BC3163E866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343072, "uuid": "2f4421e3-e7c7-4536-8a49-abaccd2ca8d0", "value": "49152:+5Fa4D6hBVU51Pno/ZkKQaC0R+Nza2VCFbRFOHArZn9u/xNFkOIjuwTGgwFDjZkz:BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343072, "uuid": "4bda6fcd-2315-45ca-a949-d5095a0eb6e9", "value": 7317504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343072, "uuid": "b65508f1-c846-43c4-a18e-3a889433d34a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343072, "uuid": "c23e744b-9ae5-492f-8426-f5cedf796e14", "value": "AnexFHNXA03856_GDN9753236AAMGB.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d400e1a2-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343190, "uuid": "00f5989d-4737-4384-b645-2b507b6b757e", "comment": "Malware payload (Grandoreiro)", "value": "5af875a98b5e6ba1bec9e7652f49de2b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343190, "uuid": "a2feecd1-86bd-4842-a315-67ace0d1c137", "comment": "Malware payload (Grandoreiro)", "value": "9c44632953c70ba0544a8b46cbc10cf027e0efedbf76af3a7a1dc8a028d4f842", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343190, "uuid": "1cad7625-e8b4-4ea2-b456-6519946c5e8b", "comment": "Malware payload (Grandoreiro)", "value": "568714a6aed17bf54ac516da086572dee51cab97", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343190, "uuid": "a7de2c0e-3eeb-4ada-8c19-4efd379820d1", "comment": "Malware payload (Grandoreiro)", "value": "46b103f71d4a0a220ce990a35100f0bc6495cfd6965fce5025ffed31e2f6c527a2da78d2de445d757b29f2b49c66f5b6", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343190, "uuid": "366dc8c4-fe96-46bf-97fc-92956161eff8", "value": "T1FE663332EA45686FC390C379B16F2E311F7CB7178148A5D139AD9286378BED1C62F462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343190, "uuid": "e87364f5-8596-47fc-aea9-4d06ba46cb28", "value": "49152:1VkaO4xhzUGAzycfvvO/LgHvmea6e+lGoQYKpHtZMsOP6FYarIIZQBZeFNnyoCfA:4yWnAUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343190, "uuid": "7d0450cd-e466-4a5b-8530-543dc4ac650f", "value": 6881280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343190, "uuid": "197a6e92-b203-42ba-a538-e5696c2e5f03", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343190, "uuid": "e5dc4813-8bd9-481e-8a46-7731d7f8e6e6", "value": "FljBGCF635269-1843RVORF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b347fd02-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343994, "uuid": "27349e35-e9a8-4f96-a0fd-8f3af8171c54", "comment": "Malware payload (Grandoreiro)", "value": "5a380f841dc76c4a1924431a6008a94f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343994, "uuid": "78bf6dfa-b07b-4e2e-b0bf-f6f86636462b", "comment": "Malware payload (Grandoreiro)", "value": "9d147c3b0186cae6ff13f5e2e0e51c2a6e173d840bc9c905de592ef1f24a5f4c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343994, "uuid": "80462674-db03-4a41-91a1-b40aae9b4dd6", "comment": "Malware payload (Grandoreiro)", "value": "06d26345ff65383151c2a998c5cbcccf5e97ec06", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343994, "uuid": "00742053-e910-4e38-bc4a-a2f0ffe5a81a", "comment": "Malware payload (Grandoreiro)", "value": "c302c2ad53da97f1fdb9df0bbe26ade2bcbbe7002cf92dfe3a9ad0be3612426ac11ea75b300f1f652fee2d2e65c14233", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343994, "uuid": "dd969433-75c5-4d94-9b39-4683d6a5d2ce", "value": "T145262375AA9A4C5BC9900330B11FAF321F3D6A434348D7D6B89CE05A3B47EC1AA5F4E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343994, "uuid": "014cdfe4-626b-445b-8d07-28313081e708", "value": "49152:Seho3RwzALLKcUsAq2Fcj5paYjQ2VS/xSCktmgdHUqlsfbBnV32SXpjuiapTg+:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343994, "uuid": "5613fb59-aa4f-4994-a493-ef837a7c3a7c", "value": 4716544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343994, "uuid": "2a39ed3d-60a7-49b8-a3eb-014ae95e7419", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343994, "uuid": "3e28d261-51bc-4916-937b-14b7b4128c7b", "value": "PlnlTXQOF_3555678FVCSKE7521.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a970aff7-0c16-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342689, "uuid": "66dc7a7c-d39f-46be-8eb4-6e15e35bd4b3", "comment": "Malware payload", "value": "475d4b207560a1a267eefb9a20a4bbfb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342689, "uuid": "4a4fd392-64be-48eb-bce8-d604db1eb73e", "comment": "Malware payload", "value": "9e02574a426bfe314f5e61bad6c8ca2aaa603a2b09071b501899fb2ee98e7afa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342689, "uuid": "9c790f36-ece3-45c0-8b25-fa91bf3045e8", "comment": "Malware payload", "value": "429dd979f0c6c18f2495f5f8f8dface4305d45fd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342689, "uuid": "301eed97-a990-47df-8983-5c4d8f4b4b37", "comment": "Malware payload", "value": "1f1ab68759ec5ad74bb1002bbce82a22ffe70cbe72f13befdfd695d120cbf651da71af0220e60609839467c05a6fad64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342689, "uuid": "eddb2adc-976a-434c-a34a-f56f7f4f488b", "value": "T1DA912975B78630AC9BE110EA953BA758B23E9315380B4032E7BDF8D13C20A5F8096F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342689, "uuid": "14b5d0f2-be03-457f-93da-bf57e87cf9e4", "value": "96:nItDJYtoAJS8ffKH1NPIX4rDIcQ0ucq4o5nZTAroRDEI7BmaL:IVJYtoA1ffqzr/IcQ0yb8rox/oaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342689, "uuid": "cf9ab2f2-fd23-452b-b394-aafecaa96498", "value": 4560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342689, "uuid": "edda3371-2136-476d-96a8-cca9310dc1ee", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342689, "uuid": "eac6f5c8-7e24-4f68-ba40-83fdbe8d65bc", "value": "0000015545452222214774124_97324031.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36655dd2-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349368, "uuid": "57f4c61f-8dc0-4c7a-b3c6-f292a5f7dd22", "comment": "Malware payload (Gafgyt)", "value": "f827e5a8f6eeddb6de7b5e6feaa200cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349368, "uuid": "e7dc54cf-74e5-4c12-91f6-88838c834f98", "comment": "Malware payload (Gafgyt)", "value": "9e4e12e6ce830f2e813addd8e7e4933153cf1204ed4daeb85b6edfcbfb84cbec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349368, "uuid": "f933b1b1-ee4c-484d-88cd-2a56c03f35ad", "comment": "Malware payload (Gafgyt)", "value": "3a62cd67c597a482cfe1335a1116ededc6af4979", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349368, "uuid": "4bac9139-3d07-4aee-af0b-1e6909efb08b", "comment": "Malware payload (Gafgyt)", "value": "d773e9e31d5df426ef2dac7b57edcca84460c032bd680fc5ed1a73a7656dd6d722528fcb1d623b8366541e8eba0b34a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349368, "uuid": "07248ec5-4fff-4796-97f9-2662aebb2ef6", "value": "T1E3D3A56EFA12EBBEE16C863107F76F70D39531A22AA1D381E16CDA181E7125C1D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349368, "uuid": "ce2b4b81-33fc-444d-af65-359fc0801a37", "value": "3072:7yfy/nxNak8f3FTXOFVJ5vUV2/zizybisFejdt1UhBl5tly3G5Ozk6DhB/ZZ9B8g:6fnZSZHbJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349368, "uuid": "c07a895d-c9a7-41d7-968e-d7b30bc1031b", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349368, "uuid": "52fc7bae-a7f4-4576-b06f-a38ef2eb9487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349368, "uuid": "b2d7176f-5256-481d-96e4-98d6b98cfe84", "value": "x86_64.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d00cbe3-0bca-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771310000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310000, "uuid": "5ca751e8-b4c4-4524-bf15-b7ff5c3f3966", "comment": "Malware payload (Mirai)", "value": "66bb6e62d6eb34e8a0064265734c0b77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310000, "uuid": "fb327931-449a-418a-a15e-5a881be6c371", "comment": "Malware payload (Mirai)", "value": "9eebcd36b43db42e9158f2fa7eba07457494a97b8d1cd110e69cc5c4d9681867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310000, "uuid": "3a932875-6cae-4e48-8818-29955dd9ef73", "comment": "Malware payload (Mirai)", "value": "cc680c1ebbc83fd8221ebe2a6cce59b25a6109bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310000, "uuid": "068c1ac2-9e64-4cd1-ab62-c00d3fd93b42", "comment": "Malware payload (Mirai)", "value": "8f3fe6a48250f8ef63e292c4876e29c0811522253db742a9e0fbbbcac01e27dea4173c6531d4030a59fde2100d52b3ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310000, "uuid": "ed95881d-34e8-4695-b4f3-adba96d5cc68", "value": "T1B7B3D91E6E25DFADF369833547B78E31A75833C62AD0C685E26CE6001E6034E245FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310000, "uuid": "a9c32ff7-20fb-4d26-9762-0dc7cac7ab15", "value": "1536:oN1qVEsdza07J1OVWCOiHqW9xKOxK4LK3PepoLZg65Lm5b5en9gnzRiQ3:Y1oJza07sOVWDpoLZg6w5bggnzRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310000, "uuid": "c234d157-ff11-4eb0-aaaa-dd09cc980353", "value": 109972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310000, "uuid": "4dc4f390-9007-4e85-9344-f33ebefe8842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310000, "uuid": "392f6678-01c1-45b6-90aa-6417dc3b93db", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdfe16b-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771343022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343022, "uuid": "a5383b5f-80a8-48e2-b2f6-b483e44239c8", "comment": "Malware payload", "value": "de53898132c377f4a8073cff37852109", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343022, "uuid": "4bd63d07-1f05-4f59-8c36-f45553a1d344", "comment": "Malware payload", "value": "9f1dd46b1b3fdb0b26083b71f94fc71e3d8d68c42d6ec67921dbe4cc032b49f6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343022, "uuid": "ab307075-21ee-42f8-ad13-38b99129fb1b", "comment": "Malware payload", "value": "4917dedda3fb594da73cb778048b955a008c59dc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343022, "uuid": "6002165c-cfb6-4482-8269-3966dc73a39b", "comment": "Malware payload", "value": "23fccf1fcfdbed03552cfc0cd1b3a427fd64af3d84669a2363a259b209707c51e89602113c83a575d535e2c04e766a76", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343022, "uuid": "0d0274d5-58e9-42e0-bf45-d4e9d459cf43", "value": "T1718601CAF7D8992FC4775036C97A16F255874C128A839F83A948720C6DBB5D44F8AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343022, "uuid": "5c9b6b95-1b7c-4384-aca1-f3363a23c0af", "value": "196608:welasiPnhW1obXpPz+Na7QiwLvCkHJUAN40fdC:basiwObkQ7avCkHJUAaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343022, "uuid": "e3cf67c8-bc89-4037-b513-57a77edf6daa", "value": 8075701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343022, "uuid": "1182fe6b-17dd-4af4-88fe-53a56993adda", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343022, "uuid": "a8c71405-89e2-42b3-8a42-7522848396bd", "value": "9f1dd46b1b3fdb0b26083b71f94fc71e3d8d68c42d6ec67921dbe4cc032b49f6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf94356-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342130, "uuid": "1a2da23d-cf0a-4ed9-8bf0-de2030d87b50", "comment": "Malware payload (Grandoreiro)", "value": "737a455da35b22d79ed47edb30788f14", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342130, "uuid": "fd1451ec-41a2-4a62-9071-24917357d93d", "comment": "Malware payload (Grandoreiro)", "value": "a000aa44129535b3d90c8f3ba7f8290e49e1c6ae5a07b27c1ce31ccb648360f0", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342130, "uuid": "32a46db8-acc1-4bef-bd59-0ef3b44ec847", "comment": "Malware payload (Grandoreiro)", "value": "6e70abe921ab2dcdfdf0ea86696ba0ad5c448f87", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342130, "uuid": "7bc0faa1-e1ef-4f34-93d2-fe1b656f44fb", "comment": "Malware payload (Grandoreiro)", "value": "65bbb0374ae4552b47447bd703c4754794adeb8409fc9ea879753b3e57f384bc267c0a744b0eccf557658ed9a53dbe94", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342130, "uuid": "1aef17ae-26d0-49ea-b756-a04a8603a2b0", "value": "T1D4A63331AE186C6BC2584375B47FAF3A2F7D3A034B8869D3615D71832B4AFC11A3E855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342130, "uuid": "c166ca39-5b43-472e-8f85-596de50c4a7f", "value": "49152:ZViu4zMQnKdej5F5Py4tNfqBZVE2Qbn1RKixx1rxr2frClbqn0ie/nTzOG7iyUJ8:Q05U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342130, "uuid": "306bd521-2eaf-4833-8e74-d442093f711c", "value": 9789440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342130, "uuid": "7a43c091-1205-4c66-bfbf-849261e67bf5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342130, "uuid": "72bc4a57-a22f-4590-98c0-397efb00f4d4", "value": "40868TYXY_ArbiQSYV-9223mdosc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d7005a-0c01-11f1-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1771333660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333660, "uuid": "ad847411-41c4-422b-9b43-80f6b31213b2", "comment": "Malware payload (ValleyRAT)", "value": "5adf5be463b10f5d183b2608de1d3299", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Yomal!rfn", "colour": "#08DB2C", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Yomal", "colour": "#D3EA97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333660, "uuid": "43a7bc6c-2685-4671-ba05-da6f814431a2", "comment": "Malware payload (ValleyRAT)", "value": "a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Yomal!rfn", "colour": "#08DB2C", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Yomal", "colour": "#D3EA97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333660, "uuid": "d5753990-09e3-4c70-8401-612f956943a3", "comment": "Malware payload (ValleyRAT)", "value": "a0fdb5603387f73fdcbf016722ad2ce7b5c1dd51", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Yomal!rfn", "colour": "#08DB2C", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Yomal", "colour": "#D3EA97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333660, "uuid": "ba5ee0c1-039a-45be-acbe-eeb13042ca9c", "comment": "Malware payload (ValleyRAT)", "value": "adf03e7b5058279bf4c04c5b9c87c2ed53df5a44506257ddd9a970e60c0b415d29ef78909ed424a042130a804ec41069", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Yomal!rfn", "colour": "#08DB2C", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Yomal", "colour": "#D3EA97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333660, "uuid": "78dfb98a-8230-47a2-9b9a-6df41521ce32", "value": "T134979E86B1E511E9E17BC038866B9707F7B1385507745BFB02A186792F23BD06F3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333660, "uuid": "de1a5e87-d2a8-4763-b25d-b8e8e9894c6f", "value": "0f746b0dfa3e0ccfa3f3ed5f0060f883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333660, "uuid": "d86cdaa2-685e-415e-a297-aacb571b069f", "value": "393216:eJopKgegab/BRRObGSlExWvdPijFJQX833vJSLiAU5IKYVE1C3dJS7xUYhqh3SRi:ppmwbNlExWgQs3eaq2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771333660, "uuid": "bd8cd974-c174-4682-82a0-6159149cf911", "value": 42105856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771333660, "uuid": "d4bb48d4-13d2-41b1-966b-e22637318fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333660, "uuid": "6f7cf7f0-761b-424f-982c-cc51fef3865b", "value": "\u56fd\u7a0e\u5e81\u304b\u3089\u306e\u901a\u77e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0a92f4-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300816, "uuid": "1c87e2ef-3745-46a7-9a1d-05583eef219a", "comment": "Malware payload (Mirai)", "value": "0ae407ade22776e2aad747a0906e4363", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300816, "uuid": "fe68bcc4-8cfd-4857-ae6b-44e7271d1b3c", "comment": "Malware payload (Mirai)", "value": "a142ecb42ebb35c6525adfc0c382910ffbc6ce115f756b5be86c4b2621d85c89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300816, "uuid": "1a4ffe04-dd43-4167-a039-5d5a56e076f7", "comment": "Malware payload (Mirai)", "value": "b8b6334e23c37a007dd59f7375ab8db1bc0220b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300816, "uuid": "48bcec0f-6138-43da-a7e1-731e65f47f18", "comment": "Malware payload (Mirai)", "value": "3a2108b50f7092ee24ef475e395b4a4a29ba99b531d83fe48239786fed3f04bb07197dd9d569c996493c968d651cc2c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300816, "uuid": "87298ea4-3045-4d0e-b572-bc1e547e8d07", "value": "T1A0B2F132C24C81A6E804807F73DE04FC9554DC8C5AECEB04F3855EAAC6DF72769689E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300816, "uuid": "5bd732ce-71e1-4683-a235-c5176d5444f4", "value": "384:Mo7/nrMpDElILLu8xiaEjjzr0FK+0KNa80HvEz/Im6euZoP7WEbMZQc/G9v1Rs:b/rMGlIPPmjjQK+0KU80MjTvuueXks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300816, "uuid": "0faff4c2-ba7f-4b79-a4a4-6e3b6f11062c", "value": 24184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300816, "uuid": "17c20df0-e7c4-4566-b5e7-6274cb4b3392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300816, "uuid": "b4893d8b-5abe-46d5-bd06-b090fd8dff32", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9909f6f7-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353829, "uuid": "f8774141-c8ce-43df-9043-f309efb411a4", "comment": "Malware payload", "value": "215e13686fa563fcb4a416f59e897586", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353829, "uuid": "33771808-df14-45c9-9684-ef46d7fbdee6", "comment": "Malware payload", "value": "a1608962cdcaca84443ae5d6094af48e39819534fe67c1a81d59da89e6a12742", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353829, "uuid": "db563536-543d-465a-b63c-8275ce5ce734", "comment": "Malware payload", "value": "2520ee9832dc79746ae83fd9fbe913135a89f92a", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353829, "uuid": "67a83193-dc97-4f9b-afb8-f9112720ec60", "comment": "Malware payload", "value": "ed7549db71f017191eda1c3e807d7d261705dbe81f55fa136bc522de0ad4d683d164f5039829b879904cd2f8a285a30d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353829, "uuid": "8fab8d3b-75f6-4128-897f-2552fe343fab", "value": "T1EC8623329E650D67CA648330B05F2E21AF3D9A134B08DAE3765C65873B59FC0963F4DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353829, "uuid": "c562ba1a-3a85-4e29-8b68-76c993fd3a76", "value": "49152:T14GLwwQexgagQ6C2FzhgvvVPj/ZsEIg6KHO3olqVo0P9wFQhe9QOMwLbvrxdKAy:oB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353829, "uuid": "ab92a5ce-6a90-4be7-9068-489eb0bd12e6", "value": 8249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353829, "uuid": "5b04fa68-c0cb-4c16-b023-54b9f59980e3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353829, "uuid": "3fcb2207-344a-4fe2-91ca-c31aba47642f", "value": "RN183146Im_JAIF-6502R7L14.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e81107-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313108, "uuid": "42643f7c-a18b-4c39-a00d-d5dff8d82474", "comment": "Malware payload (ChromElevator)", "value": "d58bedb6262856d1ca0cbdfdefa03afd", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313108, "uuid": "4df34de7-707b-4d94-8b51-7cf485176b36", "comment": "Malware payload (ChromElevator)", "value": "a1c56fc63d58c613115c298baca7da311f021e451c4394b08323b95572c2ecb6", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313108, "uuid": "240ce5c5-6064-409e-92cb-0bba4dac9630", "comment": "Malware payload (ChromElevator)", "value": "14031415fc2bbbaf4cd4b3cc435363e9f91df1f0", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313108, "uuid": "5a349986-3695-4ee4-b16e-cadcd6686a1c", "comment": "Malware payload (ChromElevator)", "value": "3849212738e21f4c32f4d259ab2672dd9808d22ae66fb53abaf840ad2f3e3c8bc953bb67ab5c5ba8dc96dd8ceafcfcb8", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313108, "uuid": "0888e945-03df-45a4-bafc-e23a288b9382", "value": "T12F96D75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313108, "uuid": "bd758006-f72c-464b-84dc-f7541f74af9d", "value": "49152:188BRiLXgwaDHNq20x4qmjtINGLP1n/8ELqjdqigeQjO69/erjMqDHC500NchR8D:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313108, "uuid": "f06ff956-64b3-4833-9e74-9bdef174b3f7", "value": 8922052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313108, "uuid": "6380b951-9fea-4582-bd93-b585c94b2f3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313108, "uuid": "61a09973-7223-4ca7-9554-124ebdded95b", "value": "nouveau_curriculum_vitae (9).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bf1296-0bf8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771329800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329800, "uuid": "e4d837b3-7a49-4c80-a2f8-5f6398ee2b11", "comment": "Malware payload", "value": "6d58a36b003bf93a002b0984277dd8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329800, "uuid": "9d326f71-ab45-4cfe-9f88-70f6957bd425", "comment": "Malware payload", "value": "a1d6cd23483dc70b990f2ea2852a6a9e94a85250483a6654d8d7cf7036c2eba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329800, "uuid": "d98e06c6-6561-4576-bc10-987153d2d442", "comment": "Malware payload", "value": "4495bc1ba42e3dc1b6be0976ffd10a0e1b5596ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329800, "uuid": "0bda86d3-0c8b-4a5f-9e7c-4f5589a2e78f", "comment": "Malware payload", "value": "d67575bc436219de9605ae3b6280aa24a2ae48630c9d56c70ccbe8fbcbf895780e6461d74a9d821605c2c7ef70a9570b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329800, "uuid": "16b43a75-8c17-4e35-9faf-8393bdbdb9bf", "value": "T11E65021B67A500F9E1F7C174CD42590AD6F7FC494BA0EA8F43944A961F237A09E3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329800, "uuid": "4ba32842-5a17-43f1-b696-8d3386558dfd", "value": "188d16fea4211d13fda773d8f06ba63e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329800, "uuid": "b4495a16-75a5-48b9-9de5-c250d58d007c", "value": "24576:ycVJlDp40Pxnm0wbQrizZ30aWG6rua32jMMHDXhNlHfZ9WiMt67z25Z2:ycV/+ImVl5qG/HrThWi4YiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329800, "uuid": "8318f9c1-1e38-4e19-ad52-d3d960c08c9e", "value": 1449472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329800, "uuid": "8aac866c-97cd-43e9-bc59-b1c219a378c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329800, "uuid": "7d32a5ef-0655-4657-a4f7-ceaeef1ea25a", "value": "4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beacd8ff-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771344013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344013, "uuid": "0ebdbe76-6125-46f5-8fd7-1f5f862ce3cb", "comment": "Malware payload (Grandoreiro)", "value": "6f22dff6db4cd537a1b2a09f6f47b838", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344013, "uuid": "c055201c-bf5c-4de5-b4ff-69faa3282f5b", "comment": "Malware payload (Grandoreiro)", "value": "a248fd58182c2fd90be7f23b2172fb582e63ba38bc200f87b96a414a12c48cb8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344013, "uuid": "2ffe3b8d-46b2-4a4f-815c-055d8e9d1f0b", "comment": "Malware payload (Grandoreiro)", "value": "28b9daa40e1995ca2b720d03979e5a241e3b0c3e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344013, "uuid": "2fc56e52-bab4-4215-9028-33ca1876a355", "comment": "Malware payload (Grandoreiro)", "value": "639104b383b626d73cc7ffbcfb611f63d700e58a8423cd72ab022917c55c9447795132ed623f7614d632f1c21cdd0ffb", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344013, "uuid": "04974317-2f27-4312-9c39-097d4fd933f3", "value": "T14E763332BF422C3AC2904730B05F5A3A6E7C3747454FAAC6B5AC94877786ED0D56F0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344013, "uuid": "a162a6ad-e5ba-48cb-a9fd-4d54e27e9644", "value": "49152:lvd2GvHzBYdUuAkHfGW1dxDaBti8X8C7GqllkGpsysVo2lAk8ZasPHIxzXW7MFSA:yuim3Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771344013, "uuid": "8d60d714-e72e-4d51-a852-e85e022f8095", "value": 7413760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771344013, "uuid": "300bfe1f-9ab0-43e8-af03-8b5fe3a35070", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344013, "uuid": "9bfa6fac-dcad-4809-8de2-467269c1510d", "value": "Prdc2UCF5R_591873OLPBM0Q7Tbszymg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f791566e-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343250, "uuid": "76b2fe77-e7da-4da0-8ee0-c2003391ee4b", "comment": "Malware payload (Grandoreiro)", "value": "22f8380cdaad205041cae3446bf79d72", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343250, "uuid": "9949aaee-0e96-4ba2-be9b-704eaaa2f27c", "comment": "Malware payload (Grandoreiro)", "value": "a2c70b417e960f2c4fe4975b948f5111362d98a08b2c3d6ca9a6b2c3554c2075", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343250, "uuid": "e004285e-57b1-417b-9e35-8580dbf8257f", "comment": "Malware payload (Grandoreiro)", "value": "59d62509cd7da368381aeb3a18ab443543730f2b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343250, "uuid": "1c4dbee4-388c-44d5-a28d-1e2141847082", "comment": "Malware payload (Grandoreiro)", "value": "6d28926667286007305edcbd13ddf6db5b9fc4bc024cd58d9fe1a924122ce004bd1414b00f92ca295391f64bfa337c1a", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343250, "uuid": "185f906f-308c-465f-bceb-00fb15001eb8", "value": "T1B64623719E554C2FC65043B0702E79266F7DAAA347CD95CB7A4CA182236BFC0E63F498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343250, "uuid": "85e05224-f99a-4f80-a008-9de0dc48cb13", "value": "49152:8Dd0iFVJRrEwi+kouT1DVusAQPhDAARXV07vgRvBJ/JnGQl4NOcn1D3GKWaKC5gY:iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343250, "uuid": "2ac68162-fe3b-4fe0-a8d5-88d162019f5a", "value": 5754880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343250, "uuid": "3ddfe6ae-e526-459d-9adf-9ed228de43c2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343250, "uuid": "b81caf65-8843-4a47-a635-3a079d62f7a0", "value": "HbrO3D3B3830322_YQHGpgmpn-NotaP8LV.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396294ff-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771290532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290532, "uuid": "48a43bba-9106-4f17-9259-380826326577", "comment": "Malware payload", "value": "e29587728ef240f6de53cbc1ee0587a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290532, "uuid": "db6a3e95-5f84-4eab-9807-9ed87e6bfd29", "comment": "Malware payload", "value": "a2db02a5ce867528655d9a8d98784dbf62b68e537dc25832a18639f8241ce0c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290532, "uuid": "36d3cdb8-a73c-4f1c-8c96-6b1077e1eb8b", "comment": "Malware payload", "value": "066d03cec7ddabf9e4e2f954656caa104f0f9634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290532, "uuid": "a87392d0-9e45-4228-98a8-80e63edb281d", "comment": "Malware payload", "value": "185d7ef9c6644baaf961c8dfaf1562ac305a35d68c93316cbdb9839643a338ca9416d69f13fe0b291b293a497e5fdb1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290532, "uuid": "cd13e1aa-6b75-435a-83e0-eb018d5246ac", "value": "T1BAC66B01FA8B98F5E9031835416BB23F63355D048B28DBEBFB543F6AFC7B6811966205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290532, "uuid": "5b81b7d8-48ee-40f0-bb76-1530989da41f", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290532, "uuid": "796462a9-59a8-44d9-bcf5-e65a0ba20c7d", "value": "49152:42h3b7TfAa67WCqEQRI0aLXFcVBxVjyTzACZqL/XNdajA59RGLndzrp5om93cIzI:LFb7TkW0d/qL/ajyIXXOYl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290532, "uuid": "08075b39-e8d1-4a6f-8b5f-e49a68ddedf6", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290532, "uuid": "49b3de5c-34e2-4fba-b1a4-04dc7574a001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290532, "uuid": "dcd7ff92-4c29-44fb-b35b-e4004545bbee", "value": "0tiic3la2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5903a9c-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313101, "uuid": "02e32a62-2a29-420a-b3a3-72800298f124", "comment": "Malware payload (ChromElevator)", "value": "8d964fa1a87cedc07b302296e531bebb", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313101, "uuid": "2f8e43b4-b22a-4c2f-96bb-72e9f324cae5", "comment": "Malware payload (ChromElevator)", "value": "a33bf25ece3360c4d75127aa032f20f5093fc2cd20fcb709f0370369fcf0b9dc", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313101, "uuid": "de0caa19-d450-49fd-8b6a-f6d85c08f2e3", "comment": "Malware payload (ChromElevator)", "value": "129cdabbeb9c785a094f76d1ae2405629a39faca", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313101, "uuid": "482591f8-1690-457a-be8f-6a1faf9cb866", "comment": "Malware payload (ChromElevator)", "value": "207dc0fa345b9bcbc0095bf5b98c50542db34b7a81364f8bc50ee54d495213c1deff85b6c70f406c84c28a7f78e0b6e3", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313101, "uuid": "5d7ad221-73c7-4716-ba29-0bcf9674df11", "value": "T1D196D75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313101, "uuid": "57e271a5-ee1e-4597-845c-9dd00bd66aa6", "value": "49152:PfKvjZsxiGeLG9xrzwrxDPGU2Gg2GXeLsviFwIONPsoUZ3o5DC2im/bqlJODFNwE:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313101, "uuid": "d96537df-2d00-4eec-9a46-18509531414f", "value": 8956839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313101, "uuid": "2fc55e60-2c8e-4ba9-8dec-5ea3b3594b44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313101, "uuid": "e3c620f3-a754-4de4-8043-52e717b36599", "value": "nouveau_curriculum_vitae (8).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcb5ffa-0c01-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771333727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333727, "uuid": "e3508d5e-8dc3-4096-80ee-38bc731c14c3", "comment": "Malware payload", "value": "099d783c5beafa513332639db766dc73", "object_relation": "md5", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333727, "uuid": "0fcfa301-4e14-4848-ab93-2fbf4ffe6efb", "comment": "Malware payload", "value": "a3d98b61bb0f409aaaf0d4f1d1029e35211ba6fbd6419082677a2d29ee7e403e", "object_relation": "sha256", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333727, "uuid": "802308c3-ca11-4394-a4cb-06bb1775adfa", "comment": "Malware payload", "value": "beb5f99a8239f4c32770b24c758ef767f4d8701a", "object_relation": "sha1", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333727, "uuid": "b00ac203-ec02-49d0-8111-6c754ff50966", "comment": "Malware payload", "value": "f526b23510c82c2abfdca139bb1a075a20ea4f01b717d067bd314045ae0752d9a6d81d8c64895eec0765702ec456015a", "object_relation": "sha3-384", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333727, "uuid": "de8b101c-a15c-4b38-9a09-79c6f9e81b0b", "value": "T1B2E4D887F1209AC7F84FDA7F14504210ADF0E0704607F2562B6E985A6FEB9C89F653E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333727, "uuid": "9f97202b-872d-4ff3-bdd2-55f24623df9a", "value": "6144:y1eMX5Uh/W94gpr2TYPjhMoQd6/0HFreDqAKk3HBgr43UM7vUI/1ip3x1Zcg:yhnyA9rnj/1Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771333727, "uuid": "a611cc06-751e-4f1b-af74-66371ac20804", "value": 702321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771333727, "uuid": "503bce72-7451-4670-9291-3011b0678150", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333727, "uuid": "3d6e7727-b4ff-44c5-bba4-b6e6e8219d92", "value": "paperrigger.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40df08c2-0c32-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771354540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354540, "uuid": "6acfd240-3a23-4d94-91e9-f0102cc81157", "comment": "Malware payload", "value": "96c314ea861e3136e2248641ab2f225e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354540, "uuid": "c08dbe4b-56eb-4156-8b74-7a792f10ffea", "comment": "Malware payload", "value": "a3e22155f561785a485206de87c68b4a1b15e2103202f0269fb6ac3f0cb661ea", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354540, "uuid": "b2608d50-2065-49f5-8b39-795d7f9747a4", "comment": "Malware payload", "value": "a63d305045efa88145d4ec0ca8c4cbc30a9a83f3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354540, "uuid": "ffa504ed-e26d-40a4-bd2d-c1e1be706186", "comment": "Malware payload", "value": "0ea42e04e8905ea44d8781e2c9fcadd8e8a14f35e97e0a921ea174297e393bfbe6d578fa9b09f803d14798b3825d3b86", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354540, "uuid": "96ef31ec-b25c-4966-9bb5-5a5ae4242d2f", "value": "T12415335CAA186B02C75ED37AC419D184554E38C236D3E9FE82F21BBEFF4A2B31516127", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354540, "uuid": "91d28e92-e610-42d4-a6eb-c4d581f4f253", "value": "24576:TOmSZ/NID0EZi6nt2TGEakA5lBczML/CGc87YgbbwfZ:imy/o06nt2TGEnAMMOW7YgPwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771354540, "uuid": "9656de43-5058-42bb-8aa4-72fac255d914", "value": 898450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771354540, "uuid": "2c9da46c-841f-4943-9143-3463497fd833", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354540, "uuid": "034fa312-f680-4fed-b49b-b30abd559fe4", "value": "SecuriteInfo.com.Trojan.GenericKD.79340617.866.32039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11a6312-0b9c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771290411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290411, "uuid": "3a0011e5-c714-4f0b-af13-aa67d532088a", "comment": "Malware payload (Mirai)", "value": "6c89b4eb90b9e5d7ac2d070969431a99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290411, "uuid": "5437772f-9268-4649-abe1-506af71b5534", "comment": "Malware payload (Mirai)", "value": "a4408e513a420676631ae7bb525567923818eaacc3b1571bcbbefa636084971b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290411, "uuid": "b720d4f5-f76b-4232-8ea2-ff178607fbc5", "comment": "Malware payload (Mirai)", "value": "1c241100d0a89e5a877475fbe5a31b87e3134ef4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290411, "uuid": "063355f8-e6ab-4aa0-b9d7-2925511fd88d", "comment": "Malware payload (Mirai)", "value": "42d5720aaa69c0f4da1dfc3321bad36f8414ec404aa1c42b7622bbe2e63ffa0a2c5d72ce2d94a273754ca787a0faac33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290411, "uuid": "39e82729-a3fb-4773-9938-85a1ca9022ec", "value": "T1E7A30906FFA10EFBD86BCD3746A9070634DC950A22E83B3A7974D428B54B58F56D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290411, "uuid": "db5ea4d5-c9da-429c-af67-0883b0aa79be", "value": "1536:zSz6QUsFqu/T6/KOhT69TYHeqFPBMoPs1r0Zq16wZYTWep9PknzY:zk6QUxu7LOhG9TYHZs1r0Z/wEWnzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290411, "uuid": "1fc6081c-3c09-48da-8085-9270a490d980", "value": 101752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290411, "uuid": "a493c573-5ffb-4bd6-9156-7d08ced4c47d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290411, "uuid": "bac1df67-43a2-4e65-b8bf-9ae2c52cb292", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af77c78a-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343988, "uuid": "744bfeab-07ed-4a03-b6f4-a40ad6e762bf", "comment": "Malware payload (Grandoreiro)", "value": "7b705e42359ec909b6507eef5c8522d5", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343988, "uuid": "a0c15a77-a687-4892-bdde-4d1fb340242f", "comment": "Malware payload (Grandoreiro)", "value": "a4ad278cc1fb6e29b496eaec4c641bb4714edba8f58d9f61d6a1fd3d688d717c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343988, "uuid": "3f548899-d57b-485e-ab76-f1c3f10f666f", "comment": "Malware payload (Grandoreiro)", "value": "1d9e3be6347b645196dc99843c6674f91734d784", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343988, "uuid": "472c6c54-348e-4bd4-aa4c-889fcac84425", "comment": "Malware payload (Grandoreiro)", "value": "a95de580333de9c3926f441aa51e4546d444e72215e2b1b69d15a13045146e667754900e8e611eea7ac78e910831168e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343988, "uuid": "c47526cc-fa69-4534-b45f-f0bea8a7eca3", "value": "T1916633716F941467C7944376B02F6A69AE7C7643424CE0C37A9CA09A234BFD2A57FCC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343988, "uuid": "76e983c3-42e4-49da-a3c2-60953fa8cdb4", "value": "49152:IZtUAiKdGmnZ1jGK+YbmEWlKtLWkyprBGkKVms4W96ZQx4o0nGkxoa2DEsJxoP6S:QpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343988, "uuid": "aae3d84e-35a1-4f36-9c34-d122456997ec", "value": 6776832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343988, "uuid": "89cee2a5-434d-4b51-8a9f-08ee98fb57ab", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343988, "uuid": "a2b6b484-b72a-4349-ac6a-e3ec16a7ef02", "value": "PlnlDDGJHV_42085YU4RYBV2408.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55f16ee-0be2-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771320483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320483, "uuid": "53c4e547-eb87-4add-85fd-baa532a1e7ef", "comment": "Malware payload (QuasarRAT)", "value": "b58bc741ee46bb08174b1da8e1ab5707", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320483, "uuid": "ac5d17f3-9a13-4934-a93f-01d439c1cc7e", "comment": "Malware payload (QuasarRAT)", "value": "a50084ff1459f1389d467dc06b5f4fb5e48024ddfd1a9ad8fda65b09f915fb0f", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320483, "uuid": "66d0f793-22b8-4ab5-899a-c04aed63470e", "comment": "Malware payload (QuasarRAT)", "value": "01005e3f1bf85bad04676f20356a9436a84b7154", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320483, "uuid": "e6815602-f4fb-44f1-8d2d-0ad60789026f", "comment": "Malware payload (QuasarRAT)", "value": "d27efa0917038c1c96a31cdbb0734b25bb30d73bc446b23691a3bb3c73a847bdd1e23f6500bd0816bba9f5ab4b064cf0", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320483, "uuid": "2a2369d6-bab6-477a-8cbc-e92a5fd011fd", "value": "T1ADE7333DA0C299825F1A761EF1962307A84D57B2073A8A3DBA331F637F61DDD9437422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320483, "uuid": "902a89e3-dec6-46d8-abe8-cbc4708650f1", "value": "1572864:oZdinFAuwXLWstRwac/919l3frWNjXjGn8cDhkA+Q9:+iWusWYzc11XqNjzG/d5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320483, "uuid": "4b051cf3-a396-46b1-8579-01cca624d054", "value": 69499922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320483, "uuid": "52c9101a-7061-4a2a-b188-989c7a00343e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320483, "uuid": "83241a46-4648-4c8d-9aaa-def15ac86f8c", "value": "botchain-desktop-stable-v1.2.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bbf67f-0ba0-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771292132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292132, "uuid": "cbcc468c-7961-4541-8b02-705893611832", "comment": "Malware payload (Mirai)", "value": "fcd7e7d21bc4ea521ea149cbb0dda9fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292132, "uuid": "7aea8725-71dd-40bf-8a6a-a532375771e6", "comment": "Malware payload (Mirai)", "value": "a51bd7639f0e30a76d7207e9ac14cf746b3e004f27a0347bf324000de97a291d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292132, "uuid": "c0151437-ef47-4335-aa7b-76de4c195045", "comment": "Malware payload (Mirai)", "value": "13f47c162a097f64780444652022726c87bf3af5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292132, "uuid": "4f2f1f23-9e19-40c4-a641-dff8cada7b02", "comment": "Malware payload (Mirai)", "value": "e06745306d8a6fb93ed941421473b1a710ca4688617146c7c50595031f23ab2958dd3c138b89dc2a4440e605dd424160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292132, "uuid": "d3802ac2-74c0-4c8e-b356-aaccdcf410d0", "value": "T139533A22A9792E17C0D5F57B21F38324B2F56B0E24A8CB2D7D720E8EFF1855065472B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292132, "uuid": "f62f6b52-bd89-462f-928e-6b1a15a601e8", "value": "768:cnol7i1qTSCq9r7Cw7p1oY8dwJONpn+d9E5mp5MiSKuSGO+h9s9F40:cnEiwGCSr7CSpiY8dwJwpn+d9x3EhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771292132, "uuid": "f2a04227-58e2-40c8-89dc-ba4b0eb385cf", "value": 62484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771292132, "uuid": "38155fe7-231e-4b72-8fa2-a29b25032447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292132, "uuid": "e924debb-90bc-4f4e-8feb-1b2d491bd285", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f5cf7d-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286948, "uuid": "d2227514-0668-420e-8992-76d0e65b6e3a", "comment": "Malware payload (Mirai)", "value": "5a05a5f2db5594c9ceb07ae224d7c428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286948, "uuid": "eeb6f4e7-d44e-4586-946f-1a9f186312eb", "comment": "Malware payload (Mirai)", "value": "a55c7895e856356915105936f3a850521fc8ded24cae1e6320d72ddcc0d46a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286948, "uuid": "295d69c0-c4c9-452a-ba0d-e74e1923566f", "comment": "Malware payload (Mirai)", "value": "423b5edabaf16b7336a0a602a8566c8d633a94fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286948, "uuid": "f135449d-1532-4c47-bec8-5eb7d3b23c78", "comment": "Malware payload (Mirai)", "value": "744532213b2e54c30ddcd999b02098cc88ddf0dcda9fb6bb3eb25d584443ebb4bb4f644c8666aae1ad79a7c514b96004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286948, "uuid": "32997e13-d79b-4363-beb2-02ff5f088375", "value": "T12763E597F801DFB3F40BE67A45D34815B930BBE60E921A72726339A7AD360D51823F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286948, "uuid": "9ae2f58d-5aaf-4dd7-b49b-d76660dd86aa", "value": "1536:rYor1ZytTnWqLrD8GA0Dz1yXJk1439OSH01iGM0C:csZy0qPZDz1yXJkS39uMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286948, "uuid": "edb6427d-9954-4d96-841e-692616b01b3f", "value": 72096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286948, "uuid": "ee9e2666-9c1e-456e-99d2-952690e3ad4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286948, "uuid": "e18d6881-508e-4bb1-b5c9-7b96a9552ceb", "value": "openssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f4125e-0c43-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771361987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361987, "uuid": "eaf2af3d-7975-4acd-b187-9ba0e9997222", "comment": "Malware payload (PhantomStealer)", "value": "0abc01258f90e2d8688c56fc339b97ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361987, "uuid": "19a53748-d3bd-4015-912c-22629b64c819", "comment": "Malware payload (PhantomStealer)", "value": "a578989343df52383e1009d0f1fb9773a96fbb83d1548c557b2f619ef224d368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361987, "uuid": "9262d840-f102-480c-8f98-b360fd8daed5", "comment": "Malware payload (PhantomStealer)", "value": "3229b4b2813b4416d1be08e02c33dba25b2d0900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361987, "uuid": "56544c20-47ca-4d68-b57c-b27d2b18deeb", "comment": "Malware payload (PhantomStealer)", "value": "835fa5739dc983bdaa620ab681f897db4cb9cfb0d387134c8ee10e41a302477f74dd6fe09cdef220ffe3e00d0456fcbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361987, "uuid": "4e25a913-a8e8-4106-b883-248adebc161c", "value": "T1588522151325DD03C4F70FB45E32E2B44BF06E89A912D3539EFAADD7B43A6812C4A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361987, "uuid": "71e46e63-b525-4b3d-9696-46b07a526d73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361987, "uuid": "bb69092d-8408-449c-bb65-db43521d7f74", "value": "49152:DeVcc3fr/DU/Zu0/Pm45Zy1pYjTebM6D:uj/eM0n7y1CebM6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771361987, "uuid": "74214a5d-3a97-49e7-89c7-c184a857a50a", "value": 1821696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771361987, "uuid": "4c639982-cad6-4973-836f-2424cab21e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361987, "uuid": "e50e56f2-6f43-40fe-a7ec-b846c794ac5c", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08ded8b-0be1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771319938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319938, "uuid": "4917870c-dee3-47e8-997b-9d2179382120", "comment": "Malware payload (AgentTesla)", "value": "949feb2886cf43078b2d661f5cad96cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319938, "uuid": "d8a44dcb-e05e-4c41-9dfe-154e6d816aa5", "comment": "Malware payload (AgentTesla)", "value": "a57d6c8a7921154096bc2a4ef475955ebb74561e812ff12aa4e8ad509745a7d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319938, "uuid": "750e3736-3127-472b-b166-9895ef8d8d65", "comment": "Malware payload (AgentTesla)", "value": "d7ae66ec7d85c24e55de5f43da8a877715617e52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319938, "uuid": "1e93861f-0b57-4634-b4fd-9eb8ee100a6f", "comment": "Malware payload (AgentTesla)", "value": "1859b444ddb0d4468f2c784fddb2f08456002ac92d1fc3896a503fad5faadf266cb45419272a697a58bc96d0a6e50eeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319938, "uuid": "b38070ae-1afb-4b91-8b93-17c60d51edf2", "value": "T1D754F1352F66C63FCF4C92B1F8D1033903BD86EA7211EAD29662B94A3E1B75191914F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319938, "uuid": "13685f1c-165a-4f94-bae6-7a202b1bd34a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319938, "uuid": "e5066454-670b-49e4-99e1-0556538ca42b", "value": "6144:xkQJNawgOEFuGSsI9yrz6BCJWmVAjsJG1WPiGLauW:yQ7abOE9SsWa6BgPVOV+nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771319938, "uuid": "fd282714-a79a-4207-a219-29cb4ea2b016", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771319938, "uuid": "734f2168-c8fe-4fbc-916e-1872b6f3ddf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319938, "uuid": "365fe575-268f-4a97-8a8d-6202fa19c297", "value": "a57d6c8a7921154096bc2a4ef475955ebb74561e812ff12aa4e8ad509745a7d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445597ae-0c34-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771355404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355404, "uuid": "48b90524-312e-4844-8308-a3f1699abe4d", "comment": "Malware payload", "value": "a6d976db338c99cf8bdb4405697a4087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355404, "uuid": "cbc0dce1-040f-4bfa-9bcd-55af7f566b5c", "comment": "Malware payload", "value": "a6581c98cfe10bd65dc5fdb90fd16afce8fcb9b3f088ff49bd67afc1746ed4a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355404, "uuid": "5e43faac-1a85-414f-854a-0cf1f358639c", "comment": "Malware payload", "value": "1ff63107ab9981df1bfe842f43c62a64d2761a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355404, "uuid": "b8c75c3a-371b-448a-bc8d-aa56bb6d707c", "comment": "Malware payload", "value": "6b037c3e1ec4f1a219826775f267440529fb005ef5273ca7eaac32370473560ef6a3dd350c44ab537c99549c2e106cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355404, "uuid": "3ac04986-7229-4c6b-9a9c-cc3a6d01db50", "value": "T19595D023B28E673EE46A9A3509729A50543FAA60651F8CB3D6F40E4CCF2D0501D7EF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355404, "uuid": "8b1f4664-8a43-4689-a39c-9868a4875a97", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355404, "uuid": "5c75a783-234d-4da5-9a11-af800ab1ff0f", "value": "24576:qXkwbj/TcZiYT3a9rgS8uOvNnUzeG5frfMm77NmIrWN6xj5OATw+am3TsRZZannM:qnfhrouOudl7BXrWiI03e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355404, "uuid": "056b85e8-8da8-4f7b-801e-d3c1ae1ccf53", "value": 1948336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355404, "uuid": "d9e5b94a-7b34-40c8-a63f-c56ae384197e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355404, "uuid": "592c58b8-ae91-457b-afc5-c420443a6874", "value": "mp3tag-3.32-installer_AQ5-HW1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffaa87e-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771313092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313092, "uuid": "8634cd71-d7fd-4288-8141-f472f022ce4b", "comment": "Malware payload", "value": "73f330ad56b9783b2bde2b25a28c6071", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313092, "uuid": "9e51e0a5-b088-4f31-ac09-8adaf1d0e35d", "comment": "Malware payload", "value": "a6eddc876b0471ece3d84b10acf32b2a0c3c0b6ea224b9103481e17241c81b50", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313092, "uuid": "54f296ab-4ee8-4dac-a68a-41c67f892b44", "comment": "Malware payload", "value": "18b5379777f60b58fa72ecb2f091c59be9f637a6", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313092, "uuid": "f24e6431-a533-45db-894f-6e4a5c1a2b6a", "comment": "Malware payload", "value": "4b5c8fd9831d167a77fdc7fa41b25fb08982c58d35cc82267611e65e83d11dc85b1df6f723b9683aa2e60b38a556ccb8", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313092, "uuid": "220ca998-0935-4016-bc00-402040eaef44", "value": "T1DE96D75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313092, "uuid": "8e0c9e7e-edd9-4e2e-bbf4-4a674257180b", "value": "49152:mhosygecs/fHI5RVhVmThJkZc0I1USD0UtQ6MGgVkMCS3owNqZdXo0c5SbiETI2p:Z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313092, "uuid": "eb3fab52-f53f-4cfc-8832-fccb1620ca24", "value": 8723370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313092, "uuid": "e159cbf3-0af6-4e8d-bde7-9e6f8ac33f2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313092, "uuid": "96a7b501-8f78-42f7-92e1-0ebe876073bd", "value": "nouveau_curriculum_vitae (7).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692c82e0-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341722, "uuid": "f06f49e9-e10a-4cb5-8d6c-623d7fd416c8", "comment": "Malware payload (Grandoreiro)", "value": "e6650df9bcaa42e036ffd8b9f9283c66", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341722, "uuid": "afeb4cd3-e844-499b-82e1-56f1d4859417", "comment": "Malware payload (Grandoreiro)", "value": "a72f9c45e458b12eac0fde5e4cc0491dd396cc2beb108e5d8024257aac2809e7", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341722, "uuid": "092c68a6-b6e8-43f9-811b-4c29000dc5a3", "comment": "Malware payload (Grandoreiro)", "value": "6947968c4e3dde3c7b9cc7625965895173e47ca8", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341722, "uuid": "c6ed18ee-e58a-44e6-8735-7431792efe1c", "comment": "Malware payload (Grandoreiro)", "value": "8ee76f9d54aed52236846892ee18fa833db503a9a346300e27a50bb83743b1f8342bf6be50f705f1ed4c7bf28f160e35", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341722, "uuid": "66e4591e-89eb-412f-951b-4a07a069ded9", "value": "T14E763333DE441D17C25483BA39372F262F3D6B434588E9D6606CA3873B46ED18E6F866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341722, "uuid": "1d3f710f-950b-45ab-81ea-31012b447b2d", "value": "49152:yDuOLsxb8vbl3pGopp95a8TCd/H+FIOb+KWG53kzKiTRfVHPg2E/LmRd/U+OZfMv:4xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341722, "uuid": "030dfb60-361f-4982-b107-31180d3104c4", "value": 7186432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341722, "uuid": "d8ce0fb2-aa5b-43db-9e08-6437a71dcf76", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341722, "uuid": "0b8726ec-41ff-417a-a98d-96bb49e463b7", "value": "0Ord11808_JNRB8I8X-Judi26477.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a64e457-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352328, "uuid": "2b897fb1-377c-45bd-b7ae-7393e9bf14c7", "comment": "Malware payload (Mirai)", "value": "3b0d2aa6fa7ef1e00e06d46f614250b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352328, "uuid": "9b99f17f-1c30-4b37-a793-73251ff156a3", "comment": "Malware payload (Mirai)", "value": "a76031c924c887fabd580f9decc3b92d009a183a876c495715ae37d29ce2d06b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352328, "uuid": "c54ea972-afe0-4d9a-b06a-b8d937f1cb1a", "comment": "Malware payload (Mirai)", "value": "fe6a1ba425dd1be0dba005983b28aa74d26af791", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352328, "uuid": "6b7e0e2a-be08-4144-a5ed-41dd8021f354", "comment": "Malware payload (Mirai)", "value": "5c229d9dab1460e2622471614138dd6c6ab669ca711e8f039de6b05bc588e47577ea894da4f06934f7b55cb14dbccd46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352328, "uuid": "3b35841c-eddb-4630-aac1-84b96e991b77", "value": "T1AC73A31ABF610FF7E86FDC378AE91B45248D641A21993B7A7D34D418B24B24F49E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352328, "uuid": "9d9ce0a0-9205-4e30-8bea-ef015ac914ae", "value": "1536:5Y2Vu+dSm1BJRc4gRGUUpuoB8DuPSwteQHBX:5nVu+dSuBLgRGlpDe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352328, "uuid": "aa981eaa-b320-49f9-86c8-9652160b6211", "value": 79868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352328, "uuid": "0d2fe4ea-a637-4883-9435-2518b3857822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352328, "uuid": "c1e08c30-6ec6-4db0-bb31-05fd9b33417b", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a24c907-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342234, "uuid": "61c6eb62-138a-4748-a445-619305004a23", "comment": "Malware payload (Grandoreiro)", "value": "78dda8a697c94ed4fb3087bd9585328f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342234, "uuid": "d6b53cfc-2bc8-4013-a43b-ffdffb1189df", "comment": "Malware payload (Grandoreiro)", "value": "a77468757fd0481c0dc93a5ba814e1ae1abcc5e06dad8512ac082f00a50f58af", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342234, "uuid": "22ba6200-81ca-4a97-991f-55e2f1426b05", "comment": "Malware payload (Grandoreiro)", "value": "117ccd9ba2c4ef22fe9f69180fc4958c43f4d3b6", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342234, "uuid": "a02e9f55-1ce9-4748-8984-f5950f9b3a34", "comment": "Malware payload (Grandoreiro)", "value": "fb06e9e684bd3cae838bb2c18fe98551366427ec75a2b14743e4dfbade7fd8070774b5a1acc3566ecd147527a6517a89", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342234, "uuid": "6341ac19-d42d-4894-aa54-b6b6b0e426ca", "value": "T106462330FB911C6EC6600771B03D3A355FBEB623468E92DA38ED91572342EC9D63B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342234, "uuid": "165c62ad-682f-411b-aafb-76ee11596b21", "value": "49152:gRhMDiMwt68Q8JDLP1RHgrxhg7qkQsOiqnEXagoJvj0Wkb/oLIfYRfwhhRJrOzMN:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342234, "uuid": "e3d537f2-52a7-4c66-b248-d2b631fef343", "value": 5718016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342234, "uuid": "dfff43ba-2cbd-4a5b-9978-6823c2887bf4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342234, "uuid": "bf15c904-b3da-4f06-a4b7-4da77b75553e", "value": "7323Y2XI12_Gst-IonTYFC.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6887a3e3-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312516, "uuid": "1e9dd15d-b75b-4dbf-860b-88fb3232df32", "comment": "Malware payload", "value": "9b234762b949408fa5cedf98ce95fd51", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312516, "uuid": "d11e5753-f5da-4850-a9a8-dfd60a6320d3", "comment": "Malware payload", "value": "a795df2048f9421a97942b4af31ad360a40f53e838223cefd7e05294bbf4683e", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312516, "uuid": "170cef6f-1cb0-4598-ac2b-6676ab66624e", "comment": "Malware payload", "value": "7d5a075c330a3a081b8e0ef79284e22ec6700b63", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312516, "uuid": "b3ef7b4f-c2f2-4db6-a5f5-0f907b52ec72", "comment": "Malware payload", "value": "7433701ee7d2153345be4288b05feb1b0e0f8dcaf6f86773b7c6ab0d369293a7621ffd6355aee6cd4a5df6369af9b4b9", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312516, "uuid": "10cca9ca-f785-4e2d-9c3e-b7d264112427", "value": "T1FFD422B348EA3E3DD95C01F35443B5F2F62A0E09587E38A626434BDC9E9194E12991FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312516, "uuid": "b56fe2d2-6bae-41b5-81b9-53968fcbad34", "value": "12288:eQktl/NXlQBkUK1DvgdpSC+fb6JnAAkODCAEnXP+Gb0w8l2JdMHxXxHnZmJb:enx6k71D4nSCbCAWXt0t2JdMHLHZGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312516, "uuid": "7f4dd59d-2cca-4e9b-92b7-44719ed96fbd", "value": 651305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312516, "uuid": "d489f442-0531-41ce-b726-a1d99f8d23b9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312516, "uuid": "7045b4ee-7dbd-44f4-92ac-cc2671cf98ca", "value": "LOI_Purchase_Intent.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a046cf0c-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343962, "uuid": "c6cd3dd0-40b7-4767-8006-65e0212b20e0", "comment": "Malware payload (Grandoreiro)", "value": "ed411bb3490d6f0b717057244f27d685", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343962, "uuid": "c9f5e1f3-3fc0-4c0e-800a-695439033b94", "comment": "Malware payload (Grandoreiro)", "value": "a7cfbb2ef8031ba6d42653fa70b081e7ead5856922acea670bdc32cda977d3f1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343962, "uuid": "27f29e9a-20e2-4cb5-9d2f-5db736a4c9f5", "comment": "Malware payload (Grandoreiro)", "value": "a28a3af4fc05a29920be6eafff17791ab3a4e993", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343962, "uuid": "33fb2fef-b4be-4935-9f50-0299cc24ac39", "comment": "Malware payload (Grandoreiro)", "value": "6aceb3295cc8aa78124ed006b538d16fa3046c7e21c8d1e0c48d74618bc5e2d9705790cd3608e53ad92f70cad4a76ed3", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343962, "uuid": "ce452c1d-a123-437a-8c8e-e052a064f21e", "value": "T1F36623339E54091ACAD48339B06F2E295E2CB547868CD5D774DCA7D237CFE904A2B0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343962, "uuid": "5ddcb245-4b3f-4062-91e5-f9c3298814c0", "value": "49152:mbHam8p97jjgnevZR66bYK8KtswSoVSGW/wyqXqZakVkBR9neuRqwMkbWc3Hc2Q3:nbqc1tU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343962, "uuid": "cf76dc8e-738a-4f66-ad52-bc96af30266c", "value": 6854656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343962, "uuid": "128f904f-e374-4504-95fa-6d66fdd1bd6e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343962, "uuid": "6b13a0d6-6156-49fd-afcc-7b9d29ac6a22", "value": "Oblg59KDE_27040FCSDIF-K9U04.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db06c4b-0c1e-11f1-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1771346105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346105, "uuid": "58d7305f-f9c7-4419-a15b-594ebef05b98", "comment": "Malware payload (Loki)", "value": "53b2328b32cb8fe005e78e33fcd6b2a0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346105, "uuid": "ae5ba90d-3de6-4659-bcce-5dab6697108b", "comment": "Malware payload (Loki)", "value": "a80c12e9918e846ee99c8aed69c882e7a2587712300519099b538e73adf74e1a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346105, "uuid": "c6da9f28-1915-4d88-8950-0e636726eda7", "comment": "Malware payload (Loki)", "value": "e220e729bce3584653163a806f086c82c842ced6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346105, "uuid": "c6bb9e04-ad36-46c3-87ac-c00ceb55dcdc", "comment": "Malware payload (Loki)", "value": "c3ea7a30da47c904ff444bdd3d8166cedab53c7e0bb55a7eabd8800d70b0c976f8853a07e410b6faeb642e14eaf6cab6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346105, "uuid": "327575fd-df09-4ecc-8cbd-7be455b01742", "value": "T13CD42351ED489C900268936621EE5569EEA00B4F6D0A74087F8D58CDAF1F3CF89B2DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346105, "uuid": "8d04286f-1c35-487a-8048-e3cb0c07d16c", "value": "12288:yLiScHZ6QZTRWRrVqG/co43sh5kXws30PN9tPr5ZpfquPCzOjgqC:yOSNQkVHUP3GUHGpBb6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771346105, "uuid": "0c3068f3-b186-4b22-b02e-2385ba92c30d", "value": 615545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771346105, "uuid": "7bcc9e3e-fec7-4bcb-91ac-c440e66090b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346105, "uuid": "5608453c-6098-4b0c-aa33-8529b7feb2aa", "value": "lokii.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd242813-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1771312684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312684, "uuid": "975f75dc-7fc0-4324-86c1-aa7875694651", "comment": "Malware payload (DarkCloud)", "value": "1de7ccac7b4a46a06327d97c578fcab1", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312684, "uuid": "4f647c9f-20b6-4c56-9be2-fc223651ef22", "comment": "Malware payload (DarkCloud)", "value": "a9070022b1d28df7c94f12f8c025366cab612baba8c6424257d8feb805b0d182", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312684, "uuid": "8dabc3f4-a468-4fff-9fb8-f6d7b83393d3", "comment": "Malware payload (DarkCloud)", "value": "fb118e7fcc73445378bc7a46d81e9d8cbadac09e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312684, "uuid": "961263d6-a545-4367-a643-da52aa283b55", "comment": "Malware payload (DarkCloud)", "value": "a89869ae6030228e1dcd91e15792cf999b89e0d5e5a3095b1fde2cd65c9eea5a97f530cb06c8bb65b488f6770823d8b6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312684, "uuid": "edb68644-ab7c-4d9b-8e1e-bd71c6077d02", "value": "T17455F11A5DC326A8D6944F74D37D54E823F0DA5B5185E3BB6FEC02F4CEA370AE902462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312684, "uuid": "c1caa39b-e5c4-4021-b9c2-fe2d191762c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312684, "uuid": "e6bf0c1a-64b9-4d50-9f25-1781478dd1f9", "value": "24576:t7k3gSFJynPgKzfjEXfmRyl/OZbBkfK1vxh/AQp1KObTnzJ:t7EhOPgufjEXf8BkfKLdAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312684, "uuid": "9ee7c4a7-7041-49ad-b5c5-90d4b56be861", "value": 1370624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312684, "uuid": "c627ae5c-2d43-48fc-988a-9dd29f58b94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312684, "uuid": "32f683ce-2658-4dbf-93d5-2f8364483c91", "value": "cccca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70067ba-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771344000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344000, "uuid": "6b8aa36b-e819-462e-8246-23266f26097d", "comment": "Malware payload (Grandoreiro)", "value": "96d41562d8099f2830742f7ae4b82a5b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344000, "uuid": "473d8968-c7ab-4215-bd4e-10754abcd3ab", "comment": "Malware payload (Grandoreiro)", "value": "aa060c322c0a11b8fe4f55db36caeb86ab6148ff6ad716db5077532a9d298fe2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344000, "uuid": "7d824827-869e-4a83-abdf-da975a2e2035", "comment": "Malware payload (Grandoreiro)", "value": "ab21235ae6d45473c8425973f374938170c42440", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771344000, "uuid": "e1ad2334-99ab-429c-815b-7f0361d9e365", "comment": "Malware payload (Grandoreiro)", "value": "3c647570d6b9532280f358152f6efd36be37e1de173093ba099428ebe6eda3462540781968604b3ab4efc285a429a67e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344000, "uuid": "3cc054f4-16e2-4d0b-843c-ce3e8013bc8a", "value": "T14F462331BE516B77C6908331762F6E396E3E220349C9D5C165EDC18B3785AC6CA3EC62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344000, "uuid": "c42e2eaa-104f-457a-aa85-32a6963b0603", "value": "49152:wZJ2taI4G7EEaRJvlXfqrmUoTwZXrKun2Cdf7wFF3lw2Gdgr:+Ggr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771344000, "uuid": "10be01c3-3a45-4818-b945-12fbab3b3c4f", "value": 5586944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771344000, "uuid": "9e69089b-1cae-4f00-8593-5f2aa4178019", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771344000, "uuid": "f6af5e33-9aa2-4da1-840e-869b1f777f83", "value": "PlnlYRYC_32571U5F3ENGKMA348371.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7342dd25-0bcb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771310386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310386, "uuid": "58e690ee-533f-466b-be8a-245edcb5f2e0", "comment": "Malware payload", "value": "a78e13cdbec3b122debf30f9e1b4c569", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310386, "uuid": "52c071b8-55ad-4949-b490-b5e1ae366df8", "comment": "Malware payload", "value": "aa55c80895a1f590ffb324243143de6acb1074eaa6b68bf3563a6b6f5e2a18db", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310386, "uuid": "ca8f5335-a2ef-4a8a-af46-49572ca225a0", "comment": "Malware payload", "value": "d888477d584092381579a8bef15b9e280d7625cc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310386, "uuid": "6913d74a-d4a0-4f14-9dc9-de4a69562436", "comment": "Malware payload", "value": "dd275f93c75fcab22fd5daf10d6b567b38333e6fa5ce1d1cbb2506a4d1f2423b0956a2b5fe7e9eb092753ab0dc81dd87", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310386, "uuid": "79ceafc0-cb32-4dc7-bb37-4fff835afb9e", "value": "T1711733613AC5C532D3DA03768DA6E2513B667D700B30E1CFB3587D299A31AE3B879316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310386, "uuid": "ed7bb756-0072-47cb-b7e4-367afc10d666", "value": "393216:fqSa8t/Rww3hN4u1pVDy+PcLHll9OXhVhc++YW1fImCutH/QZhEVAxlHJ:fqS1t6w3hKeFixWhjp+YqfImXHIvnDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310386, "uuid": "fbe617c2-6d48-4dcb-a1a2-4d4580a25b19", "value": 19996672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310386, "uuid": "0050e115-c649-4876-b27b-52ba76ab4f75", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310386, "uuid": "568c4181-94a7-4349-8ea4-4ce96c321e88", "value": "aa55c80895a1f590ffb324243143de6acb1074eaa6b68bf3563a6b6f5e2a18db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a14a04-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352648, "uuid": "21147b16-4e2c-4970-bba6-26a43f2ebbbc", "comment": "Malware payload", "value": "cdd370fa3810da9ca936191f5b08be84", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352648, "uuid": "8c77663a-b40d-4edd-b799-f21325712fb3", "comment": "Malware payload", "value": "aa678b3c39a5b7d62ab244624cab44c819b025b81716c94684e7b0a21fb5142a", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352648, "uuid": "893867b5-66ee-4b64-a7d0-f2d52a1e645e", "comment": "Malware payload", "value": "7915549de7f562440d6762e334f7f2f4d464a605", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352648, "uuid": "4efa36c0-f65e-4f2b-aa69-a63244da0b46", "comment": "Malware payload", "value": "a8196631939144002fc3f7b9097dfe22dfa6b9c9200782eeba5a0f6d2f083616e8efef0199ace78ec30a2ef8e86eb36c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352648, "uuid": "b02b76fa-d825-4458-b65a-969b1b89cc4c", "value": "T1AE262331AA514D1BC9204379B11F66367F3DB323008899E27CEDD14A278BED9962F8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352648, "uuid": "f8548d3a-1767-4148-ad7c-7afec7079433", "value": "49152:5dalah/4ydSX+29wJXB0bh17Xc61Ug+Ya9vFA1sHcjrcHTNXfqUlMFI9mVaQEcGR:MMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352648, "uuid": "a646663f-d150-431c-866e-3e4ac5ea737b", "value": 4741120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352648, "uuid": "a04cdcf4-1ba7-4837-b0c1-952afe028fbe", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352648, "uuid": "ea8e8c80-38e6-46aa-a1c6-1507c0f0a45c", "value": "TrmY1TOC-5430FZYDBXOV71_Expe.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e44532-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342286, "uuid": "ae31c41e-5baf-4a3c-a7ff-a76fd8668e3e", "comment": "Malware payload", "value": "6f84592e00ee3c67e662992f02dd3683", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342286, "uuid": "86bf0ccc-57ee-4e4b-8ffb-0a9766cb3691", "comment": "Malware payload", "value": "aa943c02f06f0fa004355fb82a9e2a06342e5a77e3383125dcf2abfef7f04c31", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342286, "uuid": "5c73a051-8916-440a-a995-391ce3a1593d", "comment": "Malware payload", "value": "59d35aa1eddd77da3d1bd6550edf10afdd85cf31", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342286, "uuid": "7875404a-b06d-4502-9d11-2c841000a232", "comment": "Malware payload", "value": "543dc7d0439aeb765cdcb0b8f7498204e1411ef04292bad28ed40c18fb561efa75fa96a703867f2748553c8979a38d72", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342286, "uuid": "28be91e6-3f95-4894-82af-79eb8373c481", "value": "T11616338CF1CB7B6211BBA72D53047494211F496C97FA2F6CB5E94DA842CCE8C4A9CCB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342286, "uuid": "55702696-717e-46b5-8661-474cd1830c5d", "value": "98304:uMoS+5T7WzrMmdJbKacCQCNNY4Zw5JVVarEADM82+:uMxOWzrMiRR1N3w5JVVaJop+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342286, "uuid": "b169bb7b-0625-4b24-8cee-689c07278539", "value": 4148909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342286, "uuid": "c90c932c-42e1-48ae-860f-2722f8a809e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342286, "uuid": "b4b76d1c-ac8d-43f9-b3f1-4d0f29b27940", "value": "MDE_File_Sample_f9eeec54d199f3929309c113730286eb4cbf1527.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12baf0f0-0c1c-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771345013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345013, "uuid": "87a9d531-703c-41e0-9906-fa1cfa2c3dd3", "comment": "Malware payload", "value": "e270a95db778e862511d8aca7d5770db", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345013, "uuid": "a94c871f-590c-4c90-b0f8-1d663a8a87a7", "comment": "Malware payload", "value": "aaab84e2cf17ee57fde1ced3f82b45bb9583ea8079957d28ec1a10501d8e4927", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345013, "uuid": "d17773ff-143b-46a4-96fd-99619893be89", "comment": "Malware payload", "value": "11c21fbb82bb3c5055e17d5f9de1f06fc2b47265", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771345013, "uuid": "8e0cd8ce-73f7-48fa-bf48-03a01417368e", "comment": "Malware payload", "value": "13417ddc4e07ba7005a66f554409119c67410064a6c8c1c21190a38dff096cc3bd9259297398fe22348ae8f0daafe15f", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345013, "uuid": "39cdee4a-153f-4b7e-b076-4ae9051b890a", "value": "T186F63394A3E448E9E967683E4D619012F3F1F8210791DACF07D44B6B2F6B6E99D3D320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345013, "uuid": "d3d63666-ce17-4d55-834e-6e0f5734b738", "value": "83bb95991fa411f18103e54ee95f06ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345013, "uuid": "4730f43f-bb47-4fb3-bc54-d46850f99a83", "value": "393216:TVuEmNGYN1bPsZg2KeiCxK4BHsFhktlapPLbYYYH4a7o:xS/N1ILX3JtUpTbLYH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771345013, "uuid": "15c4a7d5-3505-46fd-af28-332fd6d8dfff", "value": 15660544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771345013, "uuid": "2ba4655c-eeb7-4c58-96d3-ab8d1cdb6514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771345013, "uuid": "1baa4918-46a9-45f2-96c4-f9d7b611f3d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434828d1-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342088, "uuid": "2a524ae2-56c7-4f6c-a3df-3248be9586d7", "comment": "Malware payload (Grandoreiro)", "value": "7f9c625e51b55fa0d238994fdbc1d3e9", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342088, "uuid": "ce8cdf48-04a0-4d59-aa3e-fa50b04a063f", "comment": "Malware payload (Grandoreiro)", "value": "ab186abdb2834e017b75bbc12154e995d1c83ef113a05bac0b5fb5c762d37535", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342088, "uuid": "a9645a8c-43d3-4d90-b871-c331e13dfe09", "comment": "Malware payload (Grandoreiro)", "value": "76478674f584c24d11ef8218e8cb243a0d28c4b1", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342088, "uuid": "e0bbd5d2-c81d-442d-ab9e-4f9d271c4a3b", "comment": "Malware payload (Grandoreiro)", "value": "84dcd9ac3e771293ad9f5842bdaef42e126c778aa24efaaadc81f3673e1f7de2304526da2aec097c323ec3d28be4eae6", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342088, "uuid": "b51cb455-d571-457e-a220-54d657e51bd9", "value": "T1956633319D05682FC9908375B03F3A363F3DB75796C892D738AC8682278AED5972F494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342088, "uuid": "54514100-25fb-40de-8b3c-e4517b8146d3", "value": "49152:U1s+JFTWkaWB6AtufoDhT5RCdPy3FxCvX92Jx90esSJ4AozWURzwlpEyen5hU0Ev:/S8AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342088, "uuid": "b3c7c8e1-2ca4-483c-ad4d-39ebd42949ed", "value": 6848512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342088, "uuid": "8f4f12eb-65df-4348-b5f6-39f04fc06b9d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342088, "uuid": "9a5cb0e8-ab82-4619-b5fb-e49f2b930570", "value": "1X0Q6671_Dsp-AchDSEMC.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54104cb-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343246, "uuid": "b48355b5-1d6d-4623-9a3a-dc53253e448a", "comment": "Malware payload (Grandoreiro)", "value": "ac8a7bb1d9d2cb14cb2c5e389c35de20", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343246, "uuid": "ccc5c600-6994-429c-87af-94990b9cbab0", "comment": "Malware payload (Grandoreiro)", "value": "ab4cf8e71e3ad30e8c03d79014c0948ac7030cfc85a41ec742b9cf32273d04d3", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343246, "uuid": "303c626d-7faa-48a1-b2e4-8504bc76960b", "comment": "Malware payload (Grandoreiro)", "value": "416d722bb216aea6e062604870a63e4f8bd904d3", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343246, "uuid": "215b3c23-f89e-4f67-b4d3-8eadf358e6a4", "comment": "Malware payload (Grandoreiro)", "value": "2a16ca32fff089506d51b6ef3c22bf6aaecde57e04c3d7ef1142cbe81f9d7d41051aef0a4eec69b790807f5d2af22dc7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343246, "uuid": "fde7b2d1-ff0f-4cc2-bc94-c98e00318159", "value": "T1892623336E640927C6A04375B0AF6F1A6F7D721B5A8CA1D378DC9182378BED5843B0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343246, "uuid": "b6c97c86-20e1-4f71-9c5c-5af0bea769f0", "value": "49152:5oViqyRR7ht4bdSZCvBCURObTvPsaQVFzsFjCXzT55nTZq3qE:SG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343246, "uuid": "9cc3fec0-2a7d-48ed-ba43-22a067cc9d4c", "value": 4614144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343246, "uuid": "66ac51bf-448a-4f00-8e75-65f05181c92c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343246, "uuid": "c0655fa6-0f18-46f9-bd83-0e415f4bc101", "value": "HbrHE8J2801_UZLXEHssliv-NotaY73F47.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b875b3-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351761, "uuid": "919fbe9f-f162-4ff5-8776-afb1829699f3", "comment": "Malware payload (Mirai)", "value": "ed659d117e5de08e47ec1e022eec0a9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351761, "uuid": "5f3c18e7-f0d8-4b2e-a93f-5f17f397c027", "comment": "Malware payload (Mirai)", "value": "ab7acb76fd2b671434466fcea14aaac9fabb50b4370556ae234552f131ddb127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351761, "uuid": "0378a424-557b-4f4c-b02e-6f821a234726", "comment": "Malware payload (Mirai)", "value": "f5284ad28d6b6061fcc0bd1b00ff09a2d59ae993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351761, "uuid": "de822e8c-57d8-449b-a8d6-fa9466bff66c", "comment": "Malware payload (Mirai)", "value": "7141c38819ada56aaa518db7472157e7183a93476535c76acbbf0e65bd8567691cb12b38c5d874a79ffdddb0b6cac78d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351761, "uuid": "274b22ca-4464-41d7-9535-4d83b13bb971", "value": "T1BD331A91B8829A12C5D4537BFA6E41CC331563A8D1EF32079D266F507BCA82F0EBB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351761, "uuid": "becc57bc-6f68-46c8-8f36-091f4579c526", "value": "768:w7Mc+v+wcWDEKmxmmEBa4OmdiC8saEbwzRgBCEVeHmYMvYPfjA/hcl3D8NRRZPNJ:lcBnWDFx8sHeHbMIfU5tGlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351761, "uuid": "b613cc82-977f-4c52-9e4f-baaa60206dfc", "value": 50316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351761, "uuid": "0c8cae2e-4647-41ed-9ead-cf4fbe3f071b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351761, "uuid": "f4df43cc-3ba5-4ec5-b6a4-0f199c949e4c", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a370053b-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343109, "uuid": "34df226c-95bb-4eea-b7a3-8ae4c029391a", "comment": "Malware payload (Grandoreiro)", "value": "0548784d1d718dec3f93860df9b02ea5", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343109, "uuid": "3b930c0a-57fc-4fa0-9c01-b8be794c5ee5", "comment": "Malware payload (Grandoreiro)", "value": "aba31a7579f05eaebceba5956a5d7f1634060e288a19d224d0ae6ea8b8480b10", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343109, "uuid": "896b3869-4ef1-4144-9d8b-609375ebbd7f", "comment": "Malware payload (Grandoreiro)", "value": "45d1fc3b5050fb35df9721802ea6cc843a185d11", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343109, "uuid": "e4592646-2077-451c-8381-f2e72b2ec95a", "comment": "Malware payload (Grandoreiro)", "value": "425016075f39507f2e19767a7a910e5fc862d8536d408dc91a9f4922d1ad52233cc740286cbab01b8358468ac5323713", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343109, "uuid": "733ecd09-16e6-430e-91e3-b91f0870c827", "value": "T113662332FE851C27CAA0C376762F2B341F7E6807444CB9D564DCC29B7B46AD2462EC5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343109, "uuid": "613a9477-87c7-49db-bb84-d7e3772dd8e9", "value": "49152:duhV2by2e81ZtONo/6KeMhiAzLG7GBwYUhoDDNRFgtZjVu599F2u3W7IMZbVkL+d:al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343109, "uuid": "1b49ba16-e490-46ce-b9f2-f6fde4cc72aa", "value": 6774784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343109, "uuid": "2e48a8c0-cee4-466b-abdf-3896676c6a92", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343109, "uuid": "4ffa3e69-c3c6-4215-b15a-2d2cec988e0f", "value": "Bal-An0A2VDSHXCOY30097_7464CX.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc8d202-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312716, "uuid": "366a8670-4747-49ab-b9dd-3be9ee3fe231", "comment": "Malware payload", "value": "09304d0746da42935b7a0e62d2044dbc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312716, "uuid": "a3a37081-5c6e-4c9c-9868-f403d8b3350e", "comment": "Malware payload", "value": "abb155bea94f0aab06d9fdba99bf2fd48a19b482e97ba3fe9134d3f80b89508e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312716, "uuid": "6302c3b1-ae29-47fc-a564-b119c5d92fc2", "comment": "Malware payload", "value": "51e424abaefaf73e5279cf4e5372fbc75a2b20c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312716, "uuid": "49c033d8-c7ad-4fe8-95f4-17989f44d089", "comment": "Malware payload", "value": "fde647e20d47b4a7947cabe6fbedc2a56d08ca8b861536ca18c33b7c9d7fd0b8b5d1d3d0f48f588bd71349f2212226eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312716, "uuid": "ce937a25-b0f7-4678-9cac-7b068dd3aab8", "value": "T17F45FD99218BDA8C907ECC41A159612FC4173EA23F65AA8A8CC3D2CFF5335954F1B43B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312716, "uuid": "6606aa89-9952-4897-83c6-b890f448db03", "value": "192:cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAk:ki0veR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312716, "uuid": "85b47421-ee44-48be-8094-1235b84bc8ad", "value": 1180491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312716, "uuid": "d29271f2-44b7-4a5a-8cce-1719277f8d84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312716, "uuid": "0648a1ad-8291-4f65-a197-f5361e255ce9", "value": "09304d0746da42935b7a0e62d2044dbc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b455c32a-0c0a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771337553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337553, "uuid": "0d7260fa-8bce-4aa1-af5a-452decf85f77", "comment": "Malware payload (Mirai)", "value": "5f201b6f7b2ce284a12392b2ce622564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337553, "uuid": "6890c778-9fa7-4ca2-841e-7a78a7ba0ee1", "comment": "Malware payload (Mirai)", "value": "ac1bef4989f8e43c61c823ffde0f6ff2af3733e873d8186d66f4d29e8b2cea92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337553, "uuid": "07b3f37d-6dab-4058-93f8-cca5255eb0f1", "comment": "Malware payload (Mirai)", "value": "009b46918a6531010a73a3e3234b3f4a08b8a1ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337553, "uuid": "110ffef0-aa02-4e8c-8911-5f5c0b59b21b", "comment": "Malware payload (Mirai)", "value": "dc3ac76966f0e635e9e910a08f53d2ebb60e608d7c1d8983f2cac96b03dd7c09dc9e259a7128599a0b734a1e678e1aaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337553, "uuid": "263b4c4a-4f6c-4016-8690-f008e4f107c0", "value": "T190230233CD2B99A3DC247DF0EC58C77160925F2AA0B9F5B23ACE47187B9551406F8483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337553, "uuid": "fa4ba3aa-4216-43ea-b329-214514e71413", "value": "768:G0WIEREyxCD9DvDNXQtFawDe3+9q3UELzod58P2x+lv:BWjR6Dd7Nai3jLzod54QKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771337553, "uuid": "4ae02eec-2736-4495-b237-13f3a6a08491", "value": 49196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771337553, "uuid": "ec442263-10cf-4bb7-9180-ac7d6a361277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337553, "uuid": "edbc6371-ac67-42d1-87ad-d884703811b0", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de8e31a-0c43-11f1-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1771361809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361809, "uuid": "c78b091a-dafb-463b-abc7-65fe86e77177", "comment": "Malware payload (GoToResolve)", "value": "77ece0ecfa33976dfb172cc05b1175ae", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361809, "uuid": "7b8debc9-76b1-486d-b157-14c1d9dbc69f", "comment": "Malware payload (GoToResolve)", "value": "ac30dc171ab52be869dd3674e674350b5fcd1b79f3cb9b0d8388d63edc1ed018", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361809, "uuid": "c916d65b-c7d0-46d9-a80c-9bd4916428c6", "comment": "Malware payload (GoToResolve)", "value": "3000cf4ad32abb5242ed300a9366a683ab6fdd43", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361809, "uuid": "f30b5368-70a5-436e-9945-bb82be4e43d7", "comment": "Malware payload (GoToResolve)", "value": "4d843a4bf511b9d80e473a5cb25e8d3a24f67919a1315539d34d443763741bfd31eec8527653eb3c074579c035e47c08", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361809, "uuid": "f8e353ae-5a55-4666-a63a-71bc118d22dd", "value": "T1BA3733207649C171F53E10B289286BBF427D6D320F6580DBB3DCFE9A5B312C16B36A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361809, "uuid": "eba0c395-43e9-4035-bc2d-65257979f754", "value": "393216:ru0G/h3+M0v1UuQHRTRGH6JHfTF7UY+/kqFj4eFSmJlVvKneUdPlZQnl2H7gOnhI:S0GF+Mm1UuQ3H/T1uThFJll+eUdEnwHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771361809, "uuid": "064261b7-86fb-4455-88b5-a14283dc067d", "value": 24530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771361809, "uuid": "d07f0c20-5595-4759-84c2-3080cfab245f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361809, "uuid": "40f221a9-d89e-4add-80c4-16f4d96e9fda", "value": "Rsvp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8651b8ec-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341771, "uuid": "7ed4d23d-5134-4ef4-b7cd-5840a339c6f4", "comment": "Malware payload (Grandoreiro)", "value": "d5e54df368f98f4a57474f820ddf5127", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341771, "uuid": "d479fb5d-3989-4503-856d-2602a10e0c02", "comment": "Malware payload (Grandoreiro)", "value": "ac507c0b5c72774bc17d296bff9bd604e85a4161082d27c14fbe68186591342d", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341771, "uuid": "efbc48fd-581a-4343-98e5-7bc8c2fa25e5", "comment": "Malware payload (Grandoreiro)", "value": "fd1bea8cc1d66bbcf1bf6a70e1c8dbd09a13ddc1", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341771, "uuid": "984be36a-d039-4ea0-82fd-4dd5d5e7491e", "comment": "Malware payload (Grandoreiro)", "value": "7ead87c1cece2b92709ec96fd9b339f1057a9d7ae10fff19c6c731d0431df1c81d0d116a093d2bc9aba3d88b11360827", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341771, "uuid": "90820e49-8d7c-4461-931b-d3465527842f", "value": "T114663333BA165877C6504371712FAF666E3C3B074588AAD365AC40837B4FEC6893F4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341771, "uuid": "721e58ab-d773-4a40-9504-f5b7c8763eee", "value": "49152:WHbsCKAaYPewlXW/VvcEQ5uUBeK7Cz0POjrFmmoCmg2JGRtyxyGqu+NwQt43Zmhf:tmuim3Y69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341771, "uuid": "bf86ac9e-1042-48ec-a5f1-0c09344f20bc", "value": 6545408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341771, "uuid": "9c560446-d777-4dc5-b2d7-9be2f32e6904", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341771, "uuid": "95fe28ca-0c67-48e7-bb02-0b9976ab045f", "value": "Jrnl78617YDELX-FBA5VI9995.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32a2b1c-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348396, "uuid": "8227da3a-f478-46f3-953d-50dd0e47d8de", "comment": "Malware payload (Mirai)", "value": "d5a46ca0448a98da9020870aa3a61602", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348396, "uuid": "759d3329-c12b-4889-814c-06183e559b0a", "comment": "Malware payload (Mirai)", "value": "ac6f9327d6e97815e6dbe493d6b23d6d6d4a776fd21426871b7e5a8effbb6a30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348396, "uuid": "9938aff6-cd89-4f2e-a17d-6b9d8faf9a5b", "comment": "Malware payload (Mirai)", "value": "dd472b5f42daf093860467b0485e63bfe4ba7f19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348396, "uuid": "3ce7f78c-23b6-4d37-a251-75631ffef8d0", "comment": "Malware payload (Mirai)", "value": "53796b422c20d114400696cfa1c9f0e3456283c13dea806ea49bf3192c00afc128a3c074389a809d2b29ff97e5547129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348396, "uuid": "0b8e5372-41a5-40e4-b495-7cd9f88253fd", "value": "T1D825AE11BBF2052AE280933586A2D750B613DB9668D5030BCF618EEBEF571750F85CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348396, "uuid": "42e2321a-3233-4bac-9745-e54ad02e5bbc", "value": "12288:eAu75hPWGAOxh86/Yu+AAqq8DPy6KNrraYn30wUQAbdHw5nZ95Z6:eFFhOhOj/xpqSdKN53H8Jgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348396, "uuid": "811de892-13cc-4283-a7ac-54b93106b13c", "value": 1057224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348396, "uuid": "fdc144aa-f092-4abd-8848-8518d5f75afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348396, "uuid": "2c3113f2-b638-4587-8a35-7e3cf7df4733", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d5070d-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342057, "uuid": "7ba60798-32ed-44f1-88bd-a254673bca21", "comment": "Malware payload (Grandoreiro)", "value": "e57eda74b8a62ee09e7e300e1b313538", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342057, "uuid": "4c1078d9-8099-45c1-84da-03414f5804e0", "comment": "Malware payload (Grandoreiro)", "value": "ac801d454d91b3e3cf5309f1f24555f2e65af749a20e00e4d948b43170b03dac", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342057, "uuid": "17a7521c-0d1a-42c7-b238-9fc3e140bf0b", "comment": "Malware payload (Grandoreiro)", "value": "06dc1a15bacb0243c7da89fa5eeecea7f70ad80b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342057, "uuid": "5d2696c1-4372-46ad-a3a5-42ae7f744bc0", "comment": "Malware payload (Grandoreiro)", "value": "ab69fc29a1d8bf8ab498acdff7faa57d08becf1ea45f6fbb4d2f95e44f3ff071bb244baf948faa45a517fbae5dd32981", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342057, "uuid": "4d0a66d7-c4c0-4031-bf26-7e184bbbbfb3", "value": "T194863335FF526C66C5D84374713F2F1A0E7D1A8B424AE8D3D1DCA0877B86BC4892E46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342057, "uuid": "961c9dd9-86b3-434d-9502-6977cff77a1c", "value": "49152:zrKHs1uajFSaIbcA6oKs/DeuGgpqWSCu/WDOfRRhkGfJIhPr+oTXsVDYRyqeB06w:auim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342057, "uuid": "d7ec10c0-a54a-4e66-87b8-8ffd36dbcd1a", "value": 8208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342057, "uuid": "9c5aa9b6-34cf-4ba9-827d-f6a5416fdc68", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342057, "uuid": "6a88694f-3b9a-4c6c-b148-ef9ff560af31", "value": "0SldFL66CJLXM-8290YU3G3LLYYfuddf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc78296-0bf7-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771329140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329140, "uuid": "774b8187-689b-4c67-8add-dec7b20c7c2f", "comment": "Malware payload (DarkTortilla)", "value": "2c0bff470f43d2778f97f9b0138bf4d1", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329140, "uuid": "60a38e9b-8e8a-4980-bc67-0ccd848a02fb", "comment": "Malware payload (DarkTortilla)", "value": "ad755061eb3d0b36beef54bc683afe0303fd44e4ce1ed6b198cc367c5b83594a", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329140, "uuid": "a3a4f3b9-fc7a-4f53-aaf2-41b5af9e353d", "comment": "Malware payload (DarkTortilla)", "value": "e2e301d2462af2051c2c46927687acefe606f847", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329140, "uuid": "be470eeb-833a-4dc3-8eef-47be62d15969", "comment": "Malware payload (DarkTortilla)", "value": "e72475751c33eadb7080741d15f475f3d326bda272a9507d2cb24e62303b53dfe0a452a4cd15c4dccd16bdd4c6ffadf2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329140, "uuid": "ed4ca30e-2924-4d0f-ac17-9f81865adbf7", "value": "T132E4F1325E462A28DA391FB9C062149977F0C843525AEB2B6FFC04F86DB3F49CC27565", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329140, "uuid": "47ce07ce-6042-46d4-af42-d842bb0ce8c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329140, "uuid": "8e1b9105-09a4-41f6-b11b-b9cbbd505a36", "value": "12288:FgYEt7TInGszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7YMfdfJblNB1:StPhpLT/4PPH7caoc7TJJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329140, "uuid": "fa7f1aad-8095-46bf-b6f8-a73d9d3b1562", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329140, "uuid": "31e89617-e665-4762-8e68-f45867850d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329140, "uuid": "48d8680a-2ff2-4eac-9325-1270c07bb278", "value": "Ordine ALZM SRL_DDT N.453471275 (72KB).pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7a7f9b-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351772, "uuid": "d66eec9d-ee74-4ddb-b16e-b044c798c20d", "comment": "Malware payload (Mirai)", "value": "4db8b889a3f524758a319fbae3644492", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351772, "uuid": "61195fb9-f3ae-4278-8829-fb3a55ff10f5", "comment": "Malware payload (Mirai)", "value": "adb0946bd82c094f7a8be77e82696a3bc996df809fbc51959b4f8ffdae6ee8c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351772, "uuid": "e0abb6bb-bc21-4cbc-9df9-24357dbbe4d2", "comment": "Malware payload (Mirai)", "value": "ca56b10af6e1bc4cd923e9fc4c422389411d79d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351772, "uuid": "d5ded927-7a11-47e8-917f-ebe868162e54", "comment": "Malware payload (Mirai)", "value": "a1ef27e0b7ff046d41660ab73bdd81ec616cb1636890680d7295e4a4f033d24af205fccc07a1121566b5c387fb582632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351772, "uuid": "84e50e95-5223-4c86-91fb-a8b7328f831a", "value": "T1FD336B31F93A2E17C0D4A47E12F74724B2F1675E25A8CA2E7D720E4EFF14A40A54B6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351772, "uuid": "d400f8cc-be1b-4cdf-81ba-e7b06d506bd5", "value": "768:t2oVxxtq9KqLPbMl/ekt1DYZYl6yaf4TojaibO+ypGvzYi:t26xxtSFPbMl/lt9Yqlps/yKki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351772, "uuid": "c2a8f003-1160-41e7-b76e-04fa6d92aa0b", "value": 52292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351772, "uuid": "7e522a7c-97aa-4179-822a-3b2de2dfb71b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351772, "uuid": "1adea932-bad5-4356-8c37-6fab5b3c2e03", "value": "hoho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3529877-0bca-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771310064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310064, "uuid": "7119b1fd-0c96-4218-a2ce-b8dfa76786b6", "comment": "Malware payload (Vidar)", "value": "1f06bd3a8b678a44b74a6820422311ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310064, "uuid": "edc9c238-432e-44ab-b942-d2548d94f34c", "comment": "Malware payload (Vidar)", "value": "add430100c7acda7a55499f05b3002734a48e5b4e54c5f877a4d7455b14ddc0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310064, "uuid": "b5c22046-3e02-4309-ab4d-71060ad284b4", "comment": "Malware payload (Vidar)", "value": "116570086ff178f1c9d94819353d841312f411ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310064, "uuid": "52a37722-7ee7-4bda-990b-df8abb14a846", "comment": "Malware payload (Vidar)", "value": "574b9db5a147f8117542a99b73448f4bbd0823be7aeceb905d11d9589a3540d6f4b4adae0da9c1d21cc06fb2080fe5e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310064, "uuid": "62b902e6-d458-43df-8dd2-c6b9f7b114f9", "value": "T123467BCB13EC13D4C0B1833D8A56E036A6267C5C03A656DA3ADD2E07BF25D964D3ABD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310064, "uuid": "122a2b24-48be-49c3-837d-3c2265f038c7", "value": "6579ae5878696902adaa4edfbc730c4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310064, "uuid": "8c726efe-10b5-42ae-932b-42e251c68274", "value": "98304:2sqplZAKmJlmzSzko2zjCf9b3v9efz2CI:TqNmmstgz2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310064, "uuid": "ba01da12-de67-4b50-bf59-25d0ed786202", "value": 5859264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310064, "uuid": "3f499d7e-afc7-4474-abb1-3c6744a11446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310064, "uuid": "57250ac7-4501-4fe4-be07-11e2a18c626d", "value": "xadd430100c7acda7a55499f05b3002734a48e5b4e54c5f877a4d7455b14ddc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3025dc8a-0c43-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771361813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361813, "uuid": "ec93a5f7-89e2-42c3-8961-6f4a53614c2f", "comment": "Malware payload", "value": "e08b3db7e48d461d5fec69994fa4c4a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361813, "uuid": "9a1b986e-be42-41c0-b952-527d02f52ed8", "comment": "Malware payload", "value": "af1508057263f66765b1bba3867e24a8fd4a309c90db9411551fb6ea4d92eb10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361813, "uuid": "164b8a9b-0541-45c6-8b9e-d9b126dd80b0", "comment": "Malware payload", "value": "1bb0297ec6d4906c1665e196258732582b290a5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361813, "uuid": "5d991f89-9227-4f30-86a1-68a7879c7058", "comment": "Malware payload", "value": "f0e6d3102a725756092e20f1e105a6e1315ed64efeb84f320fcb3a53372aa82a34f025417f4d5f732dafe1e14a5c34ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361813, "uuid": "4e58952e-bb03-40ac-b8ff-984ed79bffd1", "value": "T1EC3733307246C171E45121F25D28AFBBC2ADAE30977644CBB3D85E2A97711C27B32E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361813, "uuid": "6a112e4d-940d-4736-89b2-bce0c0e5255f", "value": "669c6ad64920732b55f250261305867b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361813, "uuid": "770374b2-1588-4d22-bf63-fdbd23fac8e0", "value": "393216:gcVpmNqw23XwNu0R5krJRnWIaeM6g+bxz3weVbOzwAlQ06k9/vjOhs+zh72XOytR:JViqwoXwNu3bNaz2uGawAKxk9/Wseh1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771361813, "uuid": "851a65d1-c36f-474b-bfab-8239f13a12de", "value": 24494600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771361813, "uuid": "c4d9ea10-809b-46c8-b51c-42d312c4cd6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361813, "uuid": "c39ef44e-291c-4097-afb2-941804c9d463", "value": "welcome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4f1da0-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351767, "uuid": "d2e22038-c133-4c61-a7d1-76aeb11608d9", "comment": "Malware payload (Mirai)", "value": "bb07a2fff4652282a9999cf79c39b918", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351767, "uuid": "6f5626fd-057e-48bc-90bf-163c47cff2c8", "comment": "Malware payload (Mirai)", "value": "afa3850e5442a07db817aeffd6fda345140be7ae54c038f5f268d6c88fd82110", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351767, "uuid": "e89d1c91-9d16-4c4a-ae61-d9d5fed046ab", "comment": "Malware payload (Mirai)", "value": "d4fef3abe0c395ce76e2cc46e92d67a26a7a6faa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351767, "uuid": "a0d1489a-04a9-4eae-b315-d1257ba0bff1", "comment": "Malware payload (Mirai)", "value": "373ad797a2a3d86d37f4860ddf84faadd63783d81efafa545628d499d8f458270109065eeccaa098c3cf53f35df1d6dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351767, "uuid": "bd4a06b8-9d08-4eb1-9fb9-b55cf1a72263", "value": "T11F13F796BC829A66C6E0237BFA5F418D3321A3E8D1DF3257CC112B057AC991F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351767, "uuid": "1165a737-52b3-4eb5-84ff-9c32a65121e4", "value": "768:XP7T28mUGj57T7lq1dZuhfHn41GC8saIDoCerCIcW138vYPDX/heg3OgGytZPNvI:XjHm55TZ0v8sUcWh8IDX50PyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351767, "uuid": "23e78f56-3265-42a3-8c3f-052e477dc1c0", "value": 42880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351767, "uuid": "e75686e3-dbd4-4565-938b-a621d2cf61d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351767, "uuid": "80aac478-bb41-496c-a24a-39ae88bedc14", "value": "hoho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab7d083-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353670, "uuid": "843f066e-7627-4aad-b7de-28c46ea54faf", "comment": "Malware payload", "value": "0c703f54e32864b36b00d40022c7624b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353670, "uuid": "ad974673-3928-4583-9433-880866421571", "comment": "Malware payload", "value": "afc205bbae4ba46ae6ec980593c840357c4b26b9222cc16cf881727cf21acc03", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353670, "uuid": "2409e1c9-1be7-4972-9205-abcd116fe09c", "comment": "Malware payload", "value": "6605744f0e5a2ed14a996db62345c3b2907ccabd", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353670, "uuid": "3938c173-b747-41b4-bdbb-83f37f51a0f6", "comment": "Malware payload", "value": "a6a7387e9df11b8b67884e212c0a0cae3ccd0a43459eac0b6565ffde552ab4867efca71d4772d0867d6e07e785f08d50", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353670, "uuid": "43a8bec7-8a6f-40ac-b406-a530ede7c019", "value": "T128762331AE50186FCA454375B03F3B125F3C76634748A4D379ACE146239EFD1DA3A8AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353670, "uuid": "ce9f9b39-9e5c-4d29-ab35-8214543203a4", "value": "49152:qOC3/Ys4K/kK319mI/xUzmtkditntr4OPEisk1Hz3TeXZ2vgyZ4jWScGCg9NhP0v:KQi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353670, "uuid": "a445dc22-dde5-4347-b02d-9647e14bdc10", "value": 7276544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353670, "uuid": "a31b363b-934d-49d6-9a70-e5a656e745ce", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353670, "uuid": "2a04461e-a6a3-4b62-a476-fb0ef85de4a8", "value": "RsptEONF874198Z7S.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9af4a7-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343206, "uuid": "7718aaa1-4e00-4fbb-b772-dde974a3a43b", "comment": "Malware payload (Grandoreiro)", "value": "4fa44a67839aa2edd20a9e6d9be56e61", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343206, "uuid": "88547411-ebfb-4be1-9d65-e50f85e48bd5", "comment": "Malware payload (Grandoreiro)", "value": "b0716668fc09c81b7651cc0e17a14e768c6fd2100defb2c2bd8adefe9de9f9cd", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343206, "uuid": "ff4cfe4d-1c9d-4905-be33-dc30cf84e872", "comment": "Malware payload (Grandoreiro)", "value": "fcf7d92e9cf28b07df8155c48669e2d022aa2921", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343206, "uuid": "92d395b7-5f23-4a0a-ba3f-776bfc68a609", "comment": "Malware payload (Grandoreiro)", "value": "94101c3c5aa38b0adf672459bf2bb93416a985a83c3e6e7e6a0777f6e457123e9a6ea8e3839f6f2daa11704f95dd15dc", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343206, "uuid": "8dc1155f-db83-469f-ae1e-e5838c00f8cc", "value": "T10A4623B2AE55482BC65442BB701E7A366F3DB523838CD4D3748CB1823796ED1D63B0E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343206, "uuid": "c2efbeb8-1437-464a-bb17-02e30652ba47", "value": "49152:Ha1UYjMKXUpYOZuuaCuiwF064qo6giCdZOuzQsZt6EOzl/lSi1WGIzaHMj:IHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343206, "uuid": "040a2cf0-8c72-4eca-98f3-80e1c8e47d23", "value": 5560320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343206, "uuid": "077578ac-bc9e-44d5-9d62-73d52daef7ba", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343206, "uuid": "39a04721-51c0-44bf-91c7-12b59e44bd70", "value": "FnzCTEIGA-1586351G64BFKSST.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767f3cea-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348187, "uuid": "9a5639dc-d2fe-4873-8849-8c8f646e0889", "comment": "Malware payload", "value": "881d1699b146803a1d17887193dd1c9d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348187, "uuid": "dd05ab5c-d094-45f4-ba7d-844f89fd8522", "comment": "Malware payload", "value": "b115b04b197b112eecf668fa549f65189e683cb87050708a72fcca268c9258e2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348187, "uuid": "dd046780-e987-4284-9b5b-78fbfeb335d1", "comment": "Malware payload", "value": "26f2e0bda5e0c547faced8c4e9eca3e00a33573d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348187, "uuid": "530bd5de-92d6-45f7-ae84-dc8a26f7db09", "comment": "Malware payload", "value": "8191951e1124a3a25cac439f43800bd0b99901cc92cb066f40cd50a56a79783be18106c4428937ff2b70930a6f95c25d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348187, "uuid": "938cef72-5a3e-4af9-9857-054e3950fc04", "value": "T14A16333C129D5CF2ECDA49BA52F9B26171329E12F7E396510F2DA29314CB2C5365EE30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348187, "uuid": "3f967a65-92b9-43eb-99fc-775895b7e14a", "value": "98304:ajcvlKwJujtETnmAefkBE4XEVWCvN+kibtLkcutxeriRQ:a+lKwJ0ErmA86E4GvN+Rw9RQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348187, "uuid": "88782144-bc50-490f-adba-d768c6386a18", "value": 4069723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348187, "uuid": "b8cc3131-d7a9-47d5-b83e-251cc6147e3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348187, "uuid": "deb53a5e-c088-492b-81ca-1d2b165989c8", "value": "Shadow-Bot-v11.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de04e5b8-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352656, "uuid": "eaa2ade0-ac45-4284-bb42-accc6368b5b9", "comment": "Malware payload", "value": "86fe6d3fa3004f7ca0fa4c63a81dfbd7", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352656, "uuid": "688e0960-f872-4d89-be71-0e4d59796795", "comment": "Malware payload", "value": "b1c29d5ee58422438b357ff8d24b1f89ae4d18ed4f38259b89e427a355751c71", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352656, "uuid": "8014c333-0d90-4784-a32e-316f2fecb483", "comment": "Malware payload", "value": "9760abbba4e4aeb00222fbacd3616eeddcb9a2bf", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352656, "uuid": "23d8c282-9d6d-4287-9e9f-ad20100e872f", "comment": "Malware payload", "value": "9d6f48dd931a86c60625e99dc224f237f14b54ef9bda9b7105d9cf8c2276b86121b4b7e723c1aff8983fd0c167a77f0c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352656, "uuid": "e61efc65-0384-4b93-b8aa-5775897c43eb", "value": "T1AF462333AB055D16C28143B4F55F79212F2D37234789A6E639ECD2463B4BEC2B62F489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352656, "uuid": "ddc70db8-7cac-474f-974a-6ed7e46ef367", "value": "49152:aiD5C5j7SSRhD+7rrumFF2rWwCm0gYggeONSCje2EaSh0XBlFZjbWpdm6FU/czTs:IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352656, "uuid": "35128a2a-a148-4cf5-8a04-faa4cabb33ea", "value": 5453824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352656, "uuid": "2130cfa1-113e-43d4-89bf-7b7b0f8518bc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352656, "uuid": "ee054d6f-83c8-4d89-823c-e7b09c12b7b7", "value": "Trsld247576LJTSI-6640G.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc77cda-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341680, "uuid": "f4e1353e-3ce8-4f23-81c7-4b3464df4c9f", "comment": "Malware payload (Grandoreiro)", "value": "764cdd6855d3f6f7bf2048f5d09b4daa", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341680, "uuid": "df8b7fc9-8ae3-4116-8934-31ec319f3dea", "comment": "Malware payload (Grandoreiro)", "value": "b20734ddd7265ed311b392461645fe377cefeb42841aff86efaf3a406715f18e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341680, "uuid": "93b53fc0-e7b0-47a4-ba56-82b30e7429f4", "comment": "Malware payload (Grandoreiro)", "value": "fdb6528fe397f059df7dbdd462f257a7e671144c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341680, "uuid": "1dcd1b95-f16a-40d5-b886-48cab0f31201", "comment": "Malware payload (Grandoreiro)", "value": "791e3dc90613144ac11c1b2b0f71cff33128f3bacde65e369cb4993d3ab0eac48067f1702c4012a47cee1de5920c7017", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341680, "uuid": "6c1e4d73-dc67-4780-a660-f92200fbc9ae", "value": "T179462331BA01286AC1904372BA3F7E362E7DB303468C55D279DDD2966707DE7A73E842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341680, "uuid": "421f58ae-fe8c-4bbd-a5b8-79553b7b275e", "value": "49152:rQRc+ZUnrVlkaJRegz3KLqzATCfglbWvxisVc23/YAb572VpBpYe7TVsyW:AsyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341680, "uuid": "b5aadbad-ad7e-4686-919d-edb58c94d0ac", "value": 5552128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341680, "uuid": "134b1e05-0a19-4bb8-a8d2-8f574b88c01d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341680, "uuid": "d01cf8fd-9ebc-4c8f-bd69-66662bb2ca53", "value": "0Mrc-Antl04142ZVSHJ4E10DL.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e040ed08-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286947, "uuid": "2ce67361-4b29-409a-ad27-e8de65306a0c", "comment": "Malware payload (Mirai)", "value": "51659bf3c94b327e98285f5edbcdc1fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286947, "uuid": "81dca940-6725-431b-ac89-ff7d63b18857", "comment": "Malware payload (Mirai)", "value": "b222ae3e2a14c2ba960f174595923c4db3d90030e92ba8f2c45e39c8a4914861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286947, "uuid": "ec6ecd80-4210-440b-b8f6-a43832617cf8", "comment": "Malware payload (Mirai)", "value": "848e65e7085d9614159c507e447df601ac6b70e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286947, "uuid": "97713883-552a-4d4f-a684-20fc3db4ae71", "comment": "Malware payload (Mirai)", "value": "17938fc7e9b94201e7bbeeb7041a4918efe06041f136f9c5e0455f94e99c032bb49ed5f9b0e5f4abd08b495c17135282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286947, "uuid": "2b284452-cb5b-4a44-8f7e-d8c049f4b355", "value": "T1CC432952D9226F77C047A4F160F95E311F26BCD65A8F1A966075ABE0024F6CDB00EFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286947, "uuid": "34ed46b4-d41c-4331-aa43-64ee76f80b79", "value": "768:1HDcludaZdFiHo5eR6MafCqUOtVA+4lRMKFmhFLaruohOfvpoC0ID:tcluQ/5eIffAuKFmhFmrS6C0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286947, "uuid": "d0669175-b92f-4b0a-a8ea-763de7ff4d8a", "value": 59680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286947, "uuid": "ec73f168-ddb1-428b-b717-b69efde7cf2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286947, "uuid": "5e8c77e9-d320-499a-aacc-b2a806eed37e", "value": "cron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd67785-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313085, "uuid": "4a234303-98fb-4c65-b728-b0ceb6fa5974", "comment": "Malware payload (ChromElevator)", "value": "2f2137144042892123e1e658591c13fe", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313085, "uuid": "ddb4a688-1214-4058-b75d-b238d52cf4fd", "comment": "Malware payload (ChromElevator)", "value": "b25a969eb9bec5945cff6ebbfc76c3630635662c607e298645db3a4f26fd0665", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313085, "uuid": "9d06fd68-0ec3-480b-8232-891c15ff087d", "comment": "Malware payload (ChromElevator)", "value": "71cb273f1c3a61f3226b817cdad44616b1faf0d3", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313085, "uuid": "5fea1494-efc9-47ef-97bb-7d9aaa60f9d7", "comment": "Malware payload (ChromElevator)", "value": "886682213023e4d6acaef43672ec4830ea7ebab329e584c5d8bd03c45248bb3a571467f171472950cc8709f95edba1b3", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313085, "uuid": "4a44e6d2-129b-46ec-a9e0-1b2a66aa3f15", "value": "T10396E79FA3D003B914B26214F58E75BEF312C47C5322D2282D5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313085, "uuid": "43cdf9e7-b569-4df1-b17c-ea20061a28d6", "value": "49152:vSakcuGJUi4ucTpPqGN6XFJkgo6BNvRMotdOKBNIi107n8v1zA3f/AlVuFk:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313085, "uuid": "8d59fb0c-f960-4535-b3d0-9ed2ec164307", "value": 8889606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313085, "uuid": "15ff30cc-c441-4519-900e-886a96e25857", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313085, "uuid": "487d29e5-d0a7-45f3-ab4e-1edca81920ce", "value": "nouveau_curriculum_vitae (6).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7875d333-0bf9-11f1-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1771330152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330152, "uuid": "bb9cf21b-cfb2-4956-9002-c1c948e0f9e9", "comment": "Malware payload (QuasarRAT)", "value": "512de6f55cf7ab321b4985cd624c89fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330152, "uuid": "90933664-deca-4bfe-a5e0-c8a6bab36de1", "comment": "Malware payload (QuasarRAT)", "value": "b287b5079df8ace6db9e2236fad46abeb8b297033e03835135016f984ac94132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330152, "uuid": "013681e2-a41a-4568-9e67-9426f6c6de66", "comment": "Malware payload (QuasarRAT)", "value": "14cd7a8137e68c33e91b07bbf39f27ae6181daaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330152, "uuid": "5cd63fd0-e8bc-4116-9c45-729b16adbb7a", "comment": "Malware payload (QuasarRAT)", "value": "90c4fab7bbfa02f151f6f9564de4c25d145133c365254101301dc368fb3eb79a51fd5d8bd84e25cdc6b7491d157d6a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330152, "uuid": "8eba67d5-8aaf-4e41-b29d-ea28e0b5dda8", "value": "T195546C6577F48B2FE2AE2779E82403104BB5E916F54BF38B894494B86D173828D41FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330152, "uuid": "0d9fdf83-7090-43bc-a624-609b58109856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330152, "uuid": "fe94d739-c039-466a-b42e-b0737586e65d", "value": "3072:TS+nE2LQWkjhf42P0pl9PEGCGbJttCrC+dmytOMPHPuzf0pTDjMmfeT9bq+DqM95:m+SclyG/JtOFDpTDjMmfeT9bRDPXGVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771330152, "uuid": "19ada2ee-c8b3-4ca5-8d41-157c6ca09d4d", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771330152, "uuid": "4f56dc64-53bd-4b5c-9475-46103a59161a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330152, "uuid": "313f2d69-19e1-4855-88ef-99c4254f37f5", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1578b4-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343284, "uuid": "681e0883-5a88-4279-a2f2-5a2ad38ad4eb", "comment": "Malware payload (Grandoreiro)", "value": "c33cf48043a668cc297406d6e5113b21", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343284, "uuid": "4bc83006-92b2-49a7-ad42-75302515422d", "comment": "Malware payload (Grandoreiro)", "value": "b2b04299294cbda4abbf1358cbf9a7657ee1c35cf76bd263040b1d542c23686d", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343284, "uuid": "098c3396-dd55-4a85-b87a-a487b3e67e37", "comment": "Malware payload (Grandoreiro)", "value": "26702bae54b4e9fc6ab81f61824b4ee0c9581d44", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343284, "uuid": "8f737097-fc1c-4702-9c0d-5bba1c912f33", "comment": "Malware payload (Grandoreiro)", "value": "c0521adfa27156018d595dd87a9584ee302bef27c1cc85100f4af6587b03eccd97aeb6735040e0bc41f1164fc5baa965", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343284, "uuid": "f408e72c-f049-4eb6-b61f-040d08469b42", "value": "T1D27633328E896C6FC9148330F56F2D25AF2D6B17854CA1DB3A9D51C3274BF96C40B4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343284, "uuid": "62fbaf7f-1b29-4e5b-aae3-ec2d838dd303", "value": "49152:4gkmRqbjMxS2vxXwWNoHtCr+j1cHSC1mGrw81FQnpV+3nX9EfK//R2tWBBJpck1a:mqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343284, "uuid": "249f056f-abdf-43c1-9916-07253a39a382", "value": 7401472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343284, "uuid": "af1ec18f-c601-4398-8624-4444759420c4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343284, "uuid": "ea2aaf44-14f6-4cdf-936a-aec1d188fa6f", "value": "Not-Ar609345PS46NCXU81679.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26909c0-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771312747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312747, "uuid": "d3c7796d-84b1-4f26-9e55-f4ac28867dde", "comment": "Malware payload (AgentTesla)", "value": "1e53b35965517da819bbf3e0e3b94147", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312747, "uuid": "19b6bc60-f31f-4c5a-bf63-6a2f975a38d1", "comment": "Malware payload (AgentTesla)", "value": "b2b27d5d401a1054f0e69835850d3a7fd1e14c7d8827c92278384bfbd7f1e9ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312747, "uuid": "1c7732ba-e616-40ef-bb7c-0af30c35c4bc", "comment": "Malware payload (AgentTesla)", "value": "f505a7d9ebac2f72bd03a0bfdfded671b68a415c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312747, "uuid": "11fa9b20-3fbd-4d9f-8930-74def9d3ae04", "comment": "Malware payload (AgentTesla)", "value": "20f878e7034de962cacc953abdf2fb7732b1cc30a4a22c01f7287a1c3dcceeacf88ca33862f64ec57c5e0eb6deb8de7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312747, "uuid": "355a15b4-454d-4290-9e57-b7ee2e98f1f5", "value": "T1A935122230DB24DE74C95361D10DF5A1FF9E506B7C3682B718BADAC791E160E2B6832D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312747, "uuid": "81ef5184-e729-4ebd-b807-26079416debb", "value": "384:vFtNfeKViUeNRp3F2hGIGd7NqJf+wxlPnXr6g7Um0U3frYzvPhHp93jbasL0:oNZU+j0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312747, "uuid": "93cf089c-53c6-40bc-9aee-577c2a6bfefc", "value": 1124818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312747, "uuid": "8d6fa4b8-d11c-4666-bb11-2d3184710b95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312747, "uuid": "258332e1-0240-4cf6-830a-b68467566d57", "value": "1e53b35965517da819bbf3e0e3b94147.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae34a83-0bf9-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771330156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330156, "uuid": "4529d2fe-da6e-41b5-9f5b-de2e2b11b3ef", "comment": "Malware payload", "value": "c9f7594ff3df1a06db25fa6bbec78fb3", "object_relation": "md5", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330156, "uuid": "ac156062-f5f9-49de-ac37-ec99c8e09931", "comment": "Malware payload", "value": "b2b29b1445818fb7d4229d8a0744ce1743896afe03c4c96b34c2a9ab48813666", "object_relation": "sha256", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330156, "uuid": "1d21dfaf-2be7-460a-b72c-ae1e5d7dc004", "comment": "Malware payload", "value": "96442736e8572f992c40ace0442c55cc477f0ae0", "object_relation": "sha1", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330156, "uuid": "4211c6cc-f038-489f-8c68-a818817e9869", "comment": "Malware payload", "value": "2f673b3c6b19ca2c2b1c8e0e326c73a7c9d7b92826fe557d18348bebc98b5c72f635e4b95f6cd931cfbfc3f51bf20946", "object_relation": "sha3-384", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330156, "uuid": "1012bc39-c304-4a7d-b6c2-cd9e59c772dc", "value": "T1A8524B252ACFD87AC417843E988A94EB957E074E7242A92F085D146E0DE1F4F4B3ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330156, "uuid": "7f082da1-a498-4071-9419-6da932357adf", "value": "384:IPn3w9gntXAskZD7oXpl4yy8XcAZ9EcdnMUszB:o9nAZD7oZK0MAscWUGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771330156, "uuid": "cd9a6d9b-b0c0-413d-b938-bf3fa2df1fcc", "value": 13230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771330156, "uuid": "39a1cfac-9b63-494e-ac7e-4334d06ed3a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330156, "uuid": "8d79429b-78c9-41a6-b0e8-a183a1fa25ee", "value": "donutdupe-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25794ba-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352636, "uuid": "dda42dd2-2501-4df6-a015-869982204907", "comment": "Malware payload", "value": "9a6e5e81dc244abe98f9b1300f9c5c76", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352636, "uuid": "1056fe40-020a-48b1-a028-9a8a5af00d06", "comment": "Malware payload", "value": "b3970ff836f096cbf87e1c1c4205262f4f515feca7684da4345339b54f84d88d", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352636, "uuid": "5027f72d-4445-453e-acea-cd4e233d4e47", "comment": "Malware payload", "value": "543ea13b391577adb5c5051b00e9b07de197246b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352636, "uuid": "a4addc0a-d838-4cde-ac1f-f56a801b00dc", "comment": "Malware payload", "value": "6914f5cf6a715d462d6e884edf1d9f5b77fc3d807f449cf8bd87bc2261322b81c68d03362f9c3cb0c1287201adbe462b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352636, "uuid": "c2cdcfb1-af75-4cd8-bbcb-2ef43e7022c9", "value": "T149863331DE841C76C194873A703F2F366EBEBA53498CD1A355DCA4867B86BC1083F9A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352636, "uuid": "5f893f5e-5cf2-427b-8c30-116f65a3d294", "value": "49152:UIx/NWjTX76zMh/vWPgYio2Im4OUBbGv8+JanJ6ZGqOCFAt76laXFFqQWUa5ND5X:Yg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352636, "uuid": "48d87d3f-dbcb-4800-b892-b3e6fe147613", "value": 7995392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352636, "uuid": "170a4980-afe6-4a56-8fb1-ac629349f1fa", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352636, "uuid": "3df27ccd-c25c-41ff-ae48-94afc7f4c818", "value": "TrmQ93J-780612GCRZOQ4UX8_Expe.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd224083-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311423, "uuid": "1cf2e7a2-f652-4e80-a2a4-e256c504fe4e", "comment": "Malware payload", "value": "2e705344ef9412c62b5d5a4f4e2580f8", "object_relation": "md5", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311423, "uuid": "0c2bfbcd-a9b4-4164-980d-941675a2b2b4", "comment": "Malware payload", "value": "b3a91d26480efc16a0f6fd30e2077b72da65bbb1c07f35abba526983c781ad51", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311423, "uuid": "94c8ad9e-c58e-44d5-98ca-90918eb4adf3", "comment": "Malware payload", "value": "84f5b211aa5f559c0ae8956c1a66a2df563feb77", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311423, "uuid": "5e881d37-53d8-42fa-b793-397eeec69c15", "comment": "Malware payload", "value": "8a9337f9132fc8a9b59e5cd1cd1a5d80e0565122642ada59359b47dfcef6df04f503b8fd76bfd69890054d31c1aaa8d0", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311423, "uuid": "21f87ac6-ddba-487f-9310-bdeda68e6591", "value": "T1C7F5FA20BAE8D325E4A876B07C76E5C959A73EDC8D1C8E0F348C731E283E324F555666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311423, "uuid": "455bb1d9-f4fb-44bd-8dfe-c8478a3441ef", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311423, "uuid": "a370f063-0307-4ce0-952c-0967b93248b3", "value": "12288:72BYJuzhFn10xUgcnu23h/pZbDBn9ELd0B:7gzhF10xHYh/pd19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311423, "uuid": "be192ad9-3d8f-417d-9cef-692767b4c504", "value": 3393600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311423, "uuid": "f9979ba9-1bda-4d18-bc74-f1c98a85e400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311423, "uuid": "6396c7e4-c4e5-41c7-8eab-bdf62bef74f8", "value": "b3a91d26480efc16a0f6fd30e2077b72da65bbb1c07f35abba526983c781ad51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698a6425-0ba6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771294478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294478, "uuid": "8c612ea4-a047-40bc-9aab-3b3122a3ba31", "comment": "Malware payload", "value": "53bceea0f6400d6009a446c2ee971fe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294478, "uuid": "a0d4ca6c-f20c-4eaf-a131-e5b5ab16c7a0", "comment": "Malware payload", "value": "b3a957ba181988bb0b692134a2c05caf09c61ac217fc8448aaf96eb002e5166a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294478, "uuid": "1cc76849-d26b-4635-845f-6d90440ba612", "comment": "Malware payload", "value": "e79b3a1a582ce39dfd087038eede22d86539ffee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294478, "uuid": "add817ca-fa35-40bf-b6c7-68de47870ca5", "comment": "Malware payload", "value": "ec4656b89d8248f5a0745a047d3769c898f30d59845211f0f726520a98f872fb01a4dbe82d0864d39983f56f22383a8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294478, "uuid": "ae9d5f08-86c1-480c-b934-03a52bf3e278", "value": "T1BCC5C562BE99EE0FD698313546A6C03473D67A04C0F07436CA67E7092FAE274D95BCD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294478, "uuid": "a51b992d-7706-4d5c-8172-a34d9831f26b", "value": "12288:8NzT1gkjE8cOPth0n3H4gd2f2HCela5U/vjRYm4y+2KlqIyjl1Jaf6I169LEhnN3:sq3HUJec5wjRcq9l10HREzaPfl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771294478, "uuid": "944cdb99-d647-40e2-b12f-c967faa334ec", "value": 2677336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771294478, "uuid": "4b4ece0b-d90f-41b6-9bd5-cc91a2bf887b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294478, "uuid": "e5ace208-ce91-47ce-a9ac-287496c2f007", "value": "bizy.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14db888a-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343299, "uuid": "4036d0dd-fc23-4f94-8abf-d3eabb32dc95", "comment": "Malware payload (Grandoreiro)", "value": "e76da3dee7b5b6dec0e116f42bc4c536", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343299, "uuid": "aa49974f-4e18-430c-beb6-e8f7fb38e6cf", "comment": "Malware payload (Grandoreiro)", "value": "b3c8a0124d5385aac8e96a42d5a2d8f8952bb8ff78525df4460e25d0acd4cfdb", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343299, "uuid": "f0af75ef-3ff1-4e2e-bf44-09d7c31d4611", "comment": "Malware payload (Grandoreiro)", "value": "60f4d67ed61e4855f943a1d225091dd983a366f2", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343299, "uuid": "16dae82d-d07b-4315-83a0-ab01dc2d0967", "comment": "Malware payload (Grandoreiro)", "value": "002e26a44fa3b04e38f4a34ca734c72331a5bd72bd577644fb0ad15bbca2aba3712fb70bfb4d7fc68a3fad2f27eb1974", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343299, "uuid": "2c0b3794-3722-43fe-8b89-446fbf8dc27b", "value": "T1C2562331FB825C6BC5418330762E2E325F3E76034848FBDAA8ADC157B7459D16E3E85A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343299, "uuid": "82e99298-4d2a-45f0-85e8-f0d4056c8aa6", "value": "49152:aoRzeP9YoSXxg9h+PHa7Qlhzafjqih4pn180WzbVTTcHbE6nOWr3aEvWgmHsUx9t:ruim3YuUyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343299, "uuid": "0e94ffef-ad16-4b2d-83af-4cf40cbf5281", "value": 6309888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343299, "uuid": "26e4829c-b006-4334-9717-e295b3a7708e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343299, "uuid": "996435e5-65c6-47f7-9a9c-68fc9c2cde66", "value": "Nta-Cr39SZC_869531LSBZXPHC.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61274dc5-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341709, "uuid": "b32a2d07-0586-4738-9c76-3b32efc33200", "comment": "Malware payload (Grandoreiro)", "value": "c2c037976fa83f2a116c10be80b6c5ad", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341709, "uuid": "02876f21-8922-4f52-838f-c74fb09cca46", "comment": "Malware payload (Grandoreiro)", "value": "b3e0ee22e38712d7132c45aec00ae47f3b8224d5ed2c9ad6ccd755554896e511", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341709, "uuid": "549d3ca7-cb3f-4e99-a0f9-31a41b43857a", "comment": "Malware payload (Grandoreiro)", "value": "2a50513ef671f42a4219ab3726a7c21b221289d8", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341709, "uuid": "6668fab5-5f79-47e3-ad0c-ebcb3e293927", "comment": "Malware payload (Grandoreiro)", "value": "078ce2ac1a7b74d49647964654e57c5fba7d6207a8d3ede30549b93ad83733ed0498556103eeb7e3fd04381e7ca517e3", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341709, "uuid": "0a6207ff-5f64-454c-8f43-010c239aa5c7", "value": "T1EA162332AE80185FC5E08336F16B36359F2E31235ACE91D338ACD69637065D9953B8E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341709, "uuid": "4d11a9f8-c0b7-42ad-8407-1a21bc3b3022", "value": "49152:vGfcDMtDoJmuAF/eJgJPQLzGSiNbZw3f5i+dnTtst/:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341709, "uuid": "337448be-a82b-4842-b70e-bba62faa2bda", "value": 4167680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341709, "uuid": "c025fbba-2dbe-467f-98d4-be709b39cbd5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341709, "uuid": "5ea75586-1c6a-457d-a8e8-5ef9cfc9ab7a", "value": "0Ofc9456PRGCLBJ6X6-91664.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6355ef99-0ba4-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771293609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293609, "uuid": "24fb7623-7947-42ed-b950-6ab77adafd13", "comment": "Malware payload", "value": "3aeac6b0a1720f2df94c0be08179b01f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293609, "uuid": "021a6074-85d9-43fb-a8e1-2fdb5ef0903c", "comment": "Malware payload", "value": "b4869015b8c8518d0c6b4608866a2d16074f50d5ac390af9b44ba017f58d1be1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293609, "uuid": "a9076195-9ba3-4b55-aa0a-25d1b97e2420", "comment": "Malware payload", "value": "cdfac4be426bbbac74010e83dd90d3fb2956c23d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293609, "uuid": "3b9c4bd8-3dae-400c-a552-9da7f3e03f35", "comment": "Malware payload", "value": "c813c453fe1a56eb4e6e7810bd9488ec49a3e4eb0746e246a5e4d4e3864f3366de51ffb66100a4333c31d6a276570f15", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293609, "uuid": "1de1c1e5-b9a0-4692-a5a5-042ccf9df0fa", "value": "T1D957331AE462166BD47BC9350DB68E2A87633D64FC030833B55533E65AF77D092FA08B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293609, "uuid": "794e7d22-5378-47f0-b3f8-0d6198ff36c4", "value": "786432:RxwsTqhBJqRqRfmXzztjeS0qr5bEqxA1clktQsIl:RxwsGhX9Qzztj5bEqxA1vfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771293609, "uuid": "97991fe0-8936-4cc8-82b1-8d163dff3adf", "value": 29302784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771293609, "uuid": "1307548b-68c5-4819-97e2-be782d04edac", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293609, "uuid": "8a48a01b-a277-47eb-bffd-61624a862b02", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9aa544-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352331, "uuid": "938c750d-387d-473e-a413-84a95d36dcb3", "comment": "Malware payload (Mirai)", "value": "a788a73acf63febeb6fe2da3d55765d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352331, "uuid": "ddf8634f-f730-4385-b611-38b478537407", "comment": "Malware payload (Mirai)", "value": "b51d6c23a152d9551e076bcfd36f70d6a1f48343394c12d37ada451e39f56a6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352331, "uuid": "f5da4da4-52ba-4249-9055-e63e5b675c1d", "comment": "Malware payload (Mirai)", "value": "e3de6a0957e5c88e2358aa9c705ace35b7d91627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352331, "uuid": "37ed2819-00ae-430b-a25f-697e9a6a5327", "comment": "Malware payload (Mirai)", "value": "fdef5055968b4f95fbe906e21aa5371e700d16dbe3128cf4a666320f0a70379ad75b6d241700ba1ec2f7b5ae01c72ff4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352331, "uuid": "ce6a0805-f9eb-4874-a174-44889ca4cbd0", "value": "T19D534A22A8792E17C0D5F57B22F78328B2F5170E24A8CA2D7C760F8EFF1895065576B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352331, "uuid": "95836a7f-b784-4edb-9fdc-09416adeb591", "value": "768:4SoA7YUFoWq9XgOpo7bDk4oIVT+eJPdIei2pM6WlxOO+hBCAFEI:4SBYEJSXgOp6bQ4oIVTXJPdIr8hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352331, "uuid": "c8ce556f-253c-4423-96c1-dac03b281e66", "value": 62476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352331, "uuid": "62b9f989-bd16-40fc-b190-e52f731ec2d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352331, "uuid": "fe026dc7-ab13-4025-9073-bbf106d015f1", "value": "mirai.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd07f1c-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771312709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312709, "uuid": "3e03e6da-2efb-4efc-a004-fa2f0021ac24", "comment": "Malware payload (AgentTesla)", "value": "6091c3bd054afb093f6f3c9897d00651", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312709, "uuid": "7d9ce1b6-71f4-4637-a189-00480d1cfd23", "comment": "Malware payload (AgentTesla)", "value": "b59299186e545e66fe671bf0cbfc935137145785511de27f01298e2874f27eed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312709, "uuid": "472e2948-9987-4031-8c20-11143f336126", "comment": "Malware payload (AgentTesla)", "value": "a8c0d7fe40d4ce8fa8c87c8f41d8a05f44d2bd98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312709, "uuid": "9b52ec9a-3d9b-4f99-aa1d-46691be2b678", "comment": "Malware payload (AgentTesla)", "value": "8e6a309020824b469a69106ab33e9daa619209ee0da32965c592d6e6397589e7b3f2f55ba12d47d856f26e1f36c3c735", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312709, "uuid": "a9e68ef7-7c36-4c12-9f0e-a2ca5d16975f", "value": "T18833A5CA37D1B0FC0A6638B7391F61B6B2AE9E40608CD016DA578D787C6372DDC76924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312709, "uuid": "c4b98902-f3ea-47b9-99f3-dd1fbded8216", "value": "1536:3yypilyiqcqo4yxTusrToX9DdXftpZnKc5HohWabIMW7:C5yaqotcsQ52jZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312709, "uuid": "a383fc73-37e5-427c-87fa-599f8c51ab34", "value": 51394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312709, "uuid": "121c32d1-9bdd-49d1-8db6-4aa702213401", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312709, "uuid": "52ed0c0a-8d63-4d2c-a36a-5dcbf4609813", "value": "6091c3bd054afb093f6f3c9897d00651.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321535dc-0c43-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771361816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361816, "uuid": "7f49cd29-d454-49a7-a805-0c30f16efff7", "comment": "Malware payload", "value": "e4419edd98580f110a98660c4f89547b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361816, "uuid": "a6756989-adb5-42d0-ab92-ec7ef421033e", "comment": "Malware payload", "value": "b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361816, "uuid": "a462788e-ff19-4c2e-9562-57476a67d25a", "comment": "Malware payload", "value": "c7d61f79297d3469538569176f3d6b256bcb52f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771361816, "uuid": "7b786f2b-99fd-4844-99ea-8aab6a8a99fe", "comment": "Malware payload", "value": "cab90d893b118d4a089ff4f9f0d6eaaad99e73e202ebda3e48696c2b16c78f980fdce3c346ccc0936ffd4038b131ab0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361816, "uuid": "5d2e901d-e6b0-45d1-b004-7fda1e1c4ba1", "value": "T199C61211B3E585B5E0BF0A38D87A86566A34BC049716C6BF57A4BD292D32FC08E31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361816, "uuid": "21199538-7516-4d55-87fe-5d9ed729a2b9", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361816, "uuid": "a8065593-4ecd-4ee9-9e8d-b599ee9de759", "value": "196608:p1EfefPkWKaLNkbgFi4Q0KaLNkbgRKaLNkbg/KaLNkbgE:p/WgFiHqWg1WgXWgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771361816, "uuid": "60655b75-d87c-4cee-85cb-c500f739cb4e", "value": 12580920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771361816, "uuid": "a7c7d6d0-e461-4dbe-842a-60695640dba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771361816, "uuid": "a1f578fd-2f4e-49b1-a9e5-926e00a21c13", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982c4a69-0c00-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771333211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333211, "uuid": "aaea7061-b1ac-49ef-b2bf-d6374770a308", "comment": "Malware payload", "value": "a6cf0cb907a20cfd3468be00756308e8", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333211, "uuid": "dee52069-e86f-4c70-b924-f79f06a3bdd3", "comment": "Malware payload", "value": "b5b7f9a0b6c8a87c525c80218a564dec93bb70a3549e686bd4e050ae5e152b00", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333211, "uuid": "3c7fe870-2870-4189-a681-d6c0f9ce0208", "comment": "Malware payload", "value": "b71041d1636b5fc1eb17c8458ac984ee626d069c", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333211, "uuid": "ee07f542-a2a3-47c7-8932-e7fa3a8109f5", "comment": "Malware payload", "value": "7cffb872aec7d40dcbe8876dd951cf33bc1543e4651dbb17406898389576f7ed47563e9f44063d6722beeb47bd6306db", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333211, "uuid": "5bcde5fb-b13a-4a30-a8a7-21e63bd18b38", "value": "T1D302B066EB1D9F4CEEFC842389DC2C855E9F1751415E30D1C4EB529FCFA1502620AB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333211, "uuid": "69e3becc-18e5-4bfa-9cc0-8402f29d17ed", "value": "192:q6UEBhCE1aJRBKGzF3qGsHWN9nCNXBE4XZMI59hoROO5IY3lO6DxRKktZ2:qoBhC5LBKGaGs2NABbXeE9SR5b3lO6DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771333211, "uuid": "b1f4f3de-eb09-474f-aeb2-7dc9bcbb5c3b", "value": 8843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771333211, "uuid": "f2fe55a6-641b-4d71-ab9d-c86fea12545a", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333211, "uuid": "ca77f60b-1eac-4efb-bc35-61d1fe3a74e1", "value": "nFerkomcelik_INQUIRY_17-02-26.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a943f1b-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348140, "uuid": "a8b8bca4-6334-4b49-9f2d-5da4503b9294", "comment": "Malware payload", "value": "a4852618bb31adee6a5ea368226d014a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348140, "uuid": "389aebd1-cb8a-4d9c-a049-f0009cfa3294", "comment": "Malware payload", "value": "b6cdbfac05e2e65513c7c2eae88ac9594c84fae7ee3691f81579ddaea6c6f95b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348140, "uuid": "5b6c7f9d-42fb-4f7a-bf52-0d7183df570d", "comment": "Malware payload", "value": "ca238fe725fc869b3a699f8ffa37a2caab27ddbd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348140, "uuid": "3a5fea0c-ee79-46a1-aba4-a23a5bdfcd2d", "comment": "Malware payload", "value": "d6a272724619171576f3a95dcb5b8ecdee2004f33852abfeac6a9a110e18533a58406f542edbec49786a8426881fd80f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348140, "uuid": "24250a2f-9af8-4966-bdd0-bcacabde8a90", "value": "T193046C01B8C1C136D66F0931997ADBA54F3DBC914FF4A9CBB7844DFA4A306C0AB3561A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348140, "uuid": "6c7a1915-28d7-4fd7-944a-f32a5bf231a9", "value": "534378d7da3ff5b0cd51357bd46fa077", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348140, "uuid": "22aa3da6-6c2d-46b2-8a0d-95f1d34a2293", "value": "3072:ZwEZJHgCMRARtRxwDq+wbZ2LE0aSt+iKihoNfpNt9mdQpBNa3ERCiI7fMX8:ZnGAtIDqHt0nMxih6BZKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348140, "uuid": "50084509-1718-4243-98e9-f1b0cc2c0f98", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348140, "uuid": "cdf8aa9b-2b29-4582-9507-06cd6c91c900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348140, "uuid": "13ede7e4-5200-419a-ba8f-d6804688120c", "value": "D3D11InstallHelper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a53c5e-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313078, "uuid": "704e6904-6dbd-4541-8ed0-c60625afaf96", "comment": "Malware payload (ChromElevator)", "value": "9f9e7477dfcdf2932d12b449bf5dd846", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313078, "uuid": "37876201-dc0b-46af-92a3-68ea99f4fa36", "comment": "Malware payload (ChromElevator)", "value": "b72a1fb2d8032fac898285e37085c6283eb2322d3c49aa35e6dac64836c1335e", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313078, "uuid": "8d1cc2d3-94be-4f5b-aa54-3ee1132d1744", "comment": "Malware payload (ChromElevator)", "value": "b55ad97212f1c5a5e1dbc70eb9f5d7d07e4a7a98", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313078, "uuid": "c5bcb198-d2da-4708-9c43-293d5c9ac9b8", "comment": "Malware payload (ChromElevator)", "value": "602a71b82e367fa81ee90275e0eaaabfd1c188a73e60d25b38f8394f2aeb493574c9987173637a4c085152cd46248a56", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313078, "uuid": "6fd6200d-95c3-4f46-b330-b3694c790a55", "value": "T11196E75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313078, "uuid": "336b14f9-8031-4e42-8a5e-276490bf732e", "value": "49152:6O/wYnVOKGfAeKlgAzePsfuQPxTy6pDWEEusQWbBuFLHdHcMP/JDxBBMDtUmOZtJ:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313078, "uuid": "c7f09d4a-1db9-450e-9a1b-699b861e39d7", "value": 8702663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313078, "uuid": "39547686-bb5e-42ef-96a5-abe467c8c836", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313078, "uuid": "9a3c265b-05d2-42a2-839a-ca309c8dc781", "value": "nouveau_curriculum_vitae (5).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07ada21-0c2b-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771351774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351774, "uuid": "338335da-aac5-4e7b-898d-70e514cbc3cc", "comment": "Malware payload (Mirai)", "value": "84a90325b127b864acc5cbd7c05bf5e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351774, "uuid": "b60f4778-5421-4a54-95c3-1e917f573623", "comment": "Malware payload (Mirai)", "value": "b745035df7dd8563c32ed457af7e4239c7cb55923ede9b8a68b651fca5c0dea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351774, "uuid": "4dd4d51e-c881-4879-bdf6-a5664d9ebb6e", "comment": "Malware payload (Mirai)", "value": "29eed388f4de2d0bcc900cc8e6d26f16492c6292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771351774, "uuid": "2cfe6c2d-a6aa-4d58-a2df-08b213481a14", "comment": "Malware payload (Mirai)", "value": "2a15245500d451c5fa0f167d7c4895968c6c8ca474a3a78d5a3539a7227a69f62854437869fc88d0c4204c2976803057", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351774, "uuid": "919d6a44-a1cf-431c-afb8-f48502147744", "value": "T1DFC32C56EA818F03C4D61776BAAF42493323E754D3DB730689186FB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351774, "uuid": "b1998af1-86e6-45e4-9b6d-1951e2f955d1", "value": "3072:lgU/44TM2nDQwI25oFxhYJn6ZaI+oV+M/900i/:eU/44TMKFx5oFxh0nlI+okM/9xi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771351774, "uuid": "a6cd6d82-3103-49a3-b2a3-e81132f14277", "value": 121479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771351774, "uuid": "029b2989-2a69-4583-837e-dfe8f57fce11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771351774, "uuid": "ebd6807d-967d-4abe-be18-08afefef0721", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6762cbeb-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771290609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290609, "uuid": "8833c96e-447e-458f-8cc7-70f542b498d0", "comment": "Malware payload (SalatStealer)", "value": "46402595842b76a4814bab429473e088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290609, "uuid": "cfc9af34-abb7-41b6-aeb1-9e652e6c13ec", "comment": "Malware payload (SalatStealer)", "value": "b7cfd798fe6c5c8ccd5fa0b7953025dcf264a91e963cf08f38f3d676d1c9fa26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290609, "uuid": "dfe243f5-4e61-42f2-86b0-bbb1acbcd05a", "comment": "Malware payload (SalatStealer)", "value": "a58bb4ab71ad8c475287fbfe09fa2d7195995705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290609, "uuid": "4c7133f6-3019-480a-b2c4-1d4da7f2fe7d", "comment": "Malware payload (SalatStealer)", "value": "17e4dbfd3243c8b6773b8589ce4d9a5fd064717d03e7a78074b96ea90088411a28c8c2da6d9f53e2696d83fba9290add", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290609, "uuid": "cbbc9f52-c058-489b-bd89-8dd39af33cc8", "value": "T1F3C65B41FA8F98F5E9031835406BA33F63315D048B28DB9BEB547E2BFCB76911967209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290609, "uuid": "284cf2cf-8c47-4170-895d-eb0c8ebe6cac", "value": "49152:xipczFUXto9udPl9J/+I79kDssrvWBLsPJxgf30ATdNXAtI3dDAV+UKiFFeuudL1:QCzFUVdUA6s0AzAtItJAEh7lvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290609, "uuid": "b677d502-6de8-4b9a-a22e-77bd596ca0b4", "value": 12108800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290609, "uuid": "d5558b4d-7934-4cc7-965e-ba8034635053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290609, "uuid": "220fd5b7-4a44-4cee-8877-3146f9aace2b", "value": "xb7cfd798fe6c5c8ccd5fa0b7953025dcf264a91e963cf08f38f3d676d1c9fa26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170f2bac-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343303, "uuid": "3678fae9-b7be-40c4-9ce0-6422cdbd0e75", "comment": "Malware payload (Grandoreiro)", "value": "261a988cf0499d9b4398f3867e55a98a", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343303, "uuid": "b8f768a6-12d6-4b31-9664-b72913e4a95e", "comment": "Malware payload (Grandoreiro)", "value": "b81f0fafd2e0594e1dd5219e3eeb1242e0504445d8075b27948dd3123866d89f", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343303, "uuid": "f8c140c8-85b6-4368-9f9a-ce9817a36837", "comment": "Malware payload (Grandoreiro)", "value": "5b142f4d2e2fd6866727b55db719b4ffd5007643", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343303, "uuid": "95a79252-9f58-4551-b325-9c8adf8fbb71", "comment": "Malware payload (Grandoreiro)", "value": "bdfa288cfad636652aae6c015ebbc2a0c04f65ec19a66e22ffc3e7fffe8a41c9ae138a919e5b1fcb3177c71de452ef2e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343303, "uuid": "576dae52-7b5e-44ae-95be-76d20d424801", "value": "T17A662331A9966D1EC5508336716F3E261F3CB75381CCE1C378AC85823B8AF95C96F4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343303, "uuid": "976da778-0e9f-4796-9446-a24d9aafc936", "value": "49152:qsctoV/hN4YOQq/H8x9N6mxqbGVPne6+YfXOmW3RJwFDC2nzQ24bYxlnO9XICabu:eLUrYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343303, "uuid": "3958c7b9-437c-4462-a631-a040e8468e21", "value": 6795264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343303, "uuid": "ccfd6656-7f90-4081-a82d-f5794d6e744d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343303, "uuid": "e9a57c7b-e09f-4316-b6ab-a04e1d4ec8ec", "value": "Nta-Cr6687KZ_7896ODMSUKP90L.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e276b6-0c08-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771336726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336726, "uuid": "c3dd7f3e-ee9c-477a-83a8-68fd759d1b3f", "comment": "Malware payload (Mirai)", "value": "98935bc730ef0e9acfb984aa757e6779", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336726, "uuid": "f0a2707f-4a49-4f5b-a3ec-c4b76d310d8b", "comment": "Malware payload (Mirai)", "value": "b85d83b714fe4bcd711ab77281258788dc5e1f513f9580dbfcf6b4ad6c1ad5d6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336726, "uuid": "96c1be4e-e778-47eb-9f18-11986e6bdcff", "comment": "Malware payload (Mirai)", "value": "7c2b38df7ca1b13e58bf4c6aaf58655376a39975", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771336726, "uuid": "8ce46e5e-5d15-492d-96c1-49ddc0e042aa", "comment": "Malware payload (Mirai)", "value": "e8b25364d5ab950f710edd3514cc573d3ab40798cb233707d4f18a3cccfa7ecfbbfd93c2b4781042106372242cd7b3cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336726, "uuid": "8f7fe539-503c-4b8f-913a-9ade982c6c9a", "value": "T131011EA864B2AE57E366CF04B9A237ADA019A1DC7CE6DFE4D02D1C59485B301B315B00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336726, "uuid": "5b59a3f0-5555-4d80-8cf0-92469abd8398", "value": "12:bCjTfjTDbGj2Ij2tdJjRkkjRktjgHk5jgHkthFGjbogjbLc0LK27:b2H/bSzsdt3igHMgHghsT3fK27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771336726, "uuid": "9bd221c8-af66-472c-9a51-30d637156fc9", "value": 684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771336726, "uuid": "7ef03969-46e5-4c3e-ac2c-da6735941778", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771336726, "uuid": "8cec59a9-1fa7-4106-800d-d8ff9de6b1f2", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c458ee4-0bfc-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771331420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771331420, "uuid": "b9e00846-5d52-4299-b8dd-804e5f115c41", "comment": "Malware payload", "value": "d90d5d22cf74d166c473da10537d6377", "object_relation": "md5", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771331420, "uuid": "263b1471-fd50-4326-b5ee-b322e2c3408a", "comment": "Malware payload", "value": "b877b4a84f281a3833bcaf185ac92faae80dc0bba6840c8bd1fc2eb45deba6df", "object_relation": "sha256", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771331420, "uuid": "6722ab54-61f7-4243-989b-d98bc089fdca", "comment": "Malware payload", "value": "0de08b84bd9c227ca954d9b15beeef6751818f77", "object_relation": "sha1", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771331420, "uuid": "a33a6c96-5c4b-4b78-85fd-7cc53fd79861", "comment": "Malware payload", "value": "831bc1df0123abd41a7686aef196eac761de7b69ace61a1d07926d2ef9959b37f16fedd6c605f45f9f5fc8cd3ec027ef", "object_relation": "sha3-384", "Tag": [ { "name": "fabric", "colour": "#9B316A", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771331420, "uuid": "20c34954-8d68-414a-96a9-61ff1c865e5c", "value": "T129E4C787F1208AC7F44FEA7F14504210AEF0E4704607F2561B6E885A6FEB9C89F657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771331420, "uuid": "ab4dff35-2eac-445d-bb5e-03b96b21ff08", "value": "6144:i1eMX5Uh/W94gpr2ToPjhMokv4/C+AN7exuEKeFTBEr45UKt5E2/1Ep3x1ZWNS:iZboENND3/1qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771331420, "uuid": "b0b730b8-1204-4afd-8558-4c7d770bef71", "value": 702378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771331420, "uuid": "a83545f7-2ac8-45df-bf7a-2ac59e6a0973", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771331420, "uuid": "4730bad4-8231-4c91-b833-ab58b028de8f", "value": "Krypton_Client-1.21.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05f8bf2-0c49-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771364605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364605, "uuid": "2a23c960-4f83-4a97-9dff-9e5470a61e80", "comment": "Malware payload", "value": "3e281b8cccc2a422175a24d2e10a8058", "object_relation": "md5", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "aplicativos-br-com", "colour": "#2FACF5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364605, "uuid": "46adb5aa-fae8-4c45-8470-4b14cdbf5481", "comment": "Malware payload", "value": "b8fa21bbd5261f2308a168c1f43b197220c0d37bdda0c4a1464be085a9f85300", "object_relation": "sha256", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "aplicativos-br-com", "colour": "#2FACF5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364605, "uuid": "0c360e07-7e91-43a7-9c7c-9d74c735584e", "comment": "Malware payload", "value": "818954d331ce35ccf8e542a2f361a8474478a8d6", "object_relation": "sha1", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "aplicativos-br-com", "colour": "#2FACF5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364605, "uuid": "2301fbf7-a4ad-476d-b269-ae532bc2dda6", "comment": "Malware payload", "value": "d1e3d6e214c4b174da597c3323efc72d23c9bc133078f142da0fb80d26b5b045cd65d81ecc18955780e0f6bd93aa313f", "object_relation": "sha3-384", "Tag": [ { "name": "109-110-184-242", "colour": "#357787", "exportable": true, "hide_tag": false }, { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "aplicativos-br-com", "colour": "#2FACF5", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364605, "uuid": "aca1ae29-e73a-4741-be63-97cd380c707e", "value": "T1F0558B42FBE99E2ECC7340364F5A9735161A9D23C743C343D968361C68BB6E40E897E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364605, "uuid": "25559412-5cf3-4aca-a110-bc0aa5340241", "value": "24576:GENr5+LOy739Sw/uvDHMU4zgdcHRAV25agmjm7N9HsRQVrZ:GEiLOy7NSwGvDHMkdcx2gmq7N/tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771364605, "uuid": "b209fec2-664c-4ad3-854e-e2bea8993214", "value": 1340614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771364605, "uuid": "88f64531-8098-4205-bd7f-005a3238bbd7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364605, "uuid": "fe761cf7-d9a3-4af0-9b84-117f79427a7f", "value": "update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdd010b-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771343096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343096, "uuid": "da73ab2e-f68e-4778-87cf-7aa9e4cd409e", "comment": "Malware payload", "value": "08bf37e9f7fe23261315a9e01bb5b53a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343096, "uuid": "2d5a9a07-d9f9-4c01-bffa-052ee62817d8", "comment": "Malware payload", "value": "ba29461a5141dbf53128fa0c5bcb41593a635d8618e5c8ac0c985f006b555056", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343096, "uuid": "5f4b70d1-a4ee-4022-8061-de908801782b", "comment": "Malware payload", "value": "e0a368c12fced2a65bb74a5c104a08ca9816b224", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343096, "uuid": "89a95891-421a-4e91-98f1-1d292c9bda75", "comment": "Malware payload", "value": "9a7e2eec983b908fea6ae8725f17a440b0e6936b422ee1b16ea853f7cf236068f4d165f4cf68e35d44ab778ae238b9e1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343096, "uuid": "60346213-e591-4cea-8986-82039fe7a806", "value": "T12865036AB6E5A7AB2316CE9551ADFEFDE5D1C06123CAB11EC02013B00D1AB6715F8CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343096, "uuid": "504a41e9-aa98-4816-8c0a-c4802b7639c5", "value": "192:G/dIXDZ0itXmb1DNNlPIyS73cziZKwuZDXdDDl37DwzdFLcVXlrYxLaZ+4clhUDB:IsAZRxJ6ibWotPy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343096, "uuid": "b3e6171e-71f9-45f3-b59a-c4ed25d1d054", "value": 1424113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343096, "uuid": "3ae7f2ea-f331-45be-bd49-bc0be9d828ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343096, "uuid": "e9fb24ec-6ca4-4b80-bbfa-91a87396c0ac", "value": "08bf37e9f7fe23261315a9e01bb5b53a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16fb96c-0bcf-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312235, "uuid": "f68b376f-e852-45a0-b235-15dbbb16a8a9", "comment": "Malware payload", "value": "8c591ff69dfbe18adaa8b430f5846bcb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312235, "uuid": "3c41acaf-b3ef-4f68-b82c-33aaf7ba2434", "comment": "Malware payload", "value": "ba7c65e11e91f816193a42dfb05f23efe111d9442310e11ca10c0d137116a8a8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312235, "uuid": "25b8ccdc-7e27-4f92-b05c-d44231bfe86c", "comment": "Malware payload", "value": "32c2b5f0a7741d2da580c27e44e1056a19c015e0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312235, "uuid": "cd7a12aa-87a1-4946-b284-a99fb3dce52e", "comment": "Malware payload", "value": "95a71f34a2be7a5aca75e7fee548139a97aa463087ebaa35d89e927d14dda0fd94e2c0f41778b7d825d8f08ff2854d94", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312235, "uuid": "7be24294-26c4-40f9-8d1c-65ff05a5614a", "value": "T1FA162310EC9E8DD507B8AA2520AE9D0436E04B978C0975953FDC65EE4F6FA4F04378EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312235, "uuid": "e66944cc-5106-46fa-a80c-ccb73e6b27ea", "value": "49152:SNqWxAyNIGaFWvYUqw1NR0+xvoGO4NEXzxhbEQwrBtNZ:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312235, "uuid": "ca612727-06d3-46eb-88e3-966416fe1934", "value": 4171409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312235, "uuid": "9e828ec2-52be-42d8-b18b-51fa71bd743b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312235, "uuid": "a28869c6-c5a2-4eb2-a70a-9478363f3aa2", "value": "ENCRYPTED.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a769c6-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286788, "uuid": "6ca45514-1681-4241-ab5d-6cd29e10f72b", "comment": "Malware payload (Mirai)", "value": "6d5ef34ce72dfcb2c90158fb4a2f63bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286788, "uuid": "3c57bb22-338a-460d-9112-23f3b13d53cd", "comment": "Malware payload (Mirai)", "value": "baaca57ea05a7f0a57cf65c27ee615effc19fae9913fb21e76c32cea21a278c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286788, "uuid": "ced75785-38a3-4692-8bf7-b66654dba882", "comment": "Malware payload (Mirai)", "value": "f79bfbdfe5c65369140ce937cdc16178be438461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286788, "uuid": "cd937966-1d6b-46ca-8180-53b8b8b66650", "comment": "Malware payload (Mirai)", "value": "a8d9ddb2a95f4ffd58efcf3b3e953546f6228c4830c447c08cb8a3dfa2c816308979feff5210755602fa4770ad6556fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286788, "uuid": "9878608b-859d-4269-9574-f0abaab45bb0", "value": "T131534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286788, "uuid": "7fa6a12d-13cc-4a13-9065-18290925dbda", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQfYLiKimfFoktCe3fYRMX:WShU3q7cEDlCK/0DY9i8Fok06fYRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286788, "uuid": "55f8f0d2-5143-47f4-a8a5-5af8a2fbce00", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286788, "uuid": "57123cc5-883a-4ffa-a32c-60c457ac7bc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286788, "uuid": "8db3cb39-c904-4b99-be03-0bd362b6fcfa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab1f6b7-0c05-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771335497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335497, "uuid": "ddcfbfad-b02d-4cab-8326-8d19678246a2", "comment": "Malware payload (Mirai)", "value": "b6b4a96a70671d20b153082ce3df441b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335497, "uuid": "897b061b-9d80-4fc0-ab3e-b960c48d7180", "comment": "Malware payload (Mirai)", "value": "baeafd62fb175fc3e1c6e96b9d3025c9e1f3161cc831e4cc3ee814f924212ba5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335497, "uuid": "19c41591-69e8-4abc-9c91-3ff6dbd38479", "comment": "Malware payload (Mirai)", "value": "723bfbaeade29a6f40a9c8b6a28bbac2682908a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335497, "uuid": "1c3d26e5-185b-4b53-9fe5-d98eebe1a26e", "comment": "Malware payload (Mirai)", "value": "556489426e932acc40a93a3ae6b02f9c0db589b1e0ac62b04cb589f71c43ca701d9204baeb7ec3dd990ff34ba0d03153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335497, "uuid": "cf60a534-7f6b-49a5-806b-0a43e982813a", "value": "T1BD833A55BC818A22C6D512BBFF5E428C772A53E8E2DB3213CD285F55378B92B0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335497, "uuid": "da5f9c9c-417f-4be3-b228-e3cf2b3d7e8d", "value": "1536:N7aL3OMymKL7KbZSbDhh6RKBwgpCVPkvN5seC1qHWkbjdKTkOybL6cvTWyEWG:N7aDiR78uAWikvN5/CsHWkbMjcyyEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771335497, "uuid": "2b558909-ccc2-4c2d-8a82-018ca70e9854", "value": 84808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771335497, "uuid": "ab517ad0-8a86-4238-8f99-bdb76618351f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335497, "uuid": "850138cc-b90b-4739-bc39-7cf5a7feee8d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b458b20-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341753, "uuid": "803b340a-0fe5-48e0-9fca-edb212e16e17", "comment": "Malware payload (Grandoreiro)", "value": "80279500db811eb4dd99537a29301fea", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341753, "uuid": "e17d0690-10e6-44c7-9e66-26db07870cbf", "comment": "Malware payload (Grandoreiro)", "value": "bb319a0e7e7274a04418673fad27a68aef072fdf5bf7c13bdd3ed5baffea2a25", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341753, "uuid": "fc192eaa-8f80-4f9b-a671-b577eed34de9", "comment": "Malware payload (Grandoreiro)", "value": "7f03215eecd1605d2e16be7c537d7551a96e6d4f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341753, "uuid": "7a081bb9-5a1f-4b17-a1a3-73b364a1a38a", "comment": "Malware payload (Grandoreiro)", "value": "a05f3a8e7e73d67b0d04c1c46d4c31e639f94c8fa930e4039864fe58b5405776a26331f6cef089bc9fc809be07186460", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341753, "uuid": "f66ed9b7-407d-4091-b5a5-652c126c4353", "value": "T10E8633324F546C6AC7684379B02F2E166F6D2953824CE5DB299DF18B334BFC0962F498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341753, "uuid": "c08e3136-8e59-4929-9229-1ce5f440d8fa", "value": "49152:wVYYR1oT5hL0DJmr6GU18p/3ybnw2NYMautmPHqiVtD/I8R4XfUvggFaNtC6VQIs:nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341753, "uuid": "d120732b-892d-4f5d-a105-086ef248bbbf", "value": 8050688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341753, "uuid": "c08e0f8f-3b60-4977-b750-df1bd13f625c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341753, "uuid": "1d78fe0c-796f-40ee-bb91-ac132b47f845", "value": "0VldcLVE0V2212ZTZPI_ZHEDH.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfd9f03-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343178, "uuid": "b2461383-29cf-4edd-8d39-f3d6a1c431a8", "comment": "Malware payload (Grandoreiro)", "value": "b9f73c93383a6d4364e739bdef8674f0", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343178, "uuid": "1754cbd3-0aca-443b-884f-f1c35390b423", "comment": "Malware payload (Grandoreiro)", "value": "bb5b4cfe4b2a005ec6c4158dbe8f1d8bb0ddc383a1349b199f0d8e04b0960163", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343178, "uuid": "1422c17a-7b09-42ff-a577-3d1b8ae5193b", "comment": "Malware payload (Grandoreiro)", "value": "b331be62a7a1301889ff5c97e3b63596bc4183ef", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343178, "uuid": "5a70b49a-c70a-4ccd-90c1-3b4068be8ce8", "comment": "Malware payload (Grandoreiro)", "value": "ff91a55e0fefed1a126c628e92247931300de5dbd66a24e7f61e010d3c61a081da5facd0c4dcc870db5ef90c24e9b0c3", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343178, "uuid": "e7c05b70-74d6-4c91-b21d-5ca0e8e09eef", "value": "T12D462332BF445C6BC1A04779752E3A354E2E6A030B8CA1D379ADD34A3B4AED3513F895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343178, "uuid": "a155e0bf-b4d6-4c1c-bf82-dc4de9146d56", "value": "49152:EERXO4skBcRFIBQn0VlKByE/VLh68nFjkOG9emtdg+g9WNa7W7/JaZGGQq:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343178, "uuid": "b8a5d5c9-1846-4f62-ae71-9d36ccef0db5", "value": 5570560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343178, "uuid": "47d66870-fc40-4748-89dc-8029395298b1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343178, "uuid": "026c6c83-ba56-473e-9bf1-3705f3dd753b", "value": "C4688BSntc-8975GZDRZCFP1.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289bf0af-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771300812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300812, "uuid": "322b076c-f671-4da7-bc82-890f9baa7127", "comment": "Malware payload (Mirai)", "value": "8110b08951c8cc8123c2a41232d4345d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300812, "uuid": "2f96cd7f-11d1-4173-9e5f-d85a66cf5e92", "comment": "Malware payload (Mirai)", "value": "bbd9cad6607885811d823574f1a5b7421da4cafcdd4e7cf8fd777c2220caf9e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300812, "uuid": "7d67a38a-e6fa-4c38-a3bd-df0c3c4dc8ef", "comment": "Malware payload (Mirai)", "value": "878a2ce5c45d2fdbb7d57eb8d6f1061917a3e3e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300812, "uuid": "c5b53d3d-e52b-4d5c-a604-e74f9855e183", "comment": "Malware payload (Mirai)", "value": "c241d2195e67ef6c2d42e8baa705263075140275e2650d1122c8b5446feb11d0ebdefe79398da85a5d26c223d1846e9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300812, "uuid": "286f4070-7bf6-49a0-8c37-ea7709244b85", "value": "T141C2D03DFA6C3E61C74E9CFE66DC4AE94109F29531C78B8E3711581CAA36E1C345982E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300812, "uuid": "75e827e9-8c66-4ae9-8ca5-0a5a7f194f0d", "value": "384:F2K0/f3zOfDZqsit+pfqckUt7BLEp8njkd7CQVbObIEL+hxr9ES5NkIu/jRWGVCz:Fe6fdz++NqckUt5EQieE4IELeVSEj2WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300812, "uuid": "bd1bafc5-44d0-4ae1-a463-86b997c00746", "value": 27568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300812, "uuid": "3453ee45-29ca-4989-9a7e-fe0a9e85e241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300812, "uuid": "c899cdee-3693-4d0f-a8f0-067cbaad11c2", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb3ac25-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1771311826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311826, "uuid": "b44a78a0-ea9b-4722-922d-5058b9ad496f", "comment": "Malware payload (DonutLoader)", "value": "f45ca7090e65357bd4c7f73235df07e7", "object_relation": "md5", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311826, "uuid": "aef5d546-dd06-4340-9772-ddd26a033e43", "comment": "Malware payload (DonutLoader)", "value": "bc0a5efbade3df89d6c58b050fa3e5ed7a23e676221ba6869fc9e011b06acb17", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311826, "uuid": "08b538c1-2a95-4f0b-a044-0b29cf84bc60", "comment": "Malware payload (DonutLoader)", "value": "81692e364473901c031008e185fd32a8ddacb31f", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311826, "uuid": "4bc7dfbe-2cbb-402d-b966-5f2230324a5c", "comment": "Malware payload (DonutLoader)", "value": "f4d58c18ec11ca55d747747882bc2c45502ca45409666ed9a1669e5a9853d64929bb6acf32c1e2350d0b59912897ea34", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311826, "uuid": "e4a56a3b-8f9f-41e6-9ce0-d6789e075b2a", "value": "T15413EA1EE242A5D8C51FC2388AEE5777B0F27910B5965B3E17B4C6B00F60DAD1B39E05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311826, "uuid": "e504aba8-575d-4acc-939f-07c20c3f78ed", "value": "507e378b8738173d2b40083e2181b450", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311826, "uuid": "50432ca8-85a0-40d2-8a42-09fc1fd6ea8a", "value": "384:Um/8FiDGOsyeL7v0esXkpiyhYDiff8nzTymelY:U6ADvZksiyhYDgknfyTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311826, "uuid": "eff56cff-0337-49c0-b4bd-c6b4a0ea7a88", "value": 45192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311826, "uuid": "981f69a2-2fe7-4b96-8de6-0fcc85f4e366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311826, "uuid": "de80a90f-c359-4313-9f46-34ecb1725c2e", "value": "bc0a5efbade3df89d6c58b050fa3e5ed7a23e676221ba6869fc9e011b06acb17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05985e1-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356498, "uuid": "38532cab-d45b-448f-bb05-ec8e04997011", "comment": "Malware payload (Mirai)", "value": "4ba01c00e9e1d3fe0290b9031a52f439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356498, "uuid": "2d6717f4-e4f0-46a8-8b1c-305474d95a5d", "comment": "Malware payload (Mirai)", "value": "bc73c5e109795ffe89be501a9a27ed49ff7a106d7f04d7fc1119a69b54ab9304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356498, "uuid": "ebd63810-f739-4ec8-9389-72525d753004", "comment": "Malware payload (Mirai)", "value": "e467341c431a22be250f0ae2908d411e8e980ddd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356498, "uuid": "afcfb74d-3fd1-46ec-a9b3-6211adb7e544", "comment": "Malware payload (Mirai)", "value": "28891834171eb7895f0b9c431471aa179eef8e8d063c67ef513f2cb5b76e4fee9c12a80f6a6aa01fa2aa58a9032745d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356498, "uuid": "3ac07966-810a-4024-9c4f-05b6574b395f", "value": "T1C713F15C1028F7B5C28268FDE93658E19B221F75F6B372BA13F6082D3A55E05637D032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356498, "uuid": "9b2413c7-cae2-4500-bc89-1584538a23df", "value": "768:K2AtaJ2XHMI4NscqzpTf1nAXG43x85nw1BdVwOmCikWtZkfqTB0xs3Uoz7:GdkscqFLKx3x850B2vOqN0cz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356498, "uuid": "e3676e9e-658b-4c48-9996-93a222b3bd2f", "value": 43724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356498, "uuid": "e2d26c76-41a6-4a0d-8aa3-0f5e49049521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356498, "uuid": "4d43615a-ae82-4468-8ce4-36849b7b6d7f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a54ecf2-0b9a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289379, "uuid": "14311a79-0685-4000-8b2c-74ff36428cf7", "comment": "Malware payload (Mirai)", "value": "fe0d0ca2bae43761ebff0f1f6fd4fed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289379, "uuid": "3fedb3c4-e827-47de-9060-f373a427abbb", "comment": "Malware payload (Mirai)", "value": "bd20ebbc3b15a3a05d0011ea92f3d7088ffe59b931d5f40f8a1051123bddae18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289379, "uuid": "f132b9e4-fd36-4034-adec-d21a9e42229e", "comment": "Malware payload (Mirai)", "value": "f3359ef1f15c0f04a0563cbb814b08151472984a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289379, "uuid": "01a938a6-1f7a-4e75-a314-5edfb504f0af", "comment": "Malware payload (Mirai)", "value": "b562ae2d0f32452b26856b13f3afab428790ef50b2ad767f51d2ebc98818edf71cfd8a2047099a62ee2add439a4d6640", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289379, "uuid": "ed1b4c46-5033-4799-b78a-024bb3ac521b", "value": "T145A31B52BD42CF17C5C261F6F7AE42483B126B7CD6FE3142E924BFA127868DA0E27511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289379, "uuid": "88c9c612-8108-49b6-87a4-df7e534566ec", "value": "3072:VbVXNPbe1BvqOEAhMKVMu/Pie8L7xLWi:VRXNDe1QEhMKVfS7xLWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289379, "uuid": "f184d15b-e3b2-4e50-a932-f1c199239f1f", "value": 99784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289379, "uuid": "cecfe2ca-7732-4e74-8922-34122308dc17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289379, "uuid": "13d6dddb-7ef8-49b4-8c68-d6e74086801c", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1b383c-0b9e-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771291100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291100, "uuid": "b48dd94e-2e2a-4882-82db-bf10519a7923", "comment": "Malware payload (Mirai)", "value": "65d92886c73097dcd1493f6ce3f78ca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291100, "uuid": "a93a7c86-7f8c-4b0b-b6a0-d317095a487a", "comment": "Malware payload (Mirai)", "value": "bd8edef9bdcb0919e6c219e97f645cb6201ca7f58d8bb43c76e17b0c0f6fe70a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291100, "uuid": "147a65eb-7cb0-4ac0-b54e-c2edc19e4822", "comment": "Malware payload (Mirai)", "value": "0fd4d73ed6b47a8a42a9d53178efaffe6ff2f127", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291100, "uuid": "89f81f5d-e3af-4fe9-adcd-0afcae1d519c", "comment": "Malware payload (Mirai)", "value": "172203b66fcd8f96ff4ccef560ba2de29cd798a86d6d5956b133d637ec7433a585c1923189bab27fc071d0e05356dd86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291100, "uuid": "de344fef-8575-41ae-ad9a-bed12539a690", "value": "T1D884D08AF7562D82C9EBC5340886C645575AE19723F3834A3B476A7B3C193B78F2C385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291100, "uuid": "d0263737-a0bc-49fb-a7b3-60fcd23e729b", "value": "6144:c5e9gio4ixnOlO152n000uv03PWw/kjXpG1WmDgpjmnN:oeujtZOlUYI/OXpG1bgpjmnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771291100, "uuid": "c8211cb5-f679-43fd-bb8c-784da5f112ed", "value": 382036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771291100, "uuid": "d7c3c30b-1726-418c-9b9e-5ca90c3b730b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291100, "uuid": "8846132d-60a0-44b7-b0d6-050acbddffe0", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b7a5e6-0c0a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771337611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337611, "uuid": "c1a76e17-955e-4e90-b2c7-13818fa80e62", "comment": "Malware payload (Mirai)", "value": "10ec0717e3070bfa9a7bbf563fefbe81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337611, "uuid": "d8423fe3-246b-45b0-85d2-09aa3c0e82a5", "comment": "Malware payload (Mirai)", "value": "bdf3d117dec15782117d323704d5b11588074c493c9f03a69aed7d047c4e3a9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337611, "uuid": "8507e6f4-402f-4c0f-8e8d-b9315da1869a", "comment": "Malware payload (Mirai)", "value": "bbe341f10a627e86d99ba0bbaabf9791cd4035eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337611, "uuid": "94bee64c-5855-4562-b161-540ab216cb16", "comment": "Malware payload (Mirai)", "value": "541349a7d8b07ed9e7caabce24516bee751f1c8ff040c8cb7505c7b315cde1023abfe5eb27d2fa5221f3f8e3aa4880ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337611, "uuid": "948f5b44-bd6b-4077-8fa8-689e4de06101", "value": "T10AC35B47EB408B13C4E21BB9B69F42493323A75593DB330699189FF43F86B9E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337611, "uuid": "831034f4-84e4-4a47-a5be-fc3248d9ccca", "value": "1536:yenXDYz12HE4QN4MVwPNAGsd50I9nx4ilUGjllHNiej77D+sD6++E6zw/9pl2UVp:HD6wH8oI9nx4i/9j7HfD7+hM/9plF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771337611, "uuid": "02fccb44-bb2c-4f5e-9f72-87d3f998eef2", "value": 126618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771337611, "uuid": "23ca6fdc-d2af-44e0-9faf-f53f8bbddcb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337611, "uuid": "48846958-81cb-4fa7-a5ed-a609f98bba92", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53589b0e-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1771311621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311621, "uuid": "c7885dae-05b3-47c3-805d-bae942553eba", "comment": "Malware payload (DonutLoader)", "value": "338388b8cb49473293f63fcb38b8ecf8", "object_relation": "md5", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311621, "uuid": "31f8f51e-5b9b-42ee-a5ff-2797ddf861b2", "comment": "Malware payload (DonutLoader)", "value": "be76fb5bdc4adc2fa04ba62787952410aacec4f9517d7ee8efd68dea651d8109", "object_relation": "sha256", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311621, "uuid": "af7bbc8e-297b-4463-94f0-985f19f6c71c", "comment": "Malware payload (DonutLoader)", "value": "48eb10734c70d81a60b32a070ef232bfb5ab53c4", "object_relation": "sha1", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311621, "uuid": "95da9440-9787-434d-819c-f195777bf255", "comment": "Malware payload (DonutLoader)", "value": "b76c9d5e8a6c4a0a9b37092077dfcf2a7f4fedfee20c501dbe8adddf07ce43e175072447eb0afcd60617202cf1d4f18d", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-53-70", "colour": "#F15520", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311621, "uuid": "6f10ac06-b652-46d5-90e2-be7acba5b3aa", "value": "T1EA017825B2AC1E0308F62925F6097742D98116333302782171A1D5C63FBCDA7DD1A492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311621, "uuid": "2e9fe742-7481-4d65-a48d-32d175d66d1b", "value": "12:uRfBhPhbHEzh0JkLJX8WFiyTnISV7YsWN7Wo0UqymwCGE8WlAvEic:M5fTEuwR8WFiGIDHWoaF8WSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311621, "uuid": "b2a09128-1575-453f-95d5-2c170d5ad63f", "value": 667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311621, "uuid": "bfadb411-706b-471c-a133-9a758545868e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311621, "uuid": "1984cc95-f789-43e0-ba91-37edbf433f45", "value": "be76fb5bdc4adc2fa04ba62787952410aacec4f9517d7ee8efd68dea651d8109.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b148c63-0bef-11f1-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1771325915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325915, "uuid": "9de0bb65-f649-4088-bf19-30ed8950c21a", "comment": "Malware payload (Amadey)", "value": "2f8c054ee2a843f44f11a9011435ea18", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325915, "uuid": "5f8d4fe5-3b26-419b-beb2-248e1c28ca26", "comment": "Malware payload (Amadey)", "value": "bebf78493db9f3c7bc38fe31f58b85d81305b4f7f27ee62f277dbddb4b8d5af8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325915, "uuid": "57f1df2e-874d-4fae-bddb-edcc465e8935", "comment": "Malware payload (Amadey)", "value": "2c05292411047a63f7c8155e8aec3b6d5bb35af3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325915, "uuid": "4b44a8cc-35f6-4f97-8440-a0a7f5a06c14", "comment": "Malware payload (Amadey)", "value": "60fe9fa85dabd5581a4b6d8121084c426f7f90fdab30bbc6d97837fbd381ddef5f8224e003a0f61aafd023bbb0983682", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325915, "uuid": "cb4f324a-2669-4ea1-8b6d-388af1e59b2c", "value": "T1CD871222ACAB56B4C7EAE13490345311BAB078550731BBD73798116B1E37BCF1A3EB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325915, "uuid": "b94f66c6-ff22-4ce9-83f9-69c93f66b81f", "value": "2fce425a25a9b32c4cbb333bf7e00afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325915, "uuid": "38e05c87-48c8-4ed5-a895-c0b80dafe2b6", "value": "786432:ti51FLXqrRtbVccLBSFopYy0sj8Ew2Ovkm:g51NqrvbekcoyFs5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771325915, "uuid": "ea46b2d8-eff2-4263-acc4-751a349bd87d", "value": 36452352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771325915, "uuid": "1c46f54f-de03-4d5c-852d-32c9656364be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325915, "uuid": "e57ed8dc-4c8a-4d9c-8f47-b7ff74af4502", "value": "bebf78493db9f3c7bc38fe31f58b85d81305b4f7f27ee62f277dbddb4b8d5af8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18305db6-0c0d-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771338580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338580, "uuid": "4096a1b5-a682-4f8c-a157-f3c7386dc240", "comment": "Malware payload (Gafgyt)", "value": "196d7ee09bbd8fe9e40e02039b56aa96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338580, "uuid": "7cfc5fef-5e91-408a-b6f8-4a160f06d54f", "comment": "Malware payload (Gafgyt)", "value": "beedf77d68b043aaf0c2faaa380c291bff6d93b7af992c06731a647ee92638ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338580, "uuid": "8f0e1fb8-4338-4d5f-97a3-55441efa818a", "comment": "Malware payload (Gafgyt)", "value": "d3198f81b619224d63fcae20be538b8a581fb876", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338580, "uuid": "b167f103-8a36-49c3-8014-6e879aeede96", "comment": "Malware payload (Gafgyt)", "value": "06e194a45662b22446bad8e772ddc12e1ce6c76cb5f1cbfd2cbc0725453f420ab5ae653b954953c94d778e3b2bf22491", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338580, "uuid": "8b31c035-ad21-4247-a91b-e08a524007a2", "value": "T1E9D30842FD428F13C6C321F7FBDE429C7A166F6DD6EA31029921BFA137864D60A36251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338580, "uuid": "d01e32cc-fb68-4e92-9efc-72845ce7c700", "value": "3072:eFjGjxJFemIr5CnsAo1/UOpRQ8O/6iJy:eFWemMMnsAo/Hpy8O/PJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771338580, "uuid": "11324341-eba7-49ca-946f-224f4d6f8037", "value": 131680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771338580, "uuid": "3def41bd-7eff-4b4e-b5cf-b4eaaac3a084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338580, "uuid": "86130ae9-01b0-4a65-a8f9-e30bb56f5d71", "value": "israel.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0bc1f7-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342081, "uuid": "c5c69a35-1b35-4a4b-b5bf-0dc42a558843", "comment": "Malware payload (Grandoreiro)", "value": "ec13d5526d7aef5b31a23bf97dd5064e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342081, "uuid": "33258e56-157f-47a6-8f0a-c91d3665f575", "comment": "Malware payload (Grandoreiro)", "value": "bf333de83c363a63b7591f9342a2891143091104dc149d17486f4f4397b7df31", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342081, "uuid": "d5792a8b-53f5-4df2-95b4-b91ac668edcd", "comment": "Malware payload (Grandoreiro)", "value": "d79e79a98e1bd7bf93e313523220c6a47ee0f066", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342081, "uuid": "dd7f188b-1aa0-41b1-9db7-64974d59e3d3", "comment": "Malware payload (Grandoreiro)", "value": "57340453149cf3ebc200b8a1615d1fb0ae62995257e1cc85a51ad5acf7223ac292f568425ef7067f01eaa9fa7ce319e7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342081, "uuid": "909fad48-1f3e-4102-849e-933d1b309e16", "value": "T1049633306E859876CA584379702F6B2D6E2E6B838788D1D765CC91C3378FFE1893B491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342081, "uuid": "f2f4cc50-7d93-4b39-b4bd-249cac4ab2ea", "value": "49152:y540Xhisd7Ckriz9q3pUO7jGZu5kON2JfCy0vXrSYMft9RK1jpTyD/LLF9Qo8WCY:krV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342081, "uuid": "2b6a68fa-9e77-4135-833a-7c6155187eee", "value": 9267200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342081, "uuid": "825fdf2b-0ab4-4b27-9660-e54eda133e57", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342081, "uuid": "2b33c12b-e617-4954-b213-4c3a95943fdc", "value": "1CAPZ8859_FndUNOXI-466648yspiy.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b413b73f-0b99-11f1-a129-42010a9c0007", "comment": "Malware payload (Juko)", "timestamp": 1771289020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289020, "uuid": "6cb11091-c397-478b-a5da-fa0b3a5eff0e", "comment": "Malware payload (Juko)", "value": "75cbd2a827a6390a4e682144d198ab9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Juko", "colour": "#C8187A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289020, "uuid": "378fa78e-99f1-4287-8cd6-faf67b4f552a", "comment": "Malware payload (Juko)", "value": "bf3f010ec8100d1730b9588aa9ffa35476c2d5780c9f1c5206be83e2a79ebe06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Juko", "colour": "#C8187A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289020, "uuid": "034cf538-3220-4926-be07-1a6cc8c09738", "comment": "Malware payload (Juko)", "value": "e2b0b5d33b0af58d3973e92fbdfb277366a0ddd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Juko", "colour": "#C8187A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289020, "uuid": "579d97d1-9fd9-4c02-bcbb-a8c37e6517e4", "comment": "Malware payload (Juko)", "value": "a4248f297be714024ff19136933b1f9df1cda8e1aae28a59b851e6fbfde3bf57a8dc6508b45cb9b5dae910d034ed372d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Juko", "colour": "#C8187A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289020, "uuid": "a3fe496b-22c7-4343-ad75-006db40017f2", "value": "T1FA63A0B629761011C48BD478E8186A60B933CCF53BF75753E3017AA89AB4D138FDE8C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289020, "uuid": "bfb0ca8c-c5e3-4ddc-be0d-483092238c92", "value": "170193414cc4abf0ae27dc2a19d74879", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289020, "uuid": "c06772a0-beac-4b8a-82de-67d2148ccd75", "value": "768:4ZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqGNPWQHd2LGm4a4RjF+S7wpg:0LsF2Kerc64sTiX2IV0DVk2LGmEQkwpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289020, "uuid": "3ba77d40-a6be-4f77-855a-be4aad543229", "value": 70152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289020, "uuid": "52c80e9e-0548-4df7-b098-77153d98a0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289020, "uuid": "ffb99e2e-e0d7-4ed2-87ee-fa6bd3929ead", "value": "amriw0z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9e4af5-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312819, "uuid": "843d856a-bf83-4d66-9c35-00ed7687d8cf", "comment": "Malware payload", "value": "6179c89b0427fb9ec0e5e63483270d99", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312819, "uuid": "1e7b8b4e-2e48-4054-a74a-4fe2486fcfa6", "comment": "Malware payload", "value": "bfcddc8fd3089c9e584809c038750bfae4dae8abac4e42f4f12319b3b0ae2421", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312819, "uuid": "2faf9e51-5c1c-40bb-a474-305786e72249", "comment": "Malware payload", "value": "768d55e987ced633bc270a52655d749bd175d2a5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312819, "uuid": "52b31aed-48aa-475b-865a-fdeeb436a7ee", "comment": "Malware payload", "value": "2e00526c269baff477b37f151a065c289d29b25e47fdeabccdae78b51f257528157950b5cc27e4d59e96f76e7c6bdd7b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312819, "uuid": "6210d016-bb68-4639-b58d-6fe54c488c2a", "value": "T11F363370AE611D3B05B4423AB06B6F369FBD4963C64DD6D588C8B0AA318ED94807FCF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312819, "uuid": "a5aec73a-4e04-40c8-9523-43903b695e2a", "value": "49152:pH3YjSmoDkwCW1qL3c2f8q+4InoPA7kx6HuH14yOAWvp+Jbac53wS4NMK3H/A:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312819, "uuid": "6f9cbb68-06c2-4ec8-85fb-81b6cd720a46", "value": 4885289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312819, "uuid": "3c3a00a0-a49d-474c-a635-691d583c7c3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312819, "uuid": "795a4bfe-7f13-43f5-8da0-f6ac21488ae3", "value": "245068Emision_ROXHC4DP5ZYrtlsvz0883CQMMV3M3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6214ba45-0be3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320665, "uuid": "dbbb86b1-8636-4b22-b5de-6608901af9ab", "comment": "Malware payload (AgentTesla)", "value": "9a710844942b8317b865156d00460563", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320665, "uuid": "5a51f14e-bd5e-42b7-8352-2f3b858e4e23", "comment": "Malware payload (AgentTesla)", "value": "c04fdee3b3f8855a5a8a75d65c99806e9ecd2dd7ca0cfd0e5b401f93bcae3dcd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320665, "uuid": "4aa7ec78-ba7c-45d8-972f-4346b5262631", "comment": "Malware payload (AgentTesla)", "value": "6133dc3827133837cad37e9b380c43d2c4837072", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320665, "uuid": "559598ea-8387-4b01-8045-e1d8dac21d03", "comment": "Malware payload (AgentTesla)", "value": "c25f8c5b90a4ca1a15367a923d98948ccbea5bb9b72d8ea90615112d1a8417132e136ff1dee5689c5381a1e6d08f1e47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320665, "uuid": "98b73de8-0665-4d46-86eb-693b2949a183", "value": "T1A3440E037E88EB11E1A93E3B82EF6D2413B2B4C71633D60B6F49AF6518516425C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320665, "uuid": "0329c23b-a218-40b1-8ddd-54c3797841b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320665, "uuid": "0e9b5f64-72d6-4463-a4de-3a577a8028ea", "value": "3072:6Bz4yAumu2esPywzHvYs3h0P4SPEm5xrosS/Kb:9umu2esqwzHvYWI4SPEzskK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320665, "uuid": "1c042358-11b1-4522-a681-b4f0cfaf77a8", "value": 262156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320665, "uuid": "0686442e-0591-416f-9c43-e593dc5f7901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320665, "uuid": "abda8eb9-e377-4182-ab15-fc3c76c90294", "value": "c04fdee3b3f8855a5a8a75d65c99806e9ecd2dd7ca0cfd0e5b401f93bcae3dcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b4903b-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343104, "uuid": "a77227de-54bd-4b45-91e1-bd087e6620f0", "comment": "Malware payload (Grandoreiro)", "value": "83e8bc7f85af10fac07c7ab030ba3497", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343104, "uuid": "233fb699-98f7-4a32-b70d-b3539ed7c3db", "comment": "Malware payload (Grandoreiro)", "value": "c06683136ffa148c70fe62663b4d80b4a607165ed95594fa0da36eed0c36125e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343104, "uuid": "e71900f5-d71e-4b20-ba65-f2d774174ecf", "comment": "Malware payload (Grandoreiro)", "value": "ff81a6d974d6ea343f1a8b890ad2ceadfef69d6c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343104, "uuid": "ad4d9fc1-d891-4eaf-88ec-33e4b58b7742", "comment": "Malware payload (Grandoreiro)", "value": "ed5eb5a46c8ea4d8034b673b0588fb7d11340db70fb1619882348334fa7e39d0d47cb6a46fe75ac631a3fe5befcdaae5", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343104, "uuid": "1cd3af0c-d4d9-4ea1-846c-0be4b6167d90", "value": "T16E7623307F94941FCA408336742E7E301F3DB763898AA5E5B89DA1472786FC19B2F895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343104, "uuid": "4e6982bf-e306-4556-be98-26495ae4d98a", "value": "49152:bu1Id/ZhMkPDTJXmIRrJYpiJGGamCLXkwVtnXm3O0uD4PCc4yi/bcRRrGOb/wzg4:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343104, "uuid": "18b176ae-ffef-4a9b-9616-9be5e302199b", "value": 7643136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343104, "uuid": "b586da4f-0e2b-44e8-ad12-7c507e8cd948", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343104, "uuid": "cfdfff95-5ef2-4015-b01b-a4dac279ae7e", "value": "Bal-An04UAI4MODIPV186214_8J1OH.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c863f863-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343171, "uuid": "b379423d-4634-4195-85d4-b65e9a5b8c8f", "comment": "Malware payload (Grandoreiro)", "value": "9d7687de83a9eb0e9df7b315ed9f7608", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343171, "uuid": "568c192d-abf0-4299-a8e3-95b41771ad28", "comment": "Malware payload (Grandoreiro)", "value": "c0b8b0b29cc684e13811c09c0befdc1628dc64ecdb91636b2165d466e9aae8f1", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343171, "uuid": "ccf012c4-713a-4040-9e5c-3a3958cbdfd6", "comment": "Malware payload (Grandoreiro)", "value": "b6002ac33a63bb7c1f31d37e281c8e9898eaa8e1", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343171, "uuid": "f2374ccb-e2df-4e62-b15d-bd9bfcce60ea", "comment": "Malware payload (Grandoreiro)", "value": "9ed3b915e4c7e22fc6160b1971648adfcbbeb1976323e39f153b267004c046e822538febbb3d4ea64a7135f01cc554fc", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343171, "uuid": "5eb575ce-463c-4bc8-8987-02a2ac54db57", "value": "T1EB763330FA516C25C8D48772713E7F351E3D3A1344CCE2D6299EA2876382FC6976AC96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343171, "uuid": "2cdffa6c-d48e-4231-9df2-24deb9be13b4", "value": "49152:Jpuc0GrJVONbtHQZpdpHnQDNfiw5jAKwDMt5hIZuzL5EhV3E2D0jiRf6BEzZWdrK:fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343171, "uuid": "571cedd4-6170-4ef4-82e4-24ae28bd2c67", "value": 7682048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343171, "uuid": "44a61204-9a33-4288-9cbd-f4b34a776ee6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343171, "uuid": "f402f9d9-701d-4eb9-812f-73e84846b29f", "value": "BVXVRMDict-73188JIQ3sdyd.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d4cc78-0c31-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771354286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354286, "uuid": "bc3ac08b-47e6-4aab-9e87-8a9c73b974fd", "comment": "Malware payload (Mirai)", "value": "fd23155e8cfff6a59b9d494c427f467c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354286, "uuid": "b467228b-ab76-4cad-88f4-810e1f0de775", "comment": "Malware payload (Mirai)", "value": "c0f4578e9139e9bb1a7cf24355f33a9d142ca7f981c890940955f493c9d72872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354286, "uuid": "cceceb3b-d978-45ba-8768-de9618cb8eca", "comment": "Malware payload (Mirai)", "value": "aba86052fd66e0fafc1405237ad132b7f6ce0787", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354286, "uuid": "c0548b5b-6991-4728-a584-07154b2aaaa1", "comment": "Malware payload (Mirai)", "value": "aaf80d0ca99d8f8875b0255f66233ff51457094889aee6d1414d721e1a1c61c03792574ffde0546676df2690ddad474a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354286, "uuid": "1a77eb09-2426-4f0f-8145-feffb0d8770f", "value": "T11F534B47FC818E11C5D506B9FA1E218E3313536DE2DF7212AE249F6137CA92F0A7B856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354286, "uuid": "0ff65756-f401-4dba-8ca9-3f902feb600a", "value": "1536:ZenjKRIgnz+2oWTdNO9gSM9QFM/i8jVF3QOr:MaDn5hjVF3QO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771354286, "uuid": "eaf6c4ca-d134-4d9d-ba97-c339c4c25be5", "value": 63208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771354286, "uuid": "b1f20f38-4544-4ce3-ac60-62e656bd1a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354286, "uuid": "21add498-01e9-4040-859e-db1171c24f9f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33ef43f-0c0a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771337552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337552, "uuid": "8f0cdb98-c84b-432b-a5c8-43df03c7c87d", "comment": "Malware payload (Mirai)", "value": "7cc6d1c2f9983a97aab169b3ea5022fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337552, "uuid": "30f1b7d8-aeb1-4b86-8e44-2e0a180b5f19", "comment": "Malware payload (Mirai)", "value": "c0f6ed8525a832abff1ad8bcc50760b8d544918cb86546bf25efdf305f90149c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337552, "uuid": "1d907430-ad5b-4cd1-897c-3137b169d49d", "comment": "Malware payload (Mirai)", "value": "51a8401a265b7de051f187f3da2018ebf7e159ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771337552, "uuid": "02377892-7901-48bb-8030-5e3a28c81ccc", "comment": "Malware payload (Mirai)", "value": "949b64acff508b4b68482eca717cef95e958f884a973b592547bb26b3c500b4233656a4d1a52a5fc44bccd355a772c94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337552, "uuid": "56afc954-0003-4faa-a9a9-69ef3cc979c6", "value": "T161B2D0203179A6B0E37058317C65C981B7B78DB92E9D37267A6487F8B1D651E30F068B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337552, "uuid": "40240de1-da2e-457f-85fa-38a6422d6fb3", "value": "768:dGj3t/wQy40t4eclTXZ2K8F/8yAs3UozE:dGzt/wQkMTp2KC8EzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771337552, "uuid": "1427ab84-f22e-4154-8cce-e244a777565d", "value": 24744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771337552, "uuid": "5936c07c-06e8-4112-825e-20b590ba5825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771337552, "uuid": "b618b2c7-cd9c-4082-8c6c-3e983d3e6774", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec80863-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309009, "uuid": "6ec0fe00-7829-4d69-b1da-66eb271120fd", "comment": "Malware payload (Mirai)", "value": "4108a34c6ab025487a3bc9e18db42a7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309009, "uuid": "68a62a01-322e-4dba-b3a0-c70a9dddec14", "comment": "Malware payload (Mirai)", "value": "c1572b0f7e550ad76061af9ed0faac6448ff222d60e83bac7ecd99e7224b64f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309009, "uuid": "0c6c995e-04d8-4af7-9068-226545bc3ece", "comment": "Malware payload (Mirai)", "value": "27fb8917757a426a7031cd3bd3c3fb3dfaf5ee6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309009, "uuid": "8f26333b-12a0-410f-9b5c-5b608a4de1d9", "comment": "Malware payload (Mirai)", "value": "999f7f06b32d165da2ad05fdd2e18a4a8e3df0fa761237ffcaab267360caead8108c0a9aab33d1f11943e1f3d04fea8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309009, "uuid": "ba0aa88c-e7c4-4f21-b282-f9cfd757d7e7", "value": "T1A1B2D0A9071DB4B38774AC36E82E939181FB2FB441B37424523096A8FD9340E61BD69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309009, "uuid": "c7a1a646-5fff-4ed5-9239-75facbcfdb38", "value": "384:NhV1t7qE2VmiU9UvPuNu9qxxtvH4SV3fKMeZyXyxE7SwTIdu/rhymdGUop5hO:zTtMmmvPuA9qrtwEaZyX3S+/rs3Uozw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309009, "uuid": "1e6fe7be-8f0b-42a5-b242-0bb8957c87d2", "value": 24736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309009, "uuid": "1bfc5126-a396-4b55-9c43-1ccd95186b0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309009, "uuid": "4a0b517a-62d4-452b-8172-c8fa23959959", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be66a99-0c10-11f1-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1771339955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339955, "uuid": "0f89f7d4-fe04-4b72-ba81-0a4e04f37af9", "comment": "Malware payload (DarkTortilla)", "value": "3f627de3426c762529450564803dbbe0", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339955, "uuid": "3c8b6274-f6f6-4352-9498-f85c1eecf2f9", "comment": "Malware payload (DarkTortilla)", "value": "c1631ae162f5eaefd7839ec215095dca0bab9bea585d74f93e5c61743cd662a4", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339955, "uuid": "55fda56c-b195-4e59-8e89-338453bd8009", "comment": "Malware payload (DarkTortilla)", "value": "6e9471705f1e4d2d662b492376284118e48113db", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771339955, "uuid": "8a0ba5d6-42e3-4cf7-a281-681e308d03e0", "comment": "Malware payload (DarkTortilla)", "value": "440eb790104c47131a26a1c09e82398162f6282f19b8ce5c36154887644e22b79817218a123386ea8ce960f5efcc7f8b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339955, "uuid": "ef0a6648-cfd2-45f0-bdfb-b76408a7e626", "value": "T187F4F1322D462A14CA791FB8C066109977F0C8572266E76FAFFD01F46DB3F48C9272A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339955, "uuid": "5728bfcf-42b1-430a-afe1-1cd3950d492b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339955, "uuid": "6d76fedb-4003-4703-8544-4a04b461f68e", "value": "12288:xv8pFycCr6GszIMjy1j89CFnLT/N0HPNI0iAxxrKXBxoo1C7Yzuw+HIJblNB1:1aFmhpLT/4PPH7caoc7Y/+HIJblNB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771339955, "uuid": "8a1fbff0-94f7-437a-ad68-89a06c6c6bb4", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771339955, "uuid": "0fc93e22-f5be-4368-9263-78a795e5a0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771339955, "uuid": "bc5864ab-fbff-4c27-bbe6-96655d58093f", "value": "PEDIDO DE Quirmex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfe08ba-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341673, "uuid": "5084d07f-886b-4bc4-a9b5-ebc0e6a2d96e", "comment": "Malware payload (Grandoreiro)", "value": "937d0ea3059ed1338d215463daa4d3f6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341673, "uuid": "8f046bc6-5ff3-47c0-a320-2eb64b0f9fd4", "comment": "Malware payload (Grandoreiro)", "value": "c1833f5d6d732e24c83c931103adf60c057d541340288d9ee920213f91be065d", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341673, "uuid": "99bb4382-bc31-4f3f-a2dd-d42fa8f0a0e9", "comment": "Malware payload (Grandoreiro)", "value": "6e1e27248e935bc8cc0d765fe919eeb795899251", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341673, "uuid": "5c867f87-0dc3-4ed8-84e1-cde9b6b7cb27", "comment": "Malware payload (Grandoreiro)", "value": "d4d5c6871743d7498918fe3f965d9ac9786d10cebb85389a6e275e0e56ab78e7f8a0572ba5382f0c03612fccb0320a88", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341673, "uuid": "47263c68-5aa8-4ce9-ae93-43261305b3db", "value": "T1F8663330BA05AD66C5810379B13FAA316F7C7B138588D5C0BD8CA1D36B87EE6D62F446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341673, "uuid": "eed5589c-b8fd-44b9-9ca1-8cdf1f1eb760", "value": "49152:FGo1Po8Ji25ynTqRQQ2+DPPxniUeZ9Q27yFATnniIE5CnmJdmTboCJ6meE/YBcuV:Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341673, "uuid": "3111f610-8e99-40a8-9b55-f81ac8c6d85e", "value": 6569984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341673, "uuid": "0c8b2def-0969-4b71-81ed-45e6a13dac82", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341673, "uuid": "56579516-5f9a-4ace-8464-d7c48d0895c3", "value": "0Mov6913-UHSRN33M163804GSZF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b3095b-0be1-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771319926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319926, "uuid": "e1900996-411c-4739-870a-2538384c3369", "comment": "Malware payload (AgentTesla)", "value": "56138c2e2e4cd48e55b68b349a9f9b49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319926, "uuid": "33dc6a83-b9a8-4a3a-9125-4ca0a86658c1", "comment": "Malware payload (AgentTesla)", "value": "c1ad17b75795d302605ede9a90f7d324172165d088330e38029dd4d9443f8c78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319926, "uuid": "9232ef67-49ea-4294-8076-23445e733da9", "comment": "Malware payload (AgentTesla)", "value": "0cf14f9fd0cc562ceb58ed1855cdf38f961176a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771319926, "uuid": "dca18dd3-256b-4c2b-9649-b8780659035f", "comment": "Malware payload (AgentTesla)", "value": "a8dc2e449e37aa236b235dbe5072c8c721791bf3723e3301bd77707ecc7c61def36460bccfa217cb913e1e3c87a457a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319926, "uuid": "9d80bbac-663d-4c42-8b53-57695d594d22", "value": "T1911523C4BB16BFBE4969930AD82F5E285E21D01AD91DC9DE78CE90890F7DF58D12EC40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319926, "uuid": "7e1ca7ec-c82f-42a6-8ec0-99045ff3dbab", "value": "12288:dyiYrj8ejVZjFHEENU7b79qHekGzyiBswAcmlT49kNNTUxeT8HBDLXLBEQJO4F1D:dyRhkz79qLGzyxHl09kNit1XdLnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771319926, "uuid": "aa90e9d2-4510-4381-901d-92ff5b18c768", "value": 912984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771319926, "uuid": "14d2eb4b-c71a-42e8-a73c-99ad87e8417d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771319926, "uuid": "5a6ba681-a328-4ab2-b5b2-410816944dad", "value": "c1ad17b75795d302605ede9a90f7d324172165d088330e38029dd4d9443f8c78.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc75189-0bfe-11f1-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1771332419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332419, "uuid": "5c654284-23e6-4bbe-b104-b2da067612a9", "comment": "Malware payload (LummaStealer)", "value": "abd7d0e39c7c8d7a3fee754e2b362a3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332419, "uuid": "eed7b169-ed5d-4319-b0b7-f35d607899e7", "comment": "Malware payload (LummaStealer)", "value": "c234f5fc2394f9a5a0dcaf93a065dc31f594e0f79b2629110702ea1ec66f6cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332419, "uuid": "9727986f-f561-4c66-8daa-9d3d33b60897", "comment": "Malware payload (LummaStealer)", "value": "db14ec70382521123f8b49d64c7952d001521f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771332419, "uuid": "e450ae01-af80-4929-9a0a-afadbd9d2e01", "comment": "Malware payload (LummaStealer)", "value": "b0f1f9040065d89bad3a08f8f9218d5ff56b5c0cd6994bd90231236928014e4a611de4f115d405c7c3a1efb2d7e0a3c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332419, "uuid": "cf34d780-713b-4d94-bee6-da9e7bde5eb9", "value": "T148E59E7156ED0612FC9F2274C5FDAA317AFBB8999AE0805FB78C155E0C248036F36726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332419, "uuid": "f119586e-3c06-4cae-8ab6-44efe4c59b9d", "value": "16dd91f6de3d26369b72af7ff0acb432", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332419, "uuid": "29b58c90-4302-422c-8313-c0d077002780", "value": "49152:qe3ZHW/NMknb07m+CYOuwOWmeunnKKL3QPXgurIUhUJFAXS3RC13:LpHq07m8OETnZL3s3r5hQA6Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771332419, "uuid": "217ffa75-20a1-4195-92f9-fc576a9094ad", "value": 3253760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771332419, "uuid": "d6c9f5fd-636f-42e1-b805-998d2067958a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771332419, "uuid": "d18d109f-87b3-4960-9c6f-210d06a49fb0", "value": "SecuriteInfo.com.Win32.MalwareX-gen.44561468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55faade3-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309048, "uuid": "42141448-1f0e-4efc-bd82-648e85812a97", "comment": "Malware payload (Mirai)", "value": "117744ff3a02bb2520e87100c1c82ed1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309048, "uuid": "1c1901a9-f357-43a2-bf66-ec4e3a649fbc", "comment": "Malware payload (Mirai)", "value": "c3492e4304eb0f4024a3713f193df1e74c1d198cfe0a19e53a6c33714d173ffe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309048, "uuid": "741b1f28-d93c-461c-a2c2-bb94dc7372c8", "comment": "Malware payload (Mirai)", "value": "acf81894802d8ea99d25301e4f34e810de16e0c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309048, "uuid": "77723e66-9f7d-48cf-8141-478a5e67cc62", "comment": "Malware payload (Mirai)", "value": "2d978cd76ffb6573c59c7ad8bb9b7930e894e27d72501ce0b5a8f6baacdbc3a666b9aebb13137f22bfcd7b62d131a7a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309048, "uuid": "e24390b1-5285-41a5-9e69-9d719fd7b864", "value": "T19C331986FD81C916C9C417B6F62E11CD3B2623A9E2DE3203DD156F11378A91F0E7B991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309048, "uuid": "6a94d4d3-ea6e-4f8f-aa24-416a21ae8e2e", "value": "768:L6OUWX14tjXrDl155tzxG9HJdKA2sDci0GAO1qrPPh4P8OHGRNIpXdhZe4U:xUWl4tjp5FxGRH8O9tej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309048, "uuid": "8f85592a-f409-46c1-a5a7-3693e7008f78", "value": 52060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309048, "uuid": "e6a88628-d2a6-42e0-81db-aa00d442f8c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309048, "uuid": "52b5c364-9859-40a8-a5c4-f0c0f91e773d", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b537d5f7-0ba3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771293317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293317, "uuid": "8ac6ad4e-0d8a-4e2e-a8ad-328c1d9e85d0", "comment": "Malware payload (Mirai)", "value": "b9b6c52ad1194eebffd83bfc2e36d7a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293317, "uuid": "a4a0e9ff-876c-471a-88ba-8fbf3953bc5a", "comment": "Malware payload (Mirai)", "value": "c398b45e5f6d4905ba4da1b7b89dc17063c11951d2fdd4749d7f59971f447295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293317, "uuid": "05b207cc-7a7b-43c0-ae8f-e0fa7ba8f53b", "comment": "Malware payload (Mirai)", "value": "8a618ac23a8c79d610e0c0b22b45fe85867a90b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293317, "uuid": "ed3e79e3-37d0-475f-bbb6-0a741522446f", "comment": "Malware payload (Mirai)", "value": "d5fe0d6d222b5311676830079e94ed8ea6aab93e481db2a366cedda2c4bdb21273432be8c90c59fb4a0588ebb15d55ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293317, "uuid": "8a6f91bd-cee0-4fa7-b011-b94e8cea651f", "value": "T14C73930ABF650FF7E86FDC3789E91B45248D641A21993B7A7D34D818B24B24F49E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293317, "uuid": "0a77bed9-c754-4c4e-925b-e75595aad3c6", "value": "1536:502Vu+dSmTBJRc4gRGUUp7gpsDuPSwteQHBz:57Vu+dS4BLgRGlpaeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771293317, "uuid": "db2bfe0c-fc96-4ec2-951d-bf3d0c7012e2", "value": 79868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771293317, "uuid": "786e2aec-89a4-4760-a231-f0ada59e8527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293317, "uuid": "1e6f5a29-b007-426f-8270-b559b0a41a5a", "value": "mirai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153a1c48-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352319, "uuid": "0922e453-ff52-479b-bc9c-16948323f699", "comment": "Malware payload (Mirai)", "value": "acb49fc957ab9d933db433f06b3c833a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352319, "uuid": "496ac289-3d43-4318-a13d-04dfad1a8219", "comment": "Malware payload (Mirai)", "value": "c3a2f74d49b31dcd4d4371d965e5c39448acf8e2f87afe469f105fc9ae7c9a92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352319, "uuid": "f4ee4733-901f-4ca4-b2ba-1445b30b84ee", "comment": "Malware payload (Mirai)", "value": "9dee086c4cc913ff3975fe0b073c22ef0e4b9cfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352319, "uuid": "879db981-b5f0-437d-883b-8780c4b45a8c", "comment": "Malware payload (Mirai)", "value": "c1460169d8fe7d71fd4cf888f7fcd6f86b55f265c926bb3c0d3524e5b9fcaa4f34a0c8597a9e0bdab1272f64df023f4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352319, "uuid": "5b676a7b-9c58-4d57-8f36-569a442ae8c7", "value": "T1C9434DD6B400DE7CF94BEB7A84214A0AFA35722154A30F27B267FD93AC721564C2BD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352319, "uuid": "e46a8d7e-57de-4825-b90d-81285751985c", "value": "1536:T5cgor9Y1asetylPku+zCkVnCSQDVY0dI87:d3GssylALxuYS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352319, "uuid": "385f305c-d741-4aaf-b125-0621cb12caad", "value": 59724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352319, "uuid": "e4637a07-8744-4e24-a96f-0f5d66f539b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352319, "uuid": "9cec1f84-8174-466c-bfaa-103a16a1abfd", "value": "mirai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37e50b4-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (ChromElevator)", "timestamp": 1771313071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313071, "uuid": "945e542d-8e00-4121-bd59-463d34b3a564", "comment": "Malware payload (ChromElevator)", "value": "341e15abdad95441c6bcd3fdbe806154", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313071, "uuid": "21108397-5bba-4634-8059-2cf6fbd0f365", "comment": "Malware payload (ChromElevator)", "value": "c3ff6d497e1ffc65a56577afdc64984f61542faeeed6beb0a957539e48ee86ef", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313071, "uuid": "fe3e7e21-8122-4b65-a95f-a5abb7f96f16", "comment": "Malware payload (ChromElevator)", "value": "05711e07eb6fab831dc18746882d52204092b9a1", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313071, "uuid": "1bf8679d-3993-4430-86e6-44ad93c7935b", "comment": "Malware payload (ChromElevator)", "value": "9ea23f2f426324814efb2885d9208db287216fe45194eb5f610e5966cf0220282faf2204c55717c9ba36d3e30ab4fd0e", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313071, "uuid": "cc170182-45e5-420c-a492-a1e6ad372de4", "value": "T1C3A6D75FA3D003B914B26214E58E75BEF312C47C5322D2382E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313071, "uuid": "ae1a5cac-c574-42ba-a368-b6f59bd16f8e", "value": "49152:+K+8DxihRMC5SCdxeUCEKsupfHn2i0WBFsL0lBPIDts71CUxWdNeHnaaqDdoFNls:3Py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313071, "uuid": "dc33b7ca-3c54-4b6b-9de7-bdc06cb2b9c9", "value": 9762401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313071, "uuid": "6a3f87d7-b60b-4e88-a226-da83efe9a11b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313071, "uuid": "0ffd7059-b30a-495d-96d9-f898fb3ad83c", "value": "nouveau_curriculum_vitae (4).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412e22aa-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342085, "uuid": "8349c7d7-473d-403c-9d3f-e1edd3b0df20", "comment": "Malware payload (Grandoreiro)", "value": "7dfe6560eb44c650a44efc1e092262af", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342085, "uuid": "8ff3f869-aa68-484f-970e-179cbfc86ea2", "comment": "Malware payload (Grandoreiro)", "value": "c4656ac5a1f8036a228a10ac5c497f3fbc6f077f4a8a7c6f9212183e277fbf15", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342085, "uuid": "0cfdfbba-94ab-46de-a535-ef17fcd21955", "comment": "Malware payload (Grandoreiro)", "value": "dba708fa69d42e05d913d6357590a8c716054d26", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342085, "uuid": "63d0fcc7-b76f-4d65-912f-dc06a45bc843", "comment": "Malware payload (Grandoreiro)", "value": "b9d374422751db8a232c431734061c8c9bfed50f2985933e72a9cf82b323d550014883259cba70b70558c3f6db597961", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342085, "uuid": "52903565-279d-4d5e-ac07-17169b25cefe", "value": "T1AA762332AF25597BC644C370706B6E110FBEBA57C78CD2D7748CE186374AAD1893B0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342085, "uuid": "527f9a25-8b2d-4540-ac6f-15e009adab52", "value": "49152:meD6ukGbBgZtaCkrHs0OW7UFvzR/S3AK5H6pOfD2zEDdsVqoiTaGVbWpJzBAmHAu:uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342085, "uuid": "4b021aeb-c416-46d3-8c51-ce076002c0de", "value": 7176192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342085, "uuid": "3a26d968-5ca7-4e91-93c8-1eb950d39827", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342085, "uuid": "c082c0b1-f912-4064-9ac8-1976ccda7e23", "value": "1K339X974627_RmbKOLD-313090ftyij.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21e301d-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353897, "uuid": "24a8e2e8-fcbf-45b4-9738-677827d51cad", "comment": "Malware payload", "value": "aec65b5f8501bc0b60413e0ffd451b04", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353897, "uuid": "1c9b9dc3-3aa1-477b-8eaa-a83732932ab8", "comment": "Malware payload", "value": "c46953cbc35b20f05689b3add134e34972519ab394314fe7b978a2b651762ed2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353897, "uuid": "b3a826c2-2ef5-4730-9ee7-3ae75e01d89f", "comment": "Malware payload", "value": "b18fc10efa477ebbe64f0a02313b5d9978ee5973", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353897, "uuid": "1fd72598-9f0b-42f1-9982-478b70122c36", "comment": "Malware payload", "value": "e9b1149ca4deb628b203e3620349614305b60e47930256f82d18cde756d2039f527dc618fe451468b840295f18cb3f0b", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353897, "uuid": "0bdaa656-68b9-46fa-905a-2095c0e5e6d8", "value": "T192B633335F911C77C5944335B06F2E192E2C7A038ACDB6D763AC59CB3B8ABC4582E469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353897, "uuid": "d1d5f44c-3394-4e65-b290-9744f6bd621d", "value": "49152:m+opOkPSd9a3EPcEhMWNX1/HAuGLbHlSq5Pg8aJ4/BBob5pPqhGJZcYNIhp8gUOf:1h/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353897, "uuid": "b7181aae-6e58-4732-908c-8dec392889f3", "value": 11456512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353897, "uuid": "2280fa1f-0bd6-40a2-8a4d-335045c4e99f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353897, "uuid": "2bee6167-ac81-43a4-abe2-34a3bc1c3e6d", "value": "Slct760011OCFGY1K995E_87268sdtyax.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac76d5f-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353858, "uuid": "68463ef0-758f-4f1d-9198-bda9a91a840a", "comment": "Malware payload", "value": "f5baa955959279b989f058e8e0eb90d3", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353858, "uuid": "ceae396a-3dc1-490f-93e0-50aefafb06bf", "comment": "Malware payload", "value": "c4fc245ace6b957c78194147c4db7fa3801c2c926fb1112045700f2b9b1460f5", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353858, "uuid": "a65353d4-c046-4a5f-984e-631dd5ebd687", "comment": "Malware payload", "value": "ea2db703d87513119f6544f9de38358610c2ff16", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353858, "uuid": "85d1bacf-dec7-4981-8675-688da5b23a09", "comment": "Malware payload", "value": "049d0d301a97f495bd5ea4d69700b580b43012c4ba13ccbed9ae165e305fff463f588a556a1d63e8e5f5d82417df5a82", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353858, "uuid": "8ed205cb-bea6-4c1d-8b82-cf6a6c077bb1", "value": "T14A6623329E550C2BC7944339701F6E25AE7CB943C68DE4C635DDE1863B4BF80A92F9A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353858, "uuid": "200768d7-feb7-4c44-b56c-e0e6aadd585c", "value": "49152:DbXi+X1Af70aQXyIAGfZM7rd7Bwr0CyViCbV8Gpi6TSmXFoigjZEWGjPa5f0vhaF:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353858, "uuid": "4f2dc705-b26b-4236-8938-fcf57babaf56", "value": 7104512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353858, "uuid": "b20d2eca-0e43-4b9f-9f29-24e6663cb533", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353858, "uuid": "ea556cf6-5f49-4026-aa25-67839d91da52", "value": "Rslu4137MTTH_ULRM.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2455c8-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343234, "uuid": "84f29884-a255-4f24-95db-ae9d87f8fa99", "comment": "Malware payload (Grandoreiro)", "value": "9e8e5d7f78bda17d059b2d6f744e1f3a", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343234, "uuid": "1f954d77-d7eb-47ed-8677-0507b1aadb88", "comment": "Malware payload (Grandoreiro)", "value": "c5950043e9a1047aefc20a2d0f5a19b8393770b49fc22941c6c77287ea4fb0df", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343234, "uuid": "92d7354d-1281-4957-b496-887fc8d47233", "comment": "Malware payload (Grandoreiro)", "value": "d315864b6e1630efaefa6db8db2957863397fb31", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343234, "uuid": "39f1ea0f-586d-44e0-9f2f-7baba06bba9b", "comment": "Malware payload (Grandoreiro)", "value": "d47039d6fce02b32642cb9721ab655134042a698ebeb82e188f5d30ddbf62b53fe7988dbfa6f8e48401ddf5680a04e51", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343234, "uuid": "44991f27-61a5-485d-bc98-b55ce3774d13", "value": "T133563332EA445C5FC690C370B52F6D3A7F3D7623548CA5C53C9C929B3B82B92992F891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343234, "uuid": "ee170954-e5a6-4360-bbb3-0d42ebca188c", "value": "49152:GMQQV9EPbwrz+vRiA7Usj8HrkxvTdyJgNjHISZ0Fhpoq7bJ44taQCwbCYw/pxv60:cks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343234, "uuid": "fba1c605-e4ef-4915-a23c-0696acaebfaf", "value": 6283264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343234, "uuid": "1978fa28-82ae-429a-9925-d3c40e99e1f8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343234, "uuid": "162f578c-b0ca-422e-86b6-9d08cf6c7fab", "value": "GQDQY9391Deb-2UTD3_Ha50934.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c132ff9-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309005, "uuid": "0bf29d8b-5e1f-419d-9f20-28dd9965b23c", "comment": "Malware payload (Mirai)", "value": "e6db358b3a2425c39716d578c9ff536e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309005, "uuid": "6f8ee538-e3ce-4f85-a504-fbd5726aeee4", "comment": "Malware payload (Mirai)", "value": "c63f8b81f0b95f5f88edb6073f725d3ef16fb1140755dc52f4f29eda21c1b5d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309005, "uuid": "c6bfbad0-4aaf-44a5-b1ac-964c0a22dec2", "comment": "Malware payload (Mirai)", "value": "dbdd7e10aa1a6dd79a7fea6a11e4ed00f83fdf35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309005, "uuid": "00b64943-3903-41f9-842e-ef297cbf4141", "comment": "Malware payload (Mirai)", "value": "3fcd8cd6df80469fbb7da24dfd708b7ce0090e5a3e20152d273a26e897ebbf2f9d377bdc949c71df267ef7178f4822ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309005, "uuid": "4d3d7387-f1c6-446b-a3b4-797f82c4aa7a", "value": "T17992E0A6144898B1D231493E6E74C2D3AE6F1779C09E342109D941B9FBE21432EFE2D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309005, "uuid": "f94c5fcc-13f2-4e74-b91c-cb70e16d04ae", "value": "384:zoMoni/wBPt7fCJZ0Sy/GoGguVJ+zM8T0sfT63XK96hymdGUop5h7tl:YngW6JaSyOJg7T0xs3Uoz9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309005, "uuid": "cdcfe604-cfe2-4aee-be38-49351c0fc396", "value": 21216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309005, "uuid": "28987958-8ea4-48b6-ac01-3e388f1a52cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309005, "uuid": "501536b7-dc61-4860-a68d-e66b04c32e62", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e10ea0b-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (NGate)", "timestamp": 1771342965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342965, "uuid": "273a342d-b573-4c01-8e28-2888ac50ae33", "comment": "Malware payload (NGate)", "value": "57a261d751f6163cf7992c3c230a2f93", "object_relation": "md5", "Tag": [ { "name": "194-41-113-221", "colour": "#F70472", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342965, "uuid": "4c0cf46c-5f3a-42c2-b0b6-8907a8243023", "comment": "Malware payload (NGate)", "value": "c659454dd6ed62bc7a0c9e0455297e41ba57b0b7935a826150c1f8c0db6f89d2", "object_relation": "sha256", "Tag": [ { "name": "194-41-113-221", "colour": "#F70472", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342965, "uuid": "2a57bd18-f3fe-4d32-b13f-056865450625", "comment": "Malware payload (NGate)", "value": "696fa04d619115e34b038d7908e29f5f46dcaefc", "object_relation": "sha1", "Tag": [ { "name": "194-41-113-221", "colour": "#F70472", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342965, "uuid": "512e1a01-5bff-4ca9-9eeb-62bc19222094", "comment": "Malware payload (NGate)", "value": "7731271cd0922d030b55a76023c350984a46342889011a1e3c485fe01a9c06374fde70d2f79359448cf6dba248803b9e", "object_relation": "sha3-384", "Tag": [ { "name": "194-41-113-221", "colour": "#F70472", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "NGate", "colour": "#F2696B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342965, "uuid": "69a2ffc4-e624-488e-a1d2-9580f1757fb0", "value": "T1DF26F08AF729552FCDB601320DBA577126634C868D87AB037948772C697BAC80F5DBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342965, "uuid": "88bb8a63-c8d7-47d2-aded-dc8405dfb51d", "value": "98304:NsmE/IiQepDdVbCFdpZ2icb2xu+9MiCDVCt3QM4D83E2z:NsmEQOVeq3au+9CDfMzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342965, "uuid": "c6120d9b-b9d2-4f93-90b4-4f5955cc694e", "value": 4468337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342965, "uuid": "cfe69051-273b-4b2c-9142-fe11e698bd87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342965, "uuid": "251b78f5-0609-433f-ac76-0b41fd376161", "value": "c659454dd6ed62bc7a0c9e0455297e41ba57b0b7935a826150c1f8c0db6f89d2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6a5522-0c25-11f1-a129-42010a9c0007", "comment": "Malware payload (Loki)", "timestamp": 1771349108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349108, "uuid": "3e49c85c-4743-4ba5-b034-dfa1c6b62ab8", "comment": "Malware payload (Loki)", "value": "110fcc47762de4eed5f1418d09e1e1e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349108, "uuid": "006998d6-1aa3-4cf7-9b56-feb06518ced7", "comment": "Malware payload (Loki)", "value": "c6df74426be4447e6956ec541c65e8a3dbd7136fb86c1a173ef336110d985c22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349108, "uuid": "5f676eaf-4033-447a-b883-f7fcad013a03", "comment": "Malware payload (Loki)", "value": "cf1f1dc38203971e84fd4fb135429a140c6a547e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349108, "uuid": "38173b2a-cf8e-466d-b14e-40798e670b75", "comment": "Malware payload (Loki)", "value": "6c7f89d838140b9d878144fbe83b150ec1f61242f0658e01efe1cbbc9eb59f413e5c53251582662a6f5711c0510d6b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349108, "uuid": "faa5957a-5a78-443e-a4fb-a31b33a1e25c", "value": "T11DA32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349108, "uuid": "a52354b0-747f-43b7-9f35-e1451537e1e8", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349108, "uuid": "bd0912b6-3b54-4fa3-83ff-f4e6e121b0ee", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349108, "uuid": "6cce7d45-bb37-456f-98ca-cd05385fb1c9", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349108, "uuid": "f8c26c75-6bf2-4526-97c7-d8242c4f9d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349108, "uuid": "f8f749b8-2979-47db-ba98-aa0e4b6e541d", "value": "110FCC47762DE4EED5F1418D09E1E1E5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13e983c-0bf8-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771329791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329791, "uuid": "dba633fe-d7d7-4949-aba0-207d8e046632", "comment": "Malware payload", "value": "e43bf657000660eea81c046eaa95c243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329791, "uuid": "bb27d13c-c58b-4e4f-85bd-664865d5e6ad", "comment": "Malware payload", "value": "c7481ec66509e95c5de1e3338f4a95e48048bf0bdd623a2c3db17e221386fe09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329791, "uuid": "816bc279-ba87-4d66-9155-93aef4c275df", "comment": "Malware payload", "value": "54bc0462f0bca1e20584cfa5aa2d8f9996fb5a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329791, "uuid": "73742f75-55b8-41c5-ab28-2b629c8544ae", "comment": "Malware payload", "value": "0b15d795fa48db2e4c5312b198279dadfde03250bac4f6b101298a7bae0c8a44759cf2e123d789c51afade8e869f39cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329791, "uuid": "5ba9e2ac-2095-4c48-ba17-5a2eaccea0f9", "value": "T119259F5AB3A800F8D477D275CD655607DBF2B4471230CB8F65E88A9A1F13A736E2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329791, "uuid": "3d115962-4295-436f-8f42-ad5458f7320e", "value": "7293f743ac74cf3c0ecf0f954fb41945", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329791, "uuid": "994e7358-b148-47d6-b3a1-54e8f8c02cbb", "value": "24576:wTODgQ6qREPLI10u/qK6XAKw4Vsdk9CSUL:wTO8q6PU10gPp/sN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329791, "uuid": "da272edb-1cdd-4870-9413-9addbe89f4f6", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329791, "uuid": "5b41f889-5eee-4388-a48f-8e20fd8b13ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329791, "uuid": "acb3fb8a-d7d5-435d-8e33-a747af545804", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfeea8d1-0bf6-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771329010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329010, "uuid": "46593ca4-30b8-428d-9302-c259c62c4d07", "comment": "Malware payload", "value": "1867f978a00bf8793427234d78a5898b", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329010, "uuid": "48ac64aa-4593-4d27-8c9f-882f03b908f9", "comment": "Malware payload", "value": "c7af85982f8ff3925fb3c2793d5f2c5189b1883c27b10fd3c2deaa4ea9f924c2", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329010, "uuid": "c90d70ff-4e1b-414d-a89c-5c505e8110aa", "comment": "Malware payload", "value": "1ba739e831c18288306306ad69ef9003349b53dc", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329010, "uuid": "378f9018-975a-42fc-968b-14eea2b249ca", "comment": "Malware payload", "value": "a242188bc79e9fbe32a8871468b724070d3326e36a223fefbe0aab510fd7d9eede98352cbcebae1b94f5b8acc609ae82", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329010, "uuid": "7b70d278-f5b2-42da-a489-891b35894afc", "value": "T1F9338274190C41EB3493EAB4B088A7E3FE6C0A5C9FED6A4F525487DA163EA8735C35C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329010, "uuid": "8f7a0202-d459-4dd1-b442-5c0645104244", "value": "768:aix2y2kwFg5MHGvEK8IWco5cc3pZ/e8jeynBEBPohMUiz:dxZNYi6GswxoVp9HjeynB6oh9iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329010, "uuid": "9549b1ea-9969-4ea2-9b6a-68d3a2ca391c", "value": 53625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329010, "uuid": "5b380868-01f7-4f87-9edb-04aa2a62d4cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329010, "uuid": "9416e475-b741-46f6-8e04-dfdf7b2b9227", "value": "RFQ -TARSUS M - CON-VR-0008367099897.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba6b829-0c49-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771364705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364705, "uuid": "2e487395-31a0-4dc8-916e-fcdcc985c1c3", "comment": "Malware payload", "value": "2249365c8168d97b97320b7b775e3b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364705, "uuid": "8de5d036-9a1e-4f6c-b5f9-d1c718fb69e1", "comment": "Malware payload", "value": "c8398a39f44ab9043a046373c67055d25bf9444c7de2d23f80cd1d3bb98c277c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364705, "uuid": "83144aec-5b66-4787-8c71-55ba7f7ff5e3", "comment": "Malware payload", "value": "a8c12183c0f96d7dbea8e3acaea0e5a6181d6041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771364705, "uuid": "57c7c873-77ed-4a56-916d-46146115aaa0", "comment": "Malware payload", "value": "13211f28722b4ea60bbbd10751893fea0ba7078e78d972d684f2718ba8eaa72fe4d218624cf3aa9a75f51a537da80c75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364705, "uuid": "bfeeb2eb-d1e1-4285-9779-2d71da5b4e6e", "value": "T117873A43F8E21DE4C4E9C575D165816BBAB23C2D1B3823DB1AA0F7201F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364705, "uuid": "a8ba9467-4b87-44b0-a746-7339609ab831", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364705, "uuid": "e99a9b14-4146-4022-9433-ba22a895a316", "value": "196608:mUrvspFlqsS23eCJJsW2u+0kNKJo40544aWUMJQcjo+0Tuih5sEydSL:mUrEpSsV3pJ8FQJY5SM8T0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771364705, "uuid": "c26c4a18-7553-41f4-9204-ad21244ae748", "value": 36686848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771364705, "uuid": "4e890cfd-2954-416e-84eb-40f4c69fc7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771364705, "uuid": "34d03597-7e4f-43ce-b14d-e7bb440cfb42", "value": "online.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802faf23-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286785, "uuid": "faf1741c-4647-4ebe-93a8-3d438f68db6d", "comment": "Malware payload (Mirai)", "value": "b6309759d3301d30ca7ca7f6c2fae041", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286785, "uuid": "e14b93df-4044-462a-97fb-3cbe8abc803e", "comment": "Malware payload (Mirai)", "value": "c8b36c9da4bdd719b36ba6f9fa1cb1f1222a87950dc9fb6a247d684e33b22284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286785, "uuid": "0a0bb945-4c14-4dc1-ad31-7525a663dfd5", "comment": "Malware payload (Mirai)", "value": "d0b58c0e31e78c5bece13a22870ef69836ee0d5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286785, "uuid": "98c3189e-885c-44ca-84b0-de9df32857b6", "comment": "Malware payload (Mirai)", "value": "9cb9c06af3f107011187d914803418bdda9e572db359493696b0764a09369afdf437a06f08e7615c290221fc2da77090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286785, "uuid": "80fcbda3-3d0f-4622-bada-51313ac108cc", "value": "T1CA534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286785, "uuid": "e2495f6c-d4db-46c8-bebd-4ecdee28dc7a", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/UGV8+BCpEMTj/J9KCrMvuBxANUr6FV+tMiwWDIC:MvolWm+phBgd/KCAWBxANee++bWDvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286785, "uuid": "f04c7d91-2af7-43ed-8011-2c5a609c7c0c", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286785, "uuid": "334bd03a-3a47-4366-8944-afd2daeea13b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286785, "uuid": "538fca28-f181-4602-b063-edda21923984", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3130e4a-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343242, "uuid": "7f990a01-d3cc-45a2-a576-7f4c54d21386", "comment": "Malware payload (Grandoreiro)", "value": "4f81424e12b565880814513d95dff569", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343242, "uuid": "53248a31-4600-4ed6-8662-51a477fcc985", "comment": "Malware payload (Grandoreiro)", "value": "c91e29d23b0def3ab87e0909976d22f2f1b0cac9fbabe17985c131e4f064e245", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343242, "uuid": "fb7cce0c-accc-47b1-afbf-5e89185ecc3c", "comment": "Malware payload (Grandoreiro)", "value": "41782a0a0667ba58c234b44939d7f7bae7d9da35", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343242, "uuid": "25a8b471-3540-4ee9-8f60-df3f288f57bb", "comment": "Malware payload (Grandoreiro)", "value": "4787cd398c52d0d3ec0fcdc63200c7f174af2b180019a739542977878271f525e2d53b9bb22f520bf3f277746fd33676", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343242, "uuid": "24f5aa74-19b9-48c2-9deb-26395644947e", "value": "T103A633317E425C7ECAA08735702F3E265E7C3B034488DAD6B99C915BB30AFD1963B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343242, "uuid": "322b86a5-66a6-4afa-b532-e0f3ae9a1992", "value": "49152:wBgf9T0857ki2CcRiK0UG7N+s2KPAmD8WYg97IR3gbrTU+y0PweuGwz5s6U+pWN6:Ouim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343242, "uuid": "323f5c45-d2f9-430a-ab7b-02503a57682d", "value": 10223616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343242, "uuid": "beb0a8df-f887-47d9-a611-a0145859b2f9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343242, "uuid": "3665b8f6-63d4-4293-bff9-7943383a1c5e", "value": "Hbr2KVZ369862_AFSVMvkuijn-Nota8G8G5.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343b573d-0b9d-11f1-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1771290523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290523, "uuid": "ed5a9d95-516d-436d-b07d-6840764c1b2e", "comment": "Malware payload (SalatStealer)", "value": "4057bbb75eb9b5768018c9a428cfab0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290523, "uuid": "ab1c59c8-af37-4bb0-879e-714385f3cc79", "comment": "Malware payload (SalatStealer)", "value": "c9359407cbf2530be6325d338d9320dc36ca2f6e1aefced3460f84627655ff94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290523, "uuid": "f8aa2577-2490-4b2d-9b13-7df8557d6e9d", "comment": "Malware payload (SalatStealer)", "value": "aab267ead4d9e75260fac9a81e60713cdc761f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771290523, "uuid": "2699342d-b24d-4aa7-a284-926659879ba9", "comment": "Malware payload (SalatStealer)", "value": "9477c7a664f57585e322bff49893d12b731531f1d4fdb724e691bf3b976892b2bf5ae03fda009a7042ffddc20afb8815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290523, "uuid": "9415d816-1f6a-43d6-8756-82c5db6da7b8", "value": "T182C65A41FA8B58F9EA031831415BB23F23355D048B28DBABEB147F6BFC7B6911967205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290523, "uuid": "3673b125-445e-49cf-a922-07e024520904", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290523, "uuid": "b6417372-ec07-4a4a-99b8-463c1169dda3", "value": "98304:9T0lw4W8GV+GYinYpQ78KHeVPDnQET8z:OWxd8FrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771290523, "uuid": "bd82bde4-58f6-44d3-87f4-b3fab95275b8", "value": 11675648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771290523, "uuid": "ad443815-12c4-4cd7-9292-3a8cb35a4a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771290523, "uuid": "50707a01-da6b-4c3a-a6f8-07cb9a0e55ac", "value": "03las9n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b174540f-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343991, "uuid": "c2b6443c-2eee-47ae-8259-7711383f2f8d", "comment": "Malware payload (Grandoreiro)", "value": "10a37382de2b87de797371157cc14180", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343991, "uuid": "f436e052-a8ce-41ff-9455-ef2bf064b587", "comment": "Malware payload (Grandoreiro)", "value": "c9603f6407315bbfcb4fc709392205c88e376b98f4f7a3d35e13d055ba12782e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343991, "uuid": "283ca10b-9121-4356-8643-5f3c84543a8e", "comment": "Malware payload (Grandoreiro)", "value": "325a13eb8148ae6f35b6320c635a46ac826d428e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343991, "uuid": "ddf88d39-a2fb-4c2a-8d77-d47bd48a0c67", "comment": "Malware payload (Grandoreiro)", "value": "c7624ad630e8f2593b9c2aec88be529bc27a893eea996d8cb3e2267bea55032e7e5974f5304a0b19c482059e86284512", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343991, "uuid": "4f13a6a8-0ba3-4cdc-a24d-96cf4db9bd28", "value": "T1F1763371BF5458AAC950C334B07E6F242F3EB6234B8C61D7B6DCA0976745AC1A87B8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343991, "uuid": "7fcaa746-4e9b-4ad9-b060-0feed9c83448", "value": "49152:spt8QY7XMMG1C1DxoB429gX/JR01YBx7QnSVTmLuTPUpzcyRAzKDarW1v9u00z4n:pGyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343991, "uuid": "2c7b8cdd-e56b-44ce-9650-74d8cd3b4c52", "value": 7571456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343991, "uuid": "0ba21d33-9dc8-4e97-9201-df534c1286a0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343991, "uuid": "748a7cbf-c6d3-4a0c-9b22-16c45890d6eb", "value": "PlnlFDRJ_66884XFHQMZTDHRG248157.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e70e0ac-0c19-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343959, "uuid": "01a03fb5-7296-42d5-aca3-97c6f4b1bc53", "comment": "Malware payload (Grandoreiro)", "value": "94b692ecbf0a7c1bbcee6e0db8553fcf", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343959, "uuid": "32b08ddc-6044-40ff-bf09-9f823d02d67f", "comment": "Malware payload (Grandoreiro)", "value": "c96298859948b64840c6a51dcfdceb373417c6baeb78d9c52ae85dba99d8b563", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343959, "uuid": "395fd1af-8d8c-4b60-8c73-1f6cca714bef", "comment": "Malware payload (Grandoreiro)", "value": "ef8ff0df2838ea8bdd5bbf1de988854d5dbc8d72", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343959, "uuid": "dcecaa83-db81-4979-9c4a-e14fb84c2187", "comment": "Malware payload (Grandoreiro)", "value": "9570ea8bdabc18186d9c11c379eb587ed48a1daa2909b5291d8c1f6f074eb1a27114cf5005a2924473347d0689d7148c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343959, "uuid": "4ad5da9c-e9d3-42a2-bffc-3e360620d9ac", "value": "T11A562332FE048C67C64043753A3F6F351E7CB6238B899AD3745CA28B3B856D6493E469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343959, "uuid": "61c93bbf-40de-496e-be34-34a1b52bf414", "value": "49152:gmFj+WrRhgNpBXMC6eqXYQrYOcwLHEAvsnwITD/AvZCH88qAGCVmJj38QH6gL9za:yDION", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343959, "uuid": "5e89a861-d920-4879-8991-59824912f424", "value": 6420480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343959, "uuid": "8f853b41-0a91-406b-9696-792a98c0f91e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343959, "uuid": "cc304477-0c58-4e8d-9525-906a5c9021d9", "value": "Oblg3QK2_21580FJOC-S8AU0.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6841b87-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343194, "uuid": "e886a797-17b6-4126-98b0-57d6a5af6b59", "comment": "Malware payload (Grandoreiro)", "value": "208f22d2f9d15ff4444d77b7dea0add0", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343194, "uuid": "857409f0-4db9-4fd9-a536-7c0bdcd49725", "comment": "Malware payload (Grandoreiro)", "value": "c99a3dc354cf71db5f228c29134ac5e2185294fc427a3a3e2ad0dee863f572d0", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343194, "uuid": "f165cc4e-2218-4bc6-b81e-66323c2f01d5", "comment": "Malware payload (Grandoreiro)", "value": "14bb2a79798b6b31d468f32c3998cc2a955f923f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343194, "uuid": "f1e37abd-30e8-43fc-a7ec-7022e0a9727e", "comment": "Malware payload (Grandoreiro)", "value": "da0f4bc58a12b0223a8eca1007f0b18cc8db9fb31368a5641cb23840b4e51897324135c4b229358a94a48d66af8dc0d1", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343194, "uuid": "c9093234-942c-4e46-8c4c-1cf8eaa2fe77", "value": "T196562331AE901C1FC5948335B03F7B262F7DBA138588A1D7789CE18A378AEC5D52F469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343194, "uuid": "d62f8c33-a690-4de4-8f6b-3d1a824fd3ed", "value": "49152:bZS2rjIX9yXd7Zc4TTedI8av9kIL5LjF2UsLjc6d+qmHaIh8FTlapS29gtIpbZuy:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343194, "uuid": "49870518-2e44-489c-b71c-b1188897066c", "value": 6250496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343194, "uuid": "81e92a1a-3908-42c3-85cd-f66e21cf37e9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343194, "uuid": "0379f276-c6ad-4ead-9278-f56c610ddce1", "value": "FljMLXDC43067-89I5IHKRXHVF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64571aef-0bcf-11f1-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1771312079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312079, "uuid": "8517ae00-2fef-465b-8788-0369ba757181", "comment": "Malware payload (NirCmd)", "value": "0d145bc86d217b4c594677467c12de8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312079, "uuid": "5f91dfe0-e820-4ee3-b16b-2817cc847c73", "comment": "Malware payload (NirCmd)", "value": "ca4db00ce4cadf295dd5d8318ecb58ecec9aa2f2f586c2bb3a39febabea24155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312079, "uuid": "41e47bc4-55e3-40d3-af23-6250c8dc7937", "comment": "Malware payload (NirCmd)", "value": "6aabb71abaf7e2d03f27738e86cada124284211b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312079, "uuid": "ce3e5680-229b-477d-9a0d-40ee66065e46", "comment": "Malware payload (NirCmd)", "value": "c131e4f0d954fd06604c56c88e7d88ffa633723d5e69c16dfe2eac84b5d123e974ab963b9341000b06acb8dfe557bcb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312079, "uuid": "67863d52-3d39-49da-8d1f-dc0382812423", "value": "T19EA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312079, "uuid": "ed6e2c8c-04eb-4903-832d-2775d4545c7f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312079, "uuid": "1cc27dd3-c7cd-4433-87b5-56ae4890e8d3", "value": "49152:ABRgTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aiTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312079, "uuid": "a539fbb8-5e9f-4839-9ded-db07c14dee6a", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312079, "uuid": "1ab6b146-afdc-42f7-9aa2-23b715cc9925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312079, "uuid": "96ae43c3-2a1f-4550-a51b-30a7ab229894", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2a0f5e-0bd0-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312736, "uuid": "f6afe3a8-4954-46dc-b54f-1ff4f5090640", "comment": "Malware payload", "value": "75418cdcc5b22ca243dfc48d0eafffd2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312736, "uuid": "6580e71b-016b-4328-b61b-6e2336931c99", "comment": "Malware payload", "value": "ca53ed45aaa5a9bc799cd16f92acb0582d3dfe0d2a4d4cc5a9d88294dd0bf8b8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312736, "uuid": "895e2b1a-cc69-4ced-b1b5-36d5815e3073", "comment": "Malware payload", "value": "553ad7569306dea706050adb0486105240241026", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312736, "uuid": "0c032eaa-1600-42dd-8bf8-6e45caaf8933", "comment": "Malware payload", "value": "9821916d4f5b7732a950b2623d7da52bb38ca948adfe1ca6b8f830341ae7495449f0dd3a1c1c3bb33bb924eaa602d763", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312736, "uuid": "890bc470-b00f-4775-89c7-888e9306d081", "value": "T1044517A7922F87D8064CA07475ACF5A8C951D55BF4125CBD73FC99CE83AEC08E2712E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312736, "uuid": "2a3af173-e1ad-4857-8f58-b7857a0b45e1", "value": "768:bWrvn41rdsPThLFOB8PTPFthKxmPH9nHmnek9J+AN8MNZHXH2eKs:yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312736, "uuid": "0c06d414-6c16-4366-bc71-81c9f2a2654a", "value": 1216708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312736, "uuid": "1e17cd53-9adf-4c0c-aa30-dda38e50357e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312736, "uuid": "a96b9909-dd47-4899-ab31-2a5bad150069", "value": "75418cdcc5b22ca243dfc48d0eafffd2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f10f040-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342887, "uuid": "71ec18c6-80d2-4a2c-beb1-886727384830", "comment": "Malware payload", "value": "85d95a99395e617514f8c5f78b03e3e9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342887, "uuid": "ee7c5c11-81e3-4764-8e11-d0c68aeddc3c", "comment": "Malware payload", "value": "ca6d1fd741061764333953f463a9be49ef1584f71732cc86175cb50f573778a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342887, "uuid": "cf1a7667-2aef-4ff1-bc43-b5321dc3f7d8", "comment": "Malware payload", "value": "d44f58f68e049f995c1ec7da996ec59c279e2fed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342887, "uuid": "7d6e6de6-b8a8-43a7-8b42-ef63e22e0f85", "comment": "Malware payload", "value": "531b5748c17aa252e3e613d82dcc7c546ab37bdfc621018c8d2d5cdd279b7b178a9a67a7bca4090af909279c2c64e97a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342887, "uuid": "2ef88ae3-1e15-42d1-9b80-f81fe7c711a3", "value": "T1F4351280663B10BF13AC30B37820EB7ACDB8B59D585E362531B789D3FE15D8BE458865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342887, "uuid": "38bab952-be9c-4a3f-aab2-562f839d64b6", "value": "96:0oB10fLxEwoiupwvTjJC9O+IBzBHq1CswZdwXmGpOFL:1p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342887, "uuid": "1151582e-c76e-43c0-b84e-adaa3ef4e91f", "value": 1126111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342887, "uuid": "e9f5659c-83ee-4154-bb14-c6fedbdb2904", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342887, "uuid": "4488c58b-3b9f-443e-bbfe-4edd46f56a6a", "value": "Pl348734639.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff712476-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1771311910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311910, "uuid": "836afe12-cf66-4619-b936-f0ff23039867", "comment": "Malware payload (DonutLoader)", "value": "23571f662dd8c1fc373bcf82c302f000", "object_relation": "md5", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311910, "uuid": "1a59ade1-367f-4eae-a0a8-5f192ca2bc50", "comment": "Malware payload (DonutLoader)", "value": "cabc7236553558d6339c0e069da8cb3302b51518fa3adc45299578a3d610083b", "object_relation": "sha256", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311910, "uuid": "2a8dbf0f-d172-42cf-8814-80dc6505c150", "comment": "Malware payload (DonutLoader)", "value": "dc842164b65b8ddf4d2f9ae65ac496e767fe09b6", "object_relation": "sha1", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311910, "uuid": "ec2c7919-6751-4b7c-87a6-19424a296ecb", "comment": "Malware payload (DonutLoader)", "value": "298453f10bf1c9c9e9d1af4cbd8c05744aaaa1edb67bb9818f2fbe5c28f0b84adab8c66acc997c5e7f0c71d38db315b7", "object_relation": "sha3-384", "Tag": [ { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311910, "uuid": "07dad81d-80aa-4117-9059-686112736429", "value": "T18513F1CBF5AA4901DAB644351A5833CFE4C19760EF32E68D3298E482634C7D149FA4A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311910, "uuid": "cf2500f9-f2da-4c65-9a2c-4d38e6b5c4ea", "value": "768:wO8f6GFgZGmObd/OT14eeoPDDM+QxVUtIHqcqK/lagreBsmxRu/rlDRH688e:wlf6G4GmOU14oDDM+P6qcd8grsSdRaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311910, "uuid": "b4f8cabe-8f62-454c-a8fd-c6ea2900626c", "value": 42704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311910, "uuid": "4f4a796d-4da2-4c11-8b8a-9bd7fe9bc037", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311910, "uuid": "2a3e23db-785e-42ca-abde-a313a822f35e", "value": "5ad34f3a900ec243355dea4ac0cd668ef69f95abc4a18f5fc67af2599d1893bd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbcea97-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771313064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313064, "uuid": "5d45fdd5-4282-4145-9bae-b2b9cd947f78", "comment": "Malware payload", "value": "4f40e7ebcf7fd7d2e833191c03741f15", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313064, "uuid": "c37e6103-7340-492e-ab49-45d88baece46", "comment": "Malware payload", "value": "cadba7e91afbd8bcf3b763d8bb180460b81e1e3931705b3bf965d91d3fe8cdd0", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313064, "uuid": "9def4b4a-5c97-4e95-86a6-76238a741820", "comment": "Malware payload", "value": "cb42ca0988d570370ed18eb46e16859bab40051a", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313064, "uuid": "663651a2-f3d6-435a-91b4-baef44b8cc7d", "comment": "Malware payload", "value": "045c361b9dcd87a09ebeafd07ff4685aef9d825f5ec9ad469d7d501dbce380d9066b279a6f58eb77f2cc72de07ea698f", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313064, "uuid": "e7c6bd33-41f7-466f-8602-e20724ed372f", "value": "T12886D75FA3D003B914B26214F58E75BEF312C47C5322D2282E5CD568326A97A6B7F4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313064, "uuid": "2f3de1b3-d7e6-482b-aeea-e93c5c311f02", "value": "49152:hfvVNfcKv9+HQJ74KT7I2ShWk3mR596pV6JFwFvlfBRo0q4LJR+XbQ7LeKZt4FP:Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313064, "uuid": "ee56aeeb-cfee-4d12-afbb-cb15edd28b24", "value": 8387686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313064, "uuid": "9b1f565d-3eb5-46ed-a25a-3103e2e802b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313064, "uuid": "809b5827-f275-433d-8cb2-f7d70778c1a3", "value": "nouveau_curriculum_vitae (3).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277d39fa-0c26-11f1-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1771349343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349343, "uuid": "c3b08d0e-8ac2-45ac-9421-7b35562772b2", "comment": "Malware payload (Gafgyt)", "value": "a781dc06e7bb6833b1b29081fdae0dfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349343, "uuid": "4ae09540-0d4f-407c-920b-b89ae71ae493", "comment": "Malware payload (Gafgyt)", "value": "cb26392cbc3b5e103507fe6ba7bad5cfa3e200323f7bb32a9018449ecb94b989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349343, "uuid": "591e6311-b478-4782-a4c0-882f3ca7b874", "comment": "Malware payload (Gafgyt)", "value": "3f4b52e74fbdc640c45ebd061b472bc9f5d9e8b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771349343, "uuid": "90e25976-b208-4a7c-a5f0-c48afea97447", "comment": "Malware payload (Gafgyt)", "value": "fab05ecdee34c7beccd177e798d5bed580489735c04e64c40e0d8fa4529c6ad13a09064c16f245e35adbc438c33213cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349343, "uuid": "80c53388-c749-42c8-ad5f-7764488aa310", "value": "T1F2835C49E747CBB3C88306B2029BBA664532F83B5E2E9F45F70D7CB49B124D47266712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349343, "uuid": "814f1788-8076-4150-9fab-18de4da43cad", "value": "1536:oEma7SDXPm8VjWWHTMcqeApHgerShKW6GLdUF5MI5AtpgwZU+aHfV+mLI2VOYjX0:ua7SDXPm8VjWWHTMXLpAeUnBUF5MI5dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771349343, "uuid": "b0b50fae-9b65-4655-9a70-dbcad2d3e530", "value": 86409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771349343, "uuid": "42db5282-fd7f-4adc-a463-75b57737e1b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771349343, "uuid": "931f0bb7-5560-471a-9f84-08e66697bd86", "value": "mipsel.armageddon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b128c958-0bca-11f1-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1771310060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310060, "uuid": "c4b18698-a751-47e7-ab1d-2b0423224408", "comment": "Malware payload (Vidar)", "value": "365dd7034af1c0303e2559bb99e6506c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310060, "uuid": "c3018a9d-8294-44a2-929c-0ac9ab3a5c8f", "comment": "Malware payload (Vidar)", "value": "cb5d2d298013bb5eb97f774ff7a6f9a4560841c9fb9b41ec12ccb27ccf29f7e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310060, "uuid": "65356a58-a33f-47f0-ad92-9e595cdb29ce", "comment": "Malware payload (Vidar)", "value": "dee7d1cf76e5a1121f92ef26865689470ecec6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310060, "uuid": "964a6ffa-184e-44f0-88c0-1671b25d9d75", "comment": "Malware payload (Vidar)", "value": "5b4870d7f98a32751a3ba8d6da448070d227e039a45479e24b4c355745e2d699e9153bf2a54158633b6ed564dc1b9c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310060, "uuid": "2ec1241a-b096-4441-a0e0-1ff42385b892", "value": "T1F0F5C0239ADA13DAE8B5B67088B056017FB4BCB186938C5BF7D4772ACC357061F26721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310060, "uuid": "cfe66431-56c4-402c-aea3-86ed9f76dc23", "value": "7a1999347d51f2cbe778232cc60933ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310060, "uuid": "b6667654-df0b-4494-a006-08a1791a925c", "value": "98304:tcV3lfBHFdGHS4g1xy6DtrqjdSL9EyXDn:olf3dGHS4g1xyKtrqjdSREen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310060, "uuid": "bd9a8a6f-3638-4ff8-b202-bf662f5afa99", "value": 3341824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310060, "uuid": "2ad7474a-71b5-4ba5-ab97-254c57f5ad1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310060, "uuid": "fb792924-2527-4775-8f3e-d6b33837e984", "value": "cb5d2d298013bb5eb97f774ff7a6f9a4560841c9fb9b41ec12ccb27ccf29f7e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d79e834-0b9a-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771289250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289250, "uuid": "d55341a2-5bd2-4b40-836c-4e8edc6a5ba7", "comment": "Malware payload (Mirai)", "value": "46917e23f45da503077a91e6e7d8f223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289250, "uuid": "f1ad3220-bad3-4b01-bf97-c4c921c41ffd", "comment": "Malware payload (Mirai)", "value": "cb7a63c0c3e40f2909c35e9f41b8442fae4c89b84aed0ac095a73b65764ccd19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289250, "uuid": "c57f9ebf-f6c8-4472-8e7b-62def2ff28bf", "comment": "Malware payload (Mirai)", "value": "7d3f090108332d12a8d25e867ef212a6d1f0bcfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771289250, "uuid": "61c12667-eae5-4226-abac-c92b79229420", "comment": "Malware payload (Mirai)", "value": "06344e6808e92ab3b93aeb1e5f3649fe26a23dcc92059839562088a1fe2e8461f9d27a180b106568c05c8b1d25dab298", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289250, "uuid": "4d8d7a1e-749f-426e-bb95-b2f62e19aef1", "value": "T1E6A3D80E5E24CF7DF769C23547B78A31A758338622E0D285E27CE6015F6024E681FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289250, "uuid": "deab8006-cbb6-495e-8d0a-c1519a6159c3", "value": "1536:WTI1JbHpBTs03EDEQqGuDtyytyqHyJ1AjUWETQ/eagWnzvzd5:91NbTs0ZMupjUWETQyWnzvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771289250, "uuid": "a40fdd80-8092-4fe9-bce3-28fcb5d2b7e6", "value": 101752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771289250, "uuid": "c93482fa-f5f1-4df3-b42a-6563b0a777c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771289250, "uuid": "6f13913b-a3b9-4831-8a04-ec432314be13", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e25d3cd-0bcb-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771310377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310377, "uuid": "5e3d393b-74e7-486e-9c41-efc5684a6d92", "comment": "Malware payload", "value": "08b2f4b14379e0b6d60cec6f9532f2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310377, "uuid": "186fd56e-7325-413a-9767-1bad302eaf34", "comment": "Malware payload", "value": "cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310377, "uuid": "4ead3aac-a2d8-405d-81c6-04070dca8f6a", "comment": "Malware payload", "value": "8da0fd53c06a4a192308f8e12a1eabbfde4c265e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771310377, "uuid": "6785ff05-6c78-4b9a-b8c7-e580dee6e35e", "comment": "Malware payload", "value": "7e8e1f66f705169eda3ce7082579db792f2497c23ffb67c309e9c552940bf473da959e777281f1cc60c29a794a5e761f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wuhan-Shuoxi-Technology-Co-Ltd", "colour": "#29E692", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310377, "uuid": "e4ca9aa3-fd11-42fa-9ebb-c5ee4a9dc2d8", "value": "T1CD1733810120F8F1F1EE49B43467B2784EDC7BE15E583D81EB7563693812F6EAF6A211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310377, "uuid": "8a621ec9-e75b-43a1-854c-be6d142c333f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310377, "uuid": "e372e52b-69e8-45bd-ac31-d02892ef549c", "value": "393216:6qOGe3wVzln2FPAxTDdGWcuYdaPK6aolsq+4cLQekh7iB7+NSQTyl:6qOaJMABDYzSW4c8eaOim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771310377, "uuid": "0ca9580d-479e-4256-b803-30a19c160e3f", "value": 19431152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771310377, "uuid": "463628cc-5fa5-4922-bed4-1fcec0f5eda5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771310377, "uuid": "214f6920-3199-4e97-8941-f18f9ce4b98c", "value": "cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a1e24a-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352315, "uuid": "46c079a9-0567-498e-9092-c7affa661f84", "comment": "Malware payload (Mirai)", "value": "2280aa5c836ca319bec35314fb6c4718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352315, "uuid": "1ce6cdf7-7c3f-4645-8e54-055c1076ff2a", "comment": "Malware payload (Mirai)", "value": "cc1aa88b44b6ca57b028de9705a6f98cb35cf509c21c8e6b46a1ddda924740fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352315, "uuid": "a7245dd5-7f7a-4436-9feb-b2bee73af4b1", "comment": "Malware payload (Mirai)", "value": "68fdb7f0b630b98e8b3aa578d7e2d035fe9be5da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352315, "uuid": "29a40198-1438-407e-8cc0-323a736c8b4b", "comment": "Malware payload (Mirai)", "value": "dcaf9c7586b349a46919cfa01cb77523605e78b23b048bdd0350d76b9d09737351446500a105dad576af91fdd72f9274", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352315, "uuid": "1ae6df12-825d-4446-8150-87d811609c0b", "value": "T1A6639209BF611FF7EC6FDC374AE91B4525CD641A21A83B397A34D818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352315, "uuid": "b7d9771c-8d8c-4651-9f8b-9cd6a2f2449a", "value": "768:z5DScD5GY2ne8s2Sxt9yYExR15IR45fTemle5Re5brvuX5XiANe1j9OE:z5DSC5G9eV249FKE4pfl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352315, "uuid": "a34a471a-f9cc-4cea-ad56-f780da8367ec", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352315, "uuid": "2645f913-80b2-4396-911d-d4434c216d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352315, "uuid": "8c031d4f-0ca6-4138-bd51-9fadfbd6aef9", "value": "miraint.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14444db-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343159, "uuid": "2a5adcb2-9966-4072-aaf0-ab3334ddb263", "comment": "Malware payload (Grandoreiro)", "value": "a72593c8528e66c2e9f63f6e48ba8ac5", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343159, "uuid": "2a34d94a-8199-4e52-b96e-8973850e9065", "comment": "Malware payload (Grandoreiro)", "value": "cc6525064f2588776186d3a35a65b0f05404c267358bc80ecbccca5008ec5c59", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343159, "uuid": "246e7407-9019-447c-a146-6cc22e3d299d", "comment": "Malware payload (Grandoreiro)", "value": "c48da43bb38acbf76e727d95b7723cb0cb83f062", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343159, "uuid": "a8bdec4a-1555-4455-9447-7b30e1502749", "comment": "Malware payload (Grandoreiro)", "value": "955fd711ba5dbeafafc09038d56f203c7a5fdde557daf51654286225941381ac343dad55611843adce0c011d36d705d4", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343159, "uuid": "d11769e2-7a5a-44ce-8285-06e65a12dc7d", "value": "T1CC862331BE645C62C5908336707E1F356E7DF60787CCDAD324EC90962B46AD1AB3E898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343159, "uuid": "cf6d85b7-afe6-4878-a875-d7457b923494", "value": "49152:slHrK+5RIcFNIrJoSyhuiXKHGNobdT4Ok9lJplDdxyo4pCRbrbzvnPnrGcYyxggc:Zs8D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343159, "uuid": "d896a596-dce8-4e7b-a698-29f85c4d6738", "value": 8460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343159, "uuid": "435a3f8c-bd66-4f42-bd0e-e60d2a90f01c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343159, "uuid": "e984b2d5-ef56-4289-8bfb-f7184a757e4c", "value": "Bol26297YCJJBB7JTV-11397_Cita.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317fbe27-0bf9-11f1-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1771330033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330033, "uuid": "68f17f17-0827-440e-9ec2-6fcee0411795", "comment": "Malware payload (RedLineStealer)", "value": "45ad46945b5a298a03b6c3e31edd7681", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330033, "uuid": "ccae7ccf-1649-491c-aabb-7804cb2ae58a", "comment": "Malware payload (RedLineStealer)", "value": "cc6bca67fc61eb4fd0e9d8e6cbf058f4f21aff8ae0824fc5557c77cad626039c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330033, "uuid": "3f4f76bd-545a-4b6d-af5c-a3504122a4df", "comment": "Malware payload (RedLineStealer)", "value": "8277b962e1b3ae879680fd77acac76c7f3545dc3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771330033, "uuid": "288bbab5-977e-4b35-9665-ef068e27ce25", "comment": "Malware payload (RedLineStealer)", "value": "36c33677ba87d8740d1351fb89573d320f0dfa9d05f83ba42c05c77a831f6935adc616db12b68db661c2c8f1c343ca0a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330033, "uuid": "a2738e76-673b-4610-a5aa-c41de3a31f01", "value": "T118871212B9AD16A9D5FAF1388479A211B67238650331BBC71BE8157B1F376D42E3F308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330033, "uuid": "99fc6c60-0318-444a-9b79-18cd60761606", "value": "1f74bdd8275d1c99b371f4a5243e6cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330033, "uuid": "c576a9c9-d5ba-41e9-b419-f3c342c04e73", "value": "786432:Ji51FLXqrRtboS/N1ILX3JtUpTbLYH4aaj3SWL:U51NqrvbL1u3HUxbt3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771330033, "uuid": "d4bbb254-463f-4c72-a7f1-6d3cd2be1ef7", "value": 36521472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771330033, "uuid": "76e28d93-fc58-458f-9fe2-0680dc8c7fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771330033, "uuid": "9d8f0e8a-119f-4bbe-9eda-2dd591c338d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f444ba0-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341706, "uuid": "3c4a4bd4-4002-4800-8985-f81b9742876a", "comment": "Malware payload (Grandoreiro)", "value": "582d5d5a4fdbd3904bf05cc67405f2a6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341706, "uuid": "0c770e2e-91c4-4391-8559-8eeb52c5ba23", "comment": "Malware payload (Grandoreiro)", "value": "cd492d78fa09c178ce3d4f191b45d9494a040e859ea2cca0b22fa22b847c8e3c", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341706, "uuid": "7b02228d-ca67-4dd5-9f48-97861d541d80", "comment": "Malware payload (Grandoreiro)", "value": "c147e6d0835ec135e7351db2280721e6cbe0fa81", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341706, "uuid": "146257a0-07fc-4fa6-a67b-f786e0da702d", "comment": "Malware payload (Grandoreiro)", "value": "ea8d4fd47fc62a2405c18f5377103ade4c5b17307bc8ed082e95903358b9be696f5819753ecaba20e7492693d830413f", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341706, "uuid": "015053a1-e1d7-4cc5-934e-6dd1c9934783", "value": "T1F6562331AF994C5ECA904339F15F2D251E2D7657C0CCA1EA786C94832B97FE4C63B898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341706, "uuid": "526acec1-0d83-4a6d-9047-9fe95d042910", "value": "49152:v9FvAgnj+X7DWviXPq/alvIgFYTODyMG4UfytXyY5rlpUISn+fH+FSlrhsJXEFwM:qsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341706, "uuid": "042ca353-a956-44a8-a527-a2b15fa93e6f", "value": 6133760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341706, "uuid": "5bd2b9e4-7941-40ba-8f99-4cb2eb5bf033", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341706, "uuid": "175395fe-069c-4be9-8328-c5808392029e", "value": "0Ofc79762MRYB9KNTY1-1320.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde7d2fb-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353890, "uuid": "c5e3445c-233e-4ac0-9b53-30eee8b229a8", "comment": "Malware payload", "value": "6c60fe96671da241d99ed8c732764374", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353890, "uuid": "3e38b6d8-62df-42d6-9f92-1dfa6d661555", "comment": "Malware payload", "value": "cd574904dd47552078824ffb133141fc799ed1eec0de501b66fa84567a76ec24", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353890, "uuid": "57b887e1-6f80-4dff-8d0e-84dd00aa4b10", "comment": "Malware payload", "value": "8336116458e0948b9937660f1634583e0e4530fb", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353890, "uuid": "de6a6581-e47e-43df-b9cf-d03692396466", "comment": "Malware payload", "value": "7015cca54069289e842b9ee62b135e3571fcf27c96edf416be439edbf601911e485547b41520933894f3d68d5d225f98", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353890, "uuid": "da115566-8df7-49e0-907b-0f28ea504e50", "value": "T1AB5623306D612C46C99083BA303E3B356E7DA65303CED6D3706CE193339AED2D57A5A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353890, "uuid": "a9e009d6-9043-4752-84a9-27bd9a3fb24e", "value": "49152:TGQhU3wLUuWmlfn2Xrqu+c4wyiHUdW81mLNLjGGOoH5FblOvte6F09LWUR1fIPrD:OJyWM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353890, "uuid": "6306fbe7-a5d2-4655-98ae-7cb72bd1d508", "value": 6332416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353890, "uuid": "dda0f586-11af-4c14-870e-5f2cb7f5ba13", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353890, "uuid": "ecc04689-3e14-44a5-93b8-72a5c3311fec", "value": "Slct16944AVQCEVCGY15_6992qhce.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115c772a-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352312, "uuid": "1bd7961f-9eb6-4082-b10d-ee9634cd3144", "comment": "Malware payload (Mirai)", "value": "ae2cfe5f7d674b4b45e14e36dc90645f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352312, "uuid": "9c71cef2-ec30-46f4-8269-201e48c0de6d", "comment": "Malware payload (Mirai)", "value": "ce417904960a3eece6f2d751cb0d5d4526d9bd3632846216f5eef6f4614b0175", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352312, "uuid": "56111bfb-c41f-474f-8db9-4e3a19f14629", "comment": "Malware payload (Mirai)", "value": "673e0756d80c1f5cd922685b07ae1f8ac2f1da6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352312, "uuid": "ce1d9ff9-9b51-49d5-bf16-d37a986efd8d", "comment": "Malware payload (Mirai)", "value": "c60112474edd9c6796f476546f14026f57bc0257db7ba81040c71874516ebb95fc7d11f439f9b994585fb4e5884c301b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352312, "uuid": "651f7ee7-9423-43dd-ab8d-3a84fbe5a271", "value": "T144530795BCD28A12C6D422B6FA2E418D372263E8D1DF3207DD216F1177CA82F0DBB556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352312, "uuid": "b2f5b639-9ca4-46d6-a102-bd9e9d604b82", "value": "1536:4tm3SWBo98R6D1sLBiPE2VrL2yBCtt5Ka5x1VV:4tmzG95NlvYbKa5x/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352312, "uuid": "4463fdb6-a8db-462f-984c-b38d6b175e87", "value": 60808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352312, "uuid": "6a3106f4-4cc2-495f-a750-75be2489443b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352312, "uuid": "4a79c5af-9970-4538-a089-d6fb91f69d2a", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f856301-0c00-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771333170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333170, "uuid": "175c5370-49de-466f-a8cd-9ca55ba2a232", "comment": "Malware payload (Mirai)", "value": "3beac714fd80bdfdc818ba8d7275d8a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333170, "uuid": "32263fcc-1c27-4c3c-8345-4fd5e87a841d", "comment": "Malware payload (Mirai)", "value": "ce4c985feddaa9010c0425facf2b1545d7e4abccb11884fc7bde1d16db2098f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333170, "uuid": "68a81df1-d02c-47b6-83cb-27dc29ac52e6", "comment": "Malware payload (Mirai)", "value": "090aa6a1e813cc04eb151102d11de9bd30011b53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771333170, "uuid": "c9b8adc2-2f3c-4678-b6ae-e07fd85e9cab", "comment": "Malware payload (Mirai)", "value": "4774a0ae161d0125fb3c3e1ea40c636fca679cf7bf5de2cd8ef24907dc2d3fbeec16e5895a9b31a8070092b91479db7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333170, "uuid": "916710a9-99ea-4e4b-a69e-2407c145758a", "value": "T1BB833A55BC818A12C6C112BBFB6E42CD772613E8E2DB3207CD295F54378B96B0E7B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333170, "uuid": "2a3dbdd1-8b13-4721-bea9-84390a91ed61", "value": "1536:K8h1fwmgoSQDr9QzjLoEgrUpjMm/lBwgpP7cPkvK5Du/Fvb/BpVv6TnOfrw8IXs0:K8h1fZgCr9ajbhjtDPckvK5S/lb/BpMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771333170, "uuid": "ef69b1d8-4249-4fbb-85c8-1f52c73ad642", "value": 87856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771333170, "uuid": "8f4b9c54-7c4c-43d9-9425-feda3c162aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771333170, "uuid": "9cca01f1-1ed2-4873-8eae-c8481d682908", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0e142d-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348144, "uuid": "aa72e4bb-aee4-4126-8f9d-7e052eb8389e", "comment": "Malware payload", "value": "2e48049ff4ab67c3923e7cf240a908ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348144, "uuid": "c2a389ac-64b5-472f-b12a-ee469be4a496", "comment": "Malware payload", "value": "ce8e3b9fb78793da0de9b73f03cfc150f09fd58003bab2198448641e242f9f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348144, "uuid": "b89f65ee-f8af-420f-bd22-bd025efab38c", "comment": "Malware payload", "value": "9d3aabd5a73859f042e5604c9bee9a9242ec5123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348144, "uuid": "5c785095-d9b6-4416-a6df-932a9a37c884", "comment": "Malware payload", "value": "cc650f6b9ee25155e6c8fa297d649741fd3de1774ba35453597c97014bcf3b78a42d9a49d6c02eb03fb064f2847dd8a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348144, "uuid": "4792ff6b-ee40-48ce-8bfa-6029faccaaec", "value": "T109C1C85B3C504A33C81111B407CB5F0DE7B794986E95AD468D1B5EA93D31E834EF460F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348144, "uuid": "ec5b7c07-01f2-4d15-adcf-d8b419e4e391", "value": "9f0f5afcd551424789f227c045328a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348144, "uuid": "0f512b14-4279-417e-9652-30a250e70477", "value": "96:S08I89xtofS4oguQ7tGPeb4zrYF3XgsttFStNoyn:l8ml0+9kYnjtStNoyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348144, "uuid": "06c94e74-b981-4891-a812-96783171cba9", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348144, "uuid": "8b1c488f-d641-4b48-bade-3006154b8569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348144, "uuid": "5bb07a78-1481-4a04-9f21-3ae33ac978b6", "value": "ceshi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a92a87-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341683, "uuid": "51d8e1ec-58a2-460f-936d-494dd93c93d4", "comment": "Malware payload (Grandoreiro)", "value": "6c9e07e1cd2295dc6be2a9927225bc7e", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341683, "uuid": "759f3860-464f-4e2d-a2cb-fbc657b1b0cb", "comment": "Malware payload (Grandoreiro)", "value": "ce9de92c79eef81c2bf444c9c9470c54ae4ef1ad521392df33e790796d207fe9", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341683, "uuid": "b8d2db7b-0d34-440a-b173-8f51a8e5052c", "comment": "Malware payload (Grandoreiro)", "value": "1b648499e45dec29e763bae42148f3a9c35a8c3c", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341683, "uuid": "08c75691-5c36-4eda-9db2-93536c6b0869", "comment": "Malware payload (Grandoreiro)", "value": "5ecd9e698c5ebf9759960a4d59f7f12470fd33a7034f8922147d245380327b08565a28a96f664cf23d99b83c7376993f", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341683, "uuid": "2ef63f33-5a65-4721-992a-345bca2880f0", "value": "T139763332BF500C36C2648379B52F7A391F3E7B13498CD1E679ADA582274BFC5592E089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341683, "uuid": "571e8406-bbb9-4499-b23a-7dda46da74f9", "value": "49152:mfjADqx7CZ0zI5BMm/DliAuws0uSw21oXm/OyZRVIFNEfK34ZlVctuA86T3ENJqQ:qTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341683, "uuid": "05ca403b-0467-4cd8-a269-d6a2521b3624", "value": 7225344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341683, "uuid": "e28e3f45-39a3-4850-8605-fa1efcf7cea1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341683, "uuid": "d63e57a0-4a8b-422f-a35b-21d9f5220b41", "value": "0Mrc-Antl1934HDSC65PK6R.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c6b3fe-0bd2-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771313398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313398, "uuid": "11148d18-8219-4dbe-b38d-39783a72e75a", "comment": "Malware payload", "value": "cd0beb075e6ad2af6a29e948058381f9", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313398, "uuid": "2e703569-f527-40bd-b0d8-9e6d3ea60d24", "comment": "Malware payload", "value": "cecf922dc4715aca2e01c7d519daed21ded6e0948c133fba9b0cde5cc70daf84", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313398, "uuid": "96088a1d-a22b-4e07-9583-f724fa163007", "comment": "Malware payload", "value": "73f0531fdabc706b54c238a171c817612d9ac44e", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313398, "uuid": "d9a1762e-9054-47ac-af28-d6616e737b94", "comment": "Malware payload", "value": "7c197fefb4344ccc925033262973a5c42d061d380fc9b5c44bf74b8d06e8f9438f62153f65ded40e546912c788c8666b", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313398, "uuid": "84c44fc0-a01a-4a39-ad3a-db255434131d", "value": "T1151419ABE35202591873229AEA8E71B9FF24C43C53535234BE9D826C231687D533B5FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313398, "uuid": "802cb665-fcde-41ac-b5a2-ec353cbe4eae", "value": "3072:Rouq/+AZGNd9BYVgbDu9rATWQtAWYRU0XZM:+j2QGNd4ebDu97s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313398, "uuid": "2e97d496-8db5-431c-853f-33181b5477b6", "value": 201117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313398, "uuid": "5aa5039b-1546-420d-9ae3-e7745c3643a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313398, "uuid": "9da99bba-8015-4550-8e6a-a4677b6d2f63", "value": "cecf922dc4715aca2e01c7d519daed21ded6e0948c133fba9b0cde5cc70daf84.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f372fda-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771312795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312795, "uuid": "d79b4d21-ae46-46bb-9c64-24a6631b0f46", "comment": "Malware payload (PhantomStealer)", "value": "808097fdc28e7d5b52b34d4d35557609", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312795, "uuid": "a45db572-1cb3-4945-9ee0-9d359e33634b", "comment": "Malware payload (PhantomStealer)", "value": "ceee0afa31bdb23facef986624aff74589e363b36a3e40425eb5c7b6819d6713", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312795, "uuid": "973871bf-2301-4a9e-8906-6241fa542e87", "comment": "Malware payload (PhantomStealer)", "value": "2cacb932aba123833225d09fde0d1b4b936120c4", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312795, "uuid": "c229c5d3-4388-40c3-9724-057a154cc1f8", "comment": "Malware payload (PhantomStealer)", "value": "fa7bc542969422ce3b5c937d44eb9763545ffc279cbd7b612d4cadfe7f112979e879f15da6c6a9c245ad440e32d8364d", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312795, "uuid": "d0ab22db-b3b3-4a7d-ac3d-8aa6ec29f632", "value": "T14FC2EAC93EC6B1A6037154332D5BA556F26ECC89B88CC4A9EAA55094FD64704CCB3AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312795, "uuid": "5ae112ec-6abb-49d3-bf0c-b8e1f1582e61", "value": "768:SdL1uxh3TqwbWPMF7hqs+R65SIR5FbBpVMqnSi:wuxh3TbOc7hq3AkQhVTSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312795, "uuid": "6e0ff321-129a-42fa-939d-472f47ba0125", "value": 27505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312795, "uuid": "bcfee23b-ce72-4af5-9f1e-b08c6744f57c", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312795, "uuid": "2dea172a-7b23-4a93-84eb-d3d936abdcdf", "value": "refund_receipts_inv.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a408f75a-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353847, "uuid": "a9921783-6201-4450-bd45-dc513e0e22a3", "comment": "Malware payload", "value": "ad89120b6c04b8e7a8f1e5e966709be1", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353847, "uuid": "e7fa45b0-5e30-4f81-80c3-fc55db9f03c3", "comment": "Malware payload", "value": "cf4096738b19e256a44debee0922061cf5995b9f2c13c6fb962968d128b3171e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353847, "uuid": "d216074e-22e5-447d-86d1-f5814900a1f2", "comment": "Malware payload", "value": "1e8a2436342c70a850821d04e1d50e42ffbb329b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353847, "uuid": "91a5178b-51ae-43d4-962f-cdb5c49bcf27", "comment": "Malware payload", "value": "73dc8f75bdd73e8930f5ba663636586777c9096761b2422411f211e9117261bd32e93610bbcc57b07cde7f0ec1c2520d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353847, "uuid": "0bada505-9ac3-4eda-8a40-a262c1a840bc", "value": "T1B9863331FE841C6EC6548335713B3E396F3CA65348C896D6649DA283374DEC7963B8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353847, "uuid": "b735c1db-97c9-4361-a778-72a31228aa25", "value": "49152:RhjW9hDybUf+RWS9U5sE7V/avaS9oWuZvSJz55zHneab1ug9SaDhmHSX5B2DvUyH:jiUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353847, "uuid": "cbaaab46-aefc-40ed-8f07-9055c2ab78d9", "value": 8230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353847, "uuid": "65d2c637-ac52-41c8-9955-663f4877a837", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353847, "uuid": "cdf0dc9c-8bda-42fd-8400-0b2afafbd2cd", "value": "RptJBX9T7-SQQNO388673_AnI9A294.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61df1bab-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771348153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348153, "uuid": "305da379-4aa4-401c-b469-79553908a4f5", "comment": "Malware payload", "value": "623a43d067b083857522863a5fc35929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348153, "uuid": "21c17279-81f3-48ea-823e-8c42e5e66fc5", "comment": "Malware payload", "value": "cf987eb2698be8b83f7d5caa995e64573683d5921025ce49734c240a54741d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348153, "uuid": "c531774b-aa61-4a0b-a0d9-ae8bc0230585", "comment": "Malware payload", "value": "30713c28166c0901b3daee3b7136b0363fc68af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348153, "uuid": "7fa9f1c8-9c57-4073-9b3f-34631456f8e1", "comment": "Malware payload", "value": "a0ba43ddda2fd389899375de4d43a9d9e88de66d97b1116cff8b2b6ed80b9d462f7d5f02702301661e5040c8a1e668e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348153, "uuid": "cabe44ad-abc6-4bc4-84dd-65eb2716f43f", "value": "T1FE247D48F6AD89FAD167D438C9410902EAB27C4A4774EB9F0B900ED59F536E0AF3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348153, "uuid": "ac3891ca-d6d6-4f69-b30a-50d6988db99e", "value": "eae225b334c4ab10eeef2157780a236c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348153, "uuid": "675444e2-b5a8-4bd1-94f2-76f655af930c", "value": "3072:2tTJS9cAVldHK43EDVWqxmva/ovey/5sF8PQc6zTFD+t1p1IsVr4tKo3qk:2tTE9cAHVK1zgvaadapTJaS6rLo3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348153, "uuid": "cb60f664-f2ef-4686-b7ad-f8595d6bf8c7", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348153, "uuid": "4d1e1b3d-f43f-4eba-ac0b-1118934f4972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348153, "uuid": "553085d7-1918-45d4-919e-4b15e3a03b7f", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854232d9-0b94-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771286794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286794, "uuid": "1cee3761-00f8-4a04-b943-8dba042eb2f0", "comment": "Malware payload (Mirai)", "value": "6e3e238776bfeac54da7ae49ae78867f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286794, "uuid": "5e97ebbb-a380-4a94-a7ca-986975794613", "comment": "Malware payload (Mirai)", "value": "cfa5d5f9016becaadc1660ddc6297c1eb727239f81dcff15315d38fa6f29febf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286794, "uuid": "46c407c5-4f99-4b74-b717-c2ebd448fdb7", "comment": "Malware payload (Mirai)", "value": "c4c70839da957a3c37d1dd74c75329449586963b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771286794, "uuid": "97c2523a-0496-4942-9261-ee716cc5969f", "comment": "Malware payload (Mirai)", "value": "c63aab1050189cfb97c7bbe8a4755c937322999facdc653ed62111483cc36d40f2111a48e2121593330c0dfab99dbcf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286794, "uuid": "131f99dd-613d-4bd2-8a68-7aa0cb6720e6", "value": "T1ABE33C56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8279B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286794, "uuid": "41ecc969-c034-4270-bc72-e2a1c5c9674c", "value": "3072:CJLce3pC5mD7naLHbz4N9GUJURIJ1FvEXkkTM/9oIMY:CJLce/naLHbz4NMUJdHvEXkYM/9LMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771286794, "uuid": "1abc714b-887e-41b5-81ea-961b64595c49", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771286794, "uuid": "3fa8ad01-ea03-4bba-8bac-84bf6c27a85f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771286794, "uuid": "00baffe3-9c96-4dbc-81b7-4d99d23955c7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b90650-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343320, "uuid": "443abf64-eee1-440e-be0e-8b1548a25aee", "comment": "Malware payload (Grandoreiro)", "value": "99478b8e535415e91699100a96b6c126", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343320, "uuid": "90f309fa-fef4-43e4-bd0a-fce31d05dbe9", "comment": "Malware payload (Grandoreiro)", "value": "cfc159d9d95f436e5ccce7bc3d7fd4dbf81979a8cb92366249f17b6054e6ee37", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343320, "uuid": "4b01450d-0477-4830-b888-fa9e85818ab8", "comment": "Malware payload (Grandoreiro)", "value": "6b5ee78bfb4b203928d04ebaba87cde2c6707c64", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343320, "uuid": "939aacc3-bb6c-482c-9122-f6f20e999092", "comment": "Malware payload (Grandoreiro)", "value": "0163f7b7a560450f1e1893d27b4aec12c67e80728be3f7b6187d7d4ac68110c9fb00d310c4b6f34a374158661f794bca", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343320, "uuid": "6ae27a6f-a406-4320-aacc-581a2948a383", "value": "T1EB462332FA104C57C44083B6783E3D352F3D321349C9A6D67CAE924B37469DAAB7E895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343320, "uuid": "f028b34e-f6ae-4afa-b124-e6049585a4c6", "value": "49152:6ZjC2HXMycHJFKyY4TnCZLaLogai07ak331cjOQk1Zqe4ygKFrGrySF/ZVSVni+:q3ni+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343320, "uuid": "d31f329b-15a5-499b-b896-73a320cdbff7", "value": 5353472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343320, "uuid": "a50c36ed-a533-4672-a70a-f7465ff13e43", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343320, "uuid": "b491fe41-e50f-425f-9c3e-1e83f4953255", "value": "NXNUITQRA3_Ct-164425593ZXY.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f5f79e-0c06-11f1-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1771335540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335540, "uuid": "a9a087bf-606f-407e-ad83-43181940990b", "comment": "Malware payload (PhantomStealer)", "value": "f861b69de16c690486eb4094693ea4bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335540, "uuid": "7e34c984-e8f4-416f-96e3-2d4002547ec6", "comment": "Malware payload (PhantomStealer)", "value": "cfd11ba39c99b6dfa239f8ae1611f2300af5a6cb6ccc01bea56780a6664ed7d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335540, "uuid": "8c25905f-666c-4626-856e-4f42c9d11251", "comment": "Malware payload (PhantomStealer)", "value": "8c032d986fd5283777f188415e830f1a69f89222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771335540, "uuid": "b190eccf-484c-4823-a56e-3e41634bee06", "comment": "Malware payload (PhantomStealer)", "value": "dc8863abd2d7af061223cf05ce00d5ee3b30dcf332718344750e9a4e68a9c38428d99ed6c90bd62c196be0db8afd890f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335540, "uuid": "10823a46-229e-492f-bb0b-7163ed463e34", "value": "T1F48512102719DD02E8E20FF01EB1E2B09FF45E9A9121C353DFFAADE7753A7912945682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335540, "uuid": "6f8b331d-a0da-4dc4-a23d-2097ba6cfc19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335540, "uuid": "8f650afc-7cf9-4d34-8811-338f42465dda", "value": "24576:yqu2VBtKpKgb6esVhZYKqpgiti5siSydXxxsnB52wKp8guKr1tdtqHFdMm5RTmTh:yeVDKKbUR6iYdBxcB8luKNGdnXmTa/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771335540, "uuid": "27460a85-8e5d-449a-9939-a1b5f62a11d9", "value": 1806848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771335540, "uuid": "23a335c0-a392-4886-9c1d-18ef2076a493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771335540, "uuid": "21454364-daff-4387-862d-5e2b8ad02405", "value": "MapPDhwld3IS8Z1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c3303f-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343139, "uuid": "7af522f1-9c2a-41ea-ba6e-847bb31ce6c0", "comment": "Malware payload (Grandoreiro)", "value": "b728d5ff5fc464e61ed50e2e9938901c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343139, "uuid": "234e1113-9783-4dcb-8852-fb27a6bdd859", "comment": "Malware payload (Grandoreiro)", "value": "d09ddf5f369619663b4b08978ac0a5051c1b93dbb3718fe7a3aa6dc77456d312", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343139, "uuid": "eb5c0905-1fa8-4c3a-98e5-b4397f7531bd", "comment": "Malware payload (Grandoreiro)", "value": "b1dafae5e1dbc884b9fcfe2e0ec073df26f14a9d", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343139, "uuid": "52e1dd67-47e7-4044-89fb-2f313dfbe08d", "comment": "Malware payload (Grandoreiro)", "value": "92631fd05d6e90e4a82733897f6f7f48a813c625d846d81c9415836a87f29cac0e666ae2d3a1167cbcc77c9640c390a7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343139, "uuid": "e4ca114d-1471-4019-a901-90b10511bfb2", "value": "T1C9562332BF564C6FC95083B4702F3E562E3CA6178184E5DAB89C8487375BF81992F4AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343139, "uuid": "ea9e5340-c4a3-4c24-b647-99c29d1e976c", "value": "49152:6c97c4VRjCo8JdeU1P92j8TppE7TCgwfOfmVpew+A2Mknzy6TXEXWeROWJ9VBUzz:iuim3YiU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343139, "uuid": "5c8d980c-9e0b-4e2e-abcd-39100962eb17", "value": 6240256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343139, "uuid": "6eb96e67-6631-4f95-8053-9a179fdfec97", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343139, "uuid": "7722ec73-a5bf-457a-bb64-700577d4330c", "value": "Bnfc545737AGLN-K2OY5070sziibe.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966a2ddc-0bef-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771325907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325907, "uuid": "a2634495-149f-4137-9290-57090f13c623", "comment": "Malware payload", "value": "f27ac46d42af348ae9c73caa4df56b0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325907, "uuid": "5e992835-585f-4e7b-9a83-128ba9ab97c0", "comment": "Malware payload", "value": "d14759935f5fb9fbfbb4071b8d9473b88b919698ec2740c789ba2a5b95eb82e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325907, "uuid": "c9967f73-9d0e-4cc6-a39a-59505b28cea2", "comment": "Malware payload", "value": "a0bb0f08ba0ca97a3ee83a364720db3f1e25cb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771325907, "uuid": "7a59d39d-e829-4d14-9e93-ea386d129d9c", "comment": "Malware payload", "value": "72e264a7a867fbb9cc1c734af4bf384d3ca84c8c401dc440505521017dab16cf8343b728ed939527f955d9a956ecf8e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325907, "uuid": "5c7beb11-4c39-4ea9-be2c-9d88f9e2b1f7", "value": "T11AC2286E07D501FCE91A82F5CC726917D3B0F0462EB1568F42B2D4C6AF126D2AD2C785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325907, "uuid": "daa5beaf-fa4d-431a-b3c6-dc0f75db57b5", "value": "67b2e05b342c56b6c89451a62cc934be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325907, "uuid": "fe7b2e9a-245b-4609-b2c4-6049e4604c02", "value": "768:2NIikKGe4EJYAAbFsukvZpk2AmzJ0qbOLE:YVGepEkAQalLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771325907, "uuid": "f94aeb83-e2dc-43b8-bff9-fb513add48a7", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771325907, "uuid": "9fe875ec-b80c-41c1-a7ab-f3b5cc41eb12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771325907, "uuid": "d897c8ac-6244-4e75-8233-885aa7e65a03", "value": "d14759935f5fb9fbfbb4071b8d9473b88b919698ec2740c789ba2a5b95eb82e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fbaeff-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343079, "uuid": "574388be-4a83-4c07-893f-f84c224222f0", "comment": "Malware payload (Grandoreiro)", "value": "130d27a67831bea48f9d6f524b89b913", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343079, "uuid": "25440356-9897-4312-859a-871277c14a84", "comment": "Malware payload (Grandoreiro)", "value": "d156bc127e95e93efa5aab2f1159e07d043308d28628befd9ce29ebacb7e8354", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343079, "uuid": "a28ca6f5-fa20-459e-97b0-face578fe8d8", "comment": "Malware payload (Grandoreiro)", "value": "e5c34139a7540c5128d6299e83ab9f5ba6c5d992", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343079, "uuid": "bb893ef1-6d69-4b78-8e6b-ca6dbb7ddb2f", "comment": "Malware payload (Grandoreiro)", "value": "f19f492cdf07ed8898d07e3c09038eb889f122f720c17cf73aef718b162336a8ce61e3b638b4385d35fac5e9a95884ea", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343079, "uuid": "50291cef-e02b-4a8e-aa06-554b15512767", "value": "T1637633319E940C6AC9D48332702F6E266E6C7F53468DDAC6379CB0563B87EC1892F578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343079, "uuid": "67750da3-3f60-44da-ad16-e6e632f393d5", "value": "49152:vxUABPRBNWEIiGK1H961/+Ayc84EHjxTjvkpXa4oavtPmxpMuF6WB38n3AcxIJEQ:en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343079, "uuid": "9928d893-8b2c-40c8-94a0-1b001ef00215", "value": 7596032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343079, "uuid": "202d74df-ad2c-42b2-91dd-9918e5be796d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343079, "uuid": "cd73bbee-bd82-49fe-870a-3cdd651b42a4", "value": "AnexLNMQ82447_392546237JDJVUS.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946a066d-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341795, "uuid": "b2f70839-76dd-4810-900e-12498ef66e8b", "comment": "Malware payload (Grandoreiro)", "value": "443ab40889c32cc6f9a91ae29a967542", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341795, "uuid": "5b04b42a-c1a6-479e-af7b-df98467b3662", "comment": "Malware payload (Grandoreiro)", "value": "d2057c0f06102d0e61294aa6047d4466094037e695d69e972872fe2e25b5efc3", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341795, "uuid": "18be06d4-8181-4646-b60b-876efda93dc4", "comment": "Malware payload (Grandoreiro)", "value": "fe73a706015bd09ee273480b914594dfd2313a13", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341795, "uuid": "cb83ac95-a201-47a4-82b7-b0cacba6df34", "comment": "Malware payload (Grandoreiro)", "value": "e54a72896ae7df54410ba506180ca881db231ecdcbac3b054cdf2d5761728f165a91800462c1758fe6656269c8d31e1c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341795, "uuid": "3dcb2dca-03e9-4707-a793-b5b00a4369d8", "value": "T18D663330AD915C2EC7904339701F2F266F6D7A63574CD5C239ACA1933B4AFC3956B8A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341795, "uuid": "7ad6c378-9c60-42a0-b56a-428bff835479", "value": "49152:6p5vLD3uXhMspwunAGcq8r8atV64mPM4PuEUoGSTc76P+C9DYvlm/IRxMsP+0Re+:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341795, "uuid": "19e6af46-425f-4e91-8910-d196b7a5348a", "value": 6975488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341795, "uuid": "15ed8f8e-c54e-4efc-bc9d-f930fb13c4e5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341795, "uuid": "145162ee-4c07-411d-a3b4-77be4d8c1d99", "value": "Liq-Uid609588232ZCEIZOJE.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf6cc00-0c12-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771340762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340762, "uuid": "bf1e9932-2da6-4397-b412-c37deb381ef7", "comment": "Malware payload", "value": "0c48763d4cf83d61a3bbd386de515539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340762, "uuid": "07b404f1-ef8b-42ff-abcb-43304cfb99b1", "comment": "Malware payload", "value": "d2914ca8bb938605016126adca6d800d8a6feda251e4936aceef35cbbfb54ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340762, "uuid": "3a3783a5-407c-4085-9090-cd2bb70109dc", "comment": "Malware payload", "value": "b3206dfc5dacd1f118e36da8717be8188e4712c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340762, "uuid": "9dd15c51-bf47-403c-9e58-14006b1d12cb", "comment": "Malware payload", "value": "3ef746ed824d2212ccaf01d61da0fbfdbb0af59281d7492f741a607d00b3abab0fd56c74ac6e9b44ab1dff138d7d1f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340762, "uuid": "62f30d3b-3c5c-4059-8930-0383ff59c6c7", "value": "T1B2C52324DD490C99036C856560AE1E0C1AB00F9B4D4875E9BFAE64CD0F6FBAF44B71EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340762, "uuid": "8d24d58b-db4b-40e2-a585-d471f37adc97", "value": "24576:+Mp0hXLm5tDZK/1VDYl3ulFVRxeNkDmoDhooCLGdmfAPyfukjGhiKJNVLyAy+5x3:AdynujPGCcUWBPQANPzFYW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771340762, "uuid": "a13e1d0a-ad19-4161-a9b8-d8298a5a7eb5", "value": 2502841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771340762, "uuid": "f17bb902-57c7-4fb1-9b95-b9f2c3e11b28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340762, "uuid": "7e0582ec-57a4-4ea1-b464-622aa3f1786f", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3917f323-0b9f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771291391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291391, "uuid": "4e1205f2-ddc6-401f-a362-1399b33a1213", "comment": "Malware payload (Mirai)", "value": "20c30e21a714f2c5f47fdb9ddabaa0db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291391, "uuid": "5390d501-524b-4854-9301-adebb70f02d8", "comment": "Malware payload (Mirai)", "value": "d2dd4d4a939525e89f326407a1c4a6b0211f80e6758223d01209b3b7ba76c9dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291391, "uuid": "890e17a8-ae8f-4a57-b545-3b42d2bf653d", "comment": "Malware payload (Mirai)", "value": "5dc20519ad7fd4ed2a54cc78eaade0b52e32a7f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291391, "uuid": "d58b97ad-cde7-42e5-8b2b-96624b829748", "comment": "Malware payload (Mirai)", "value": "66f230fce56696d800bb724d13722836ae9a45a33be0e9b4555c6ff56be24e0f4e030732fbbac5eedf3607a54657de83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291391, "uuid": "b606ca9c-9839-4455-998a-14c4ba29d35c", "value": "T13EB3F616FB610FF7D86BCD3746A90B0529CC551A22E83B7A7974C42CB24B14F4AE39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291391, "uuid": "9b86a339-7d92-4cfe-879c-2637e865a785", "value": "1536:pMAUIIqQHT/uaX+HA09bPH+imC1jdR3uJCq9uVXkBPZM05RDlaanzsGY:p5UIIDHzuP9bPe4fq9xhF8anzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771291391, "uuid": "dff11842-e81c-4f75-bf1e-26db0a0253b9", "value": 110708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771291391, "uuid": "4fb8c99a-0112-45be-8e14-79d4a9650bc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291391, "uuid": "7d94e301-14b4-4d64-a68c-42121c789e55", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80a53c9-0c20-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771346982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346982, "uuid": "ff4bb077-6524-45f0-aee0-cf4fb4d8fa6d", "comment": "Malware payload (Mirai)", "value": "46fa8bc601cbc393b1d410273e635475", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346982, "uuid": "a00560aa-1784-4b47-857f-9634f0e9ce4d", "comment": "Malware payload (Mirai)", "value": "d34e24978219766bb965326f67424074983406ccca35fb54a17f50fbe04b7945", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346982, "uuid": "9e3bb457-d980-4d54-804a-3084c3e5f437", "comment": "Malware payload (Mirai)", "value": "685f37b4c12dc6b533dc001dae850ad728ff882a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771346982, "uuid": "f36c4a1b-290f-420e-ae0e-baa6dbb0c993", "comment": "Malware payload (Mirai)", "value": "9293bfc898b3751582b3fd922f64fb56be86ee9a2ee25eebacc4b2c5e15e1b76ea0165a165cc9ada5f7f51aa7c95e73f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346982, "uuid": "4517fb08-2d9c-42c9-99aa-94fd25e9d7ae", "value": "T1DC632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346982, "uuid": "5ee3964f-c54d-46bf-bb4a-1e1147b83e90", "value": "1536:lGBVg7AOotXhGIAsQXt3AvQAQm75YH/tat0V:lSCzxBwQmVNaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771346982, "uuid": "8b3e92ee-d6eb-4ddb-9f1c-15b2c80e392c", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771346982, "uuid": "a55a1fa4-3250-4131-8cac-c5246b3b6a4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771346982, "uuid": "be6ec4fe-f21e-4bfb-b95f-f3a2761e6d0b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e26a78c-0be3-11f1-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1771320685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320685, "uuid": "277d1a0f-491a-4bf8-bf8e-fd48ba711135", "comment": "Malware payload (AgentTesla)", "value": "61d3e4078e531fb21a4bfaad9e2a9f0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320685, "uuid": "4e37173b-9fe9-4dca-bd9a-eb30f3c9f671", "comment": "Malware payload (AgentTesla)", "value": "d386e318963a675eb25ed578bc57c704e910575e8c28272eda7f6320b9377035", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320685, "uuid": "093d4df2-6893-43d5-8305-455e2d69574a", "comment": "Malware payload (AgentTesla)", "value": "614b741cf2f5be411fe17f649f64eda012b5bb12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771320685, "uuid": "e1bac794-78d7-4240-9e88-7e019a2e827f", "comment": "Malware payload (AgentTesla)", "value": "3d139dfb2a13ade9aac321e1e9cfdb5a2441508d52c3c219ab42f4dece7ca2f3af061e5b04affaf40f39e7370ea602c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320685, "uuid": "aec114b8-c80d-499f-87b9-cd4bdfa8b76a", "value": "T10EA4B819B6D9BDA0C5CE773AC38B580017F69C943FBAB30B678D2615259F81BDC4A2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320685, "uuid": "f198fcb1-9b42-4bf8-a160-883a7902285c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320685, "uuid": "c713c1ef-da3f-4656-9767-96a7952268bc", "value": "6144:gjwaq6ZATdqRLh4McCZ/hPCDihb5QngvPCzaxcinIFaXO0jF/BxP3Kn2ZBKTw05:gjwaJBDhPCWo1cIq3J/yTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771320685, "uuid": "f406c964-6ace-448d-8ce6-db8e9ecef3bc", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771320685, "uuid": "7ba90713-a1bd-4d05-985b-23507c301229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771320685, "uuid": "26cb8d31-29eb-4399-9390-aee403a29464", "value": "d386e318963a675eb25ed578bc57c704e910575e8c28272eda7f6320b9377035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9199e967-0c2e-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771352957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352957, "uuid": "4e311328-1231-4405-aa33-b705716dfb21", "comment": "Malware payload", "value": "63426f624c930a756faf7ce3e7b4789f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352957, "uuid": "902f8960-c552-4483-aa8c-e854876a8e68", "comment": "Malware payload", "value": "d38de5d71d04dcd70039b897c2edbc0981ba8940c249872f7c3a77b60abb3955", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352957, "uuid": "14b237f9-3faa-4849-b318-63360528cec5", "comment": "Malware payload", "value": "a609cf9a7250e6fbfc4cd3fdf04ea64b5a535617", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352957, "uuid": "2cb15202-8e5e-4d27-9be8-6ce9fe46892f", "comment": "Malware payload", "value": "45a1593d170800f2a041e5eec0246b513030cff9bb52054a1f2804ffc219ef5a46dd7ea2ff13363bc1111fb3aed5443a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352957, "uuid": "87b742a7-72fb-4b4c-ba4e-dc7e7cd28c7f", "value": "T117C633987DB1C897599B3B540BC62AF0F7E446903D84744BE910274AE93739BCBCCA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352957, "uuid": "d5c8e62a-f576-4da9-9aff-bbbcd9222a86", "value": "196608:wBCqhCg/qJmTFDrfroPZ+8gI7yGR5tyoyHSd0kE20+7ya74ka+D1uY+otXjiCKYG:NcqJWVrfrU7/+c5tyowpDQ8Il93Dvsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352957, "uuid": "017e7c75-d071-4a4a-97bd-33cfb0f53e97", "value": 12430156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352957, "uuid": "6f2aa1e6-9812-47ff-9b02-6ae269c670a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352957, "uuid": "d7315645-fb63-4cd8-b5fd-4355036ea5f9", "value": "spisok_ip_adresov_narusheniya.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1562b7-0ba7-11f1-a129-42010a9c0007", "comment": "Malware payload (SantaStealer)", "timestamp": 1771294858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294858, "uuid": "0c8eb554-d404-433d-997f-17084a254849", "comment": "Malware payload (SantaStealer)", "value": "e63171634c92f0170eb5bd64bd2e44b6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294858, "uuid": "023860da-98b4-458a-9785-0bd5fd4c3906", "comment": "Malware payload (SantaStealer)", "value": "d3fb6919ce5b708d7e4f50e49050d5c497f658f89951418c4f590d9476764271", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294858, "uuid": "6a88e10e-0dca-4f07-a500-97d79f8f9f26", "comment": "Malware payload (SantaStealer)", "value": "8ca0726ec0ad8cd8758f3e47401b374b5a0a2d7b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771294858, "uuid": "eac0ae82-5c75-4abc-8c87-6d8233d21fd2", "comment": "Malware payload (SantaStealer)", "value": "5a503fa49e921626ae95d04cac209232d2a06980bdabfec77adc4d1c4f9eb9f98822e6d063239e2ebd8c7be51dc5503e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294858, "uuid": "93c0c480-857f-4d9f-8fdd-6bea9773bfd6", "value": "T1AA1633B44C836A32D264C031D1A559B7C673906E1EEC6E7C27E0ED192F533E2936DD2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294858, "uuid": "300e9c0f-314c-4276-a709-8c0ad7531078", "value": "459038dd913bd7fa2746dd2acf101131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294858, "uuid": "7d2c1027-a487-4ccc-8b8b-df96d19d662f", "value": "98304:1cJsFhY3bgEkgZObJH2bwQ9Pb9feOGRRU7/Kat8N0:1cJ3PZObYbv9Pb9feOGI7/KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771294858, "uuid": "2ab1c978-fb2f-4bcc-aa4e-b40649a45e02", "value": 4101632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771294858, "uuid": "8a53e60a-6824-464a-a106-9a9cadd40d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771294858, "uuid": "74d0bd30-79f9-4da3-970d-c7c4fd44c05c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d07330f-0c11-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771340467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340467, "uuid": "87243e45-426e-4028-a713-3759648647c8", "comment": "Malware payload (Grandoreiro)", "value": "eaaa1b9148c1740c88bf663c68ffe5a6", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340467, "uuid": "deb69343-b603-44c6-8f97-8a4a8b8b6753", "comment": "Malware payload (Grandoreiro)", "value": "d4b64dff66263ae6bb7a97147f11bb528bf068a956cb46954d5339b00e9525b5", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340467, "uuid": "4a79f788-fa31-40d8-9e70-30f1004812f0", "comment": "Malware payload (Grandoreiro)", "value": "9a73c8ac6be364d71c727f66ec5ff7a9aaf12064", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771340467, "uuid": "1ff66419-dc40-4de1-b605-953f69cb61a6", "comment": "Malware payload (Grandoreiro)", "value": "29648c7ce3e353d345b766a56597493e3b4cc60285feff1bd827f36d71b957900fc8a3a738e61833d2ee5de3c37909de", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340467, "uuid": "37c24150-10be-4156-ace2-2573cb3586ee", "value": "T1CC663332AE512C67C9A48334F01F2E362E3D7603858DE5D674AD91873B8BFD6452F898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340467, "uuid": "896e44ac-b9ca-4ad0-b876-c6715d546d7f", "value": "49152:PHV+nRnX8LfvXfkVp48d1arFOFhs2tgqRHYTN8p0jenxkrsQ/9VB6exRcb435xyV:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771340467, "uuid": "75880ff1-1a72-4b4d-846b-484c4c1bb2f6", "value": 6746112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771340467, "uuid": "a2e5af18-0992-4c56-b5c5-92849e2713a4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771340467, "uuid": "d9663817-0e27-4a85-9348-010276cde4f0", "value": "IJSADZRIZCNP_Acr1991-9V6G3.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964f95d7-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342228, "uuid": "f9bcf601-dff1-4b73-ac57-dbe1e361c549", "comment": "Malware payload (Grandoreiro)", "value": "4e04ab8f1a54ca870c899eda241d367f", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342228, "uuid": "803dd40d-0406-4908-899d-13fa77f38025", "comment": "Malware payload (Grandoreiro)", "value": "d59fb9ad4613bdbfd835ea5730d794472b0d1797154e11ec7226b1b148a582fa", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342228, "uuid": "77e06ab0-2a27-48c6-a014-5065e476ab32", "comment": "Malware payload (Grandoreiro)", "value": "5ca0875b007a71dae5461da16a959fd48b25392b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342228, "uuid": "3de9d892-5622-4874-b1ad-f76e2bd11310", "comment": "Malware payload (Grandoreiro)", "value": "31ef0478a5071898d1479bfbc59497aedf45e0d3c3994251a30e5c0e00fe2a070e3eb644326d30644d2885af7f61acbf", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342228, "uuid": "56e6df6c-3f63-47a3-a72e-13d1cbf433e4", "value": "T13A563332AD811D5BC6808331B46F3E2A2F7DB70396C8D5D6781C9442378BED2CA6F599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342228, "uuid": "2621e193-39b4-4425-9caa-767a3e967ff8", "value": "49152:PAU+dCouYpwb8izAzghd2PzucCtGaDNP+hEnSW50Irp37iXYlVdOSnJGdT6exbWd:Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342228, "uuid": "5a70618d-06bd-4fee-8e50-521726ffdcb4", "value": 6027264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342228, "uuid": "02948eba-98f0-49e6-a204-ae9f1ddeef19", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342228, "uuid": "c5f3c4fd-30fd-41a9-b815-cd8470412e91", "value": "726556Rcb-UFQGG5F6LC1088YZLINL.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcdbf04-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343317, "uuid": "02adb158-564f-4f9b-a39b-d4363f83efa6", "comment": "Malware payload (Grandoreiro)", "value": "027e33e9ba7a77af1f83b966899a2300", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343317, "uuid": "0756261b-b1c6-40f9-afdd-5ae665b191bf", "comment": "Malware payload (Grandoreiro)", "value": "d5aa09c33c873d4c6e14c6505d21fc3b7c397e711da17b1f7ba2d91d2d2d4f86", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343317, "uuid": "d250ad94-2f1e-4fd8-a3c7-b53a50a4b172", "comment": "Malware payload (Grandoreiro)", "value": "8379dfb791f352d36bd83ec0bb899ec23e78c453", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343317, "uuid": "039643d6-8997-4805-ab79-adf49cd832da", "comment": "Malware payload (Grandoreiro)", "value": "6606d8eb30ece7dd010504832386744fe4876afc7242233d18fcc75fd8b2a9c8d32de233d0daa2937a61f9a1a2f6f88d", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343317, "uuid": "95c6258d-5e00-4eae-9404-1fc1734ccfff", "value": "T13A563330BE844869C6904376302E3635AF7D7A23878E46D7299CE247775BFE1C63E492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343317, "uuid": "2931baeb-c441-4bce-ad81-9551135f2edf", "value": "49152:AtvzL8GVQ6bMzZIcHHxBXjMWcgICtvlnW1T+sG0ZA4IO7bx+0cS6GVqzjGWwKDTa:zA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343317, "uuid": "f65f109f-d422-4f8e-9ec5-c42fa085c8fd", "value": 6283264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343317, "uuid": "7c97436c-db35-4868-ad15-e87a96c89c33", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343317, "uuid": "e2031735-1dd5-4ff0-9af8-08d7701a979b", "value": "NX2AO8872TZJNEUqalqh_Desv21477.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948f5855-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1771343513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343513, "uuid": "4b0dc1ed-3e7b-42a1-b080-fbf21b3034f5", "comment": "Malware payload (RemcosRAT)", "value": "5fd9ec900c09527ac363f8e4b6dc3160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343513, "uuid": "1ead1edf-03f3-4faf-b88b-2cc388ec1418", "comment": "Malware payload (RemcosRAT)", "value": "d6fa8891a75373ce59659837bff519f9caa1882a59a417a453184793ce419c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343513, "uuid": "47e9742a-70dc-4ab5-90fd-374ba445a44a", "comment": "Malware payload (RemcosRAT)", "value": "fc7ed41609c2930f7012572a251dacf18f642269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343513, "uuid": "c6bcc66f-5b4d-4778-8185-f013d69e0090", "comment": "Malware payload (RemcosRAT)", "value": "f4c6b31f804acac6627355a1855752918ab6a211bce64f8bd8c2a324ccfabde593422881fda345c8a0a0827aa3dd3206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343513, "uuid": "6a551c11-2dd9-407d-8406-8a0b099bfd2c", "value": "T14EE4CF01B6E2C072D97655300935EB35DEBCBD20183599BB63DA1D5BFE30190AB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343513, "uuid": "617f63e0-f114-47b4-bd33-9381a2fa6b09", "value": "63e9c7643fc39f184f388f94c9495f00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343513, "uuid": "a6984efd-390c-4927-b514-2f56e1a57064", "value": "12288:FlNG8R4sXM9wpXFnJENlHV9FGeDWv3jADnyYiCNrsPZlA:+sXAwyNlHfFjDu3YiCNuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343513, "uuid": "5ef373ed-2027-46ca-86d8-3a806a1e32a4", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343513, "uuid": "43457739-8540-47d3-b9f0-417be1064031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343513, "uuid": "eb36b601-f98f-49ad-b9f0-020350af0081", "value": "d6fa8891a75373ce59659837bff519f9caa1882a59a417a453184793ce419c00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493bd77a-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312892, "uuid": "ccbd9174-73ac-4299-8df5-e9ab501880c7", "comment": "Malware payload", "value": "8f8483961c57438cf1a460e4c4f0b328", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312892, "uuid": "f4a1768e-8f9a-4454-bb48-07b33f845095", "comment": "Malware payload", "value": "d7340e6ebd71590ca9bf8c864ce67c3dcef15b493a3679372db5624483c8ad98", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312892, "uuid": "5f1d96c4-0054-4689-8389-398a68860cfd", "comment": "Malware payload", "value": "9d272c3a42a267cfad28f990e41526ad1b993aaa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312892, "uuid": "618109f0-f9a0-4b78-865e-2d8f4b9591d7", "comment": "Malware payload", "value": "5172f706c24f7e3ef8199412bfdbff776039c1d6252978ae61af787367442c9dbd27e79333fddcfb454cb5adec8362dd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312892, "uuid": "874c9cc2-b9a9-4461-98d6-cb4fbaf7dece", "value": "T1B551815A9F0DA27D49604343CB2BBD4DC7E8557E6300A824BD9CE48C672832CC2E91DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312892, "uuid": "321d5b72-b59f-499e-8ab8-d3a25a28e222", "value": "48:a82bsaQZAONd6ddoLTPErVsBAE8aifLv/thIJnf1kcW78uvLa6UC:5gdddSgsYfLkFajvL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312892, "uuid": "13fbf19a-3d95-42f4-a27c-c15d775a6b4a", "value": 2732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312892, "uuid": "af34870e-7a66-4621-ab5e-49b218d54a94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312892, "uuid": "fd3eb6ab-f17a-42f9-a22d-76b19a291a32", "value": "trqd_81.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4dcede-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343335, "uuid": "84f6569e-fe53-499d-94fd-e8b77db52dbf", "comment": "Malware payload (Grandoreiro)", "value": "fc5fa97c6ae25279cbfb39c8be896964", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343335, "uuid": "96a8d50d-6775-4cb0-a391-cdfca2a9ccb5", "comment": "Malware payload (Grandoreiro)", "value": "d74a85e343bca0978ef7842dcdc74063f9e6b2b4fa9b39563939764f5791290e", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343335, "uuid": "3b76441d-514a-48c4-9187-b0f4b5602438", "comment": "Malware payload (Grandoreiro)", "value": "44998ba4f74f40c60b61bb2409ecd69d2a13fc18", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343335, "uuid": "a69c4704-9c72-44aa-99a5-d4ef4a2ac97e", "comment": "Malware payload (Grandoreiro)", "value": "d041cb7305321669ea9ed580e2ae2ed435665b2031348409d09f4012110ccbccff15e4a8169188cc31892eab746b4038", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343335, "uuid": "8806442e-a234-435f-ab27-b9e5a0a63ea9", "value": "T1DF562331FF069CAAC5904372B12F2E252F7D7603514896D7FD6E61473B4AEC1AA2F068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343335, "uuid": "8aca0fa9-2fef-462b-83e3-a3b5fe0d2466", "value": "49152:1I62iyjaBAi8HzdpCEJl+SSFHUVxkh4acX0Uh0+Vqh8x/gTmwiuTrmux4Nu1INSx:cuim3Yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343335, "uuid": "2e403ad6-4a8e-4d33-b859-519b92682f65", "value": 6156288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343335, "uuid": "14a9871e-ba41-4663-8ef5-f51c4f0b207b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343335, "uuid": "bf037938-9c5d-4098-a1b4-62394c5128d5", "value": "Oblg1D63_5296UZGJOD-O21T.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78ba464-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311440, "uuid": "da5c4c44-7f2f-46aa-a22f-689d925e5bc0", "comment": "Malware payload", "value": "13677170df68fa7b52836cf92270abfd", "object_relation": "md5", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311440, "uuid": "7e8abde5-6e96-43a2-a8aa-c8fbdc2d848f", "comment": "Malware payload", "value": "d7959f1fa97bb5a45af9292d302d30b56be5db0671a369b48e7c71ab4d27def8", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311440, "uuid": "2a8c8338-6157-4dfa-a65c-bccb8beabbf9", "comment": "Malware payload", "value": "a1677496a8ec2e881c243af4392514ea2dac973e", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311440, "uuid": "9cae051f-ab9a-4d09-b8bc-0ae18f769a8e", "comment": "Malware payload", "value": "8377b66aecdc0ce70fb0c0a469e0a6905585bb53cddc33e914abe2370e682b87269ff77a4304d500859a89b5c137f96b", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311440, "uuid": "bb0cbc34-2b3c-4536-a0b8-06a7b17bd71d", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311440, "uuid": "37a906a3-e793-4373-8aac-34064463457b", "value": "3:7dIIFR83ExyOGy:j8UxzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311440, "uuid": "0d0bd023-e8e2-4b6f-be0f-3e2e538d0982", "value": 42, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311440, "uuid": "6467da71-7129-4f5e-890a-e36021153c06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311440, "uuid": "9fc44582-7597-4cae-81e2-811202692297", "value": "d7959f1fa97bb5a45af9292d302d30b56be5db0671a369b48e7c71ab4d27def8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc30bad-0c35-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771355954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355954, "uuid": "9091b927-0371-4fc0-81ea-1b7b4bad3eb0", "comment": "Malware payload (Mirai)", "value": "a0e638fbba628b5081318f57beaf9a15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355954, "uuid": "5aed3c31-3da0-4c88-b398-0e7277451045", "comment": "Malware payload (Mirai)", "value": "d7f2ad89052cf874f2ed80ddc4b4450af1474a53d0152afd444f0625c1109a91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355954, "uuid": "f632638a-eec5-4ae5-9cc2-d268326d6b45", "comment": "Malware payload (Mirai)", "value": "e046783897e0fe1e1951fdf371cc755b9e74e939", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771355954, "uuid": "9da1af53-a7f3-4450-a882-953efc1b4bb9", "comment": "Malware payload (Mirai)", "value": "3385dcf3f273c7d0548db5dbb5c91082f37aec32d40123705bfd979fb96113140c8abb4d85c9a6b5b6932e3f8847df3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355954, "uuid": "e7f8fc56-115f-4e0f-85d2-84d080a58ff6", "value": "T187B31A46B9919F12C4D621FAFE9F458933136FF8D7EA3102C8206F54378699B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355954, "uuid": "bdfa4019-4bbf-446e-85be-c365c47167d6", "value": "3072:lBkvhQKG/6Y8K4gxqCaRFEYZbdWltmwcBrEbxyEDWa:IvhQGK4OqCabEYZbdWrmylJWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771355954, "uuid": "9d37ad55-3c8c-4c7d-9c8c-e168ba759142", "value": 110664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771355954, "uuid": "bdf15233-e340-4373-83f8-338c56715552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771355954, "uuid": "08b8c99f-a43a-4d6f-a5f1-7f41c2dc4c3b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51acdc51-0bc8-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771309041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309041, "uuid": "2331ef4f-9b30-4a67-b1b8-76fbc8ffd2e0", "comment": "Malware payload (Mirai)", "value": "c274519f01ac7f6ddbd9269bf6069254", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309041, "uuid": "60f68bf3-b1d9-4931-97ef-38e453a3edbb", "comment": "Malware payload (Mirai)", "value": "d7f328b5b389154a385133d34b4a65009e6a268a6fea507819420cdb7a3155f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309041, "uuid": "56cc1cdb-c0dd-48ad-9945-2e51eb2fd598", "comment": "Malware payload (Mirai)", "value": "45edd39cfdd8693af669790f236132d28215abbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771309041, "uuid": "4aa0073f-b8f5-4e23-8d4e-f8e0b1582634", "comment": "Malware payload (Mirai)", "value": "466c9a85c6f02dc6bf6dc519fe816e99e3a7da3078f8984c0d2268fd4b201354e83cb1ed17934f8118e104ea3a8b62cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309041, "uuid": "8b6eb846-0926-47d4-940c-c097b6be70a9", "value": "T1D4533B47FC818E11C5D106B9FA1E218E331353ADE2DF7212AE149F6137CA92F0A7B856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309041, "uuid": "c4beb115-bed6-4906-9629-bb04ed5c5396", "value": "1536:Zen6CT/fKfJ+rxNOiKSM9QFM/i8jVF3QOr:K/f38jVF3QO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771309041, "uuid": "2b29b52e-d4b6-4faa-b73f-feae6aeee392", "value": 63208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771309041, "uuid": "039cb58f-817b-4e74-9404-4ab5e57bf232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771309041, "uuid": "7010cf85-243d-4050-b4ef-0d5d16bde6ec", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d06ba7-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342126, "uuid": "991fda52-021f-4f53-b584-fa8aa2ac9fe1", "comment": "Malware payload (Grandoreiro)", "value": "006d6e5b2a9bd9642dc7d1581af311d8", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342126, "uuid": "87956267-1000-4950-979d-c2cc3ef73e6b", "comment": "Malware payload (Grandoreiro)", "value": "d89d20cba74b7f2fc99b1411709ba17d6aef487f1321ecc64463492191b3cdc3", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342126, "uuid": "686c472a-28b9-4a7f-bedb-f52603fbf8c9", "comment": "Malware payload (Grandoreiro)", "value": "96a8a568cca8db0e5e3e3908baa8923bb280b000", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342126, "uuid": "31af4738-c9a4-4923-970f-945698d3e51b", "comment": "Malware payload (Grandoreiro)", "value": "6c8542697f1c9e6cc98c98cdbc2b2549bbf2f811b52173165907687dfd34ff616788852434b7bdf968a49d5c38264192", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342126, "uuid": "5e7e2609-d4b1-4a9c-940b-15d6dc7504db", "value": "T1B7662332FB441866CA118376722E6E367F6C73038C8CDBE2659CD2467707ED2963D85A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342126, "uuid": "7c2fbe35-8ce9-47de-8f94-01c209ce67a5", "value": "49152:AsHkBlkx+6MRDWqfqBz8KqlI5hXXfyA9AT+uSrMBiq/pwtjHVfaOwFKw6eWGEjoL:Ouim3YqcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342126, "uuid": "afa39fda-3a61-497f-8a50-e5bd19a58777", "value": 7104512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342126, "uuid": "724cf92e-c80c-4b9d-b233-ca7a38ba8050", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342126, "uuid": "0cb6a605-ee32-427a-a65d-b1108d85bf3c", "value": "398655Pag-O4FX68QNTGDJtukgio_Trm1794870MYN.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05da7cb4-0bce-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771311491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311491, "uuid": "cc776423-a0f7-4628-ba39-596f9aeb09ba", "comment": "Malware payload", "value": "d8dc70e0258f25b35fe81477b9f4f15a", "object_relation": "md5", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311491, "uuid": "975a39b8-db4b-4509-8c89-b3d8819abf6d", "comment": "Malware payload", "value": "d980a44bbd47c8d29f21229ef8e5a442161da94369cbd0984ece090914b0eac9", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311491, "uuid": "8d422505-8fb1-4396-b90d-854f95db4ae2", "comment": "Malware payload", "value": "54f0a186fe1c6580cf7a70b9e92b3fd795524790", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311491, "uuid": "e9d87aaf-ffd7-4f6c-a0cc-7c4f597946de", "comment": "Malware payload", "value": "036c093ec3c207995072d07fe6a48ee45e2d820722d1b04a203ad3d6d1ffcf06026f11baf3b237041cfb7887e4748560", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-219", "colour": "#5955F7", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311491, "uuid": "2587ecef-ea33-4e75-bc62-7dcb56686ca5", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311491, "uuid": "7eb3754e-3055-45ae-8042-7390e1f47cab", "value": "3:3JyT3Rr8EZv:3JINDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311491, "uuid": "0819cd8d-74ce-4710-bd1b-e48e8e0f47b6", "value": 30, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311491, "uuid": "9822ad24-3383-4881-a94f-8932bc746bef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311491, "uuid": "1f257c83-771a-4d27-8dd3-f2d46ef54138", "value": "d980a44bbd47c8d29f21229ef8e5a442161da94369cbd0984ece090914b0eac9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a6f727-0ba3-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771293163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293163, "uuid": "4857d397-8959-4f1d-a881-d9edf9a5cd00", "comment": "Malware payload (Mirai)", "value": "76b6500212542c3a2f41e6420605f174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293163, "uuid": "95451b8c-58f1-40d2-b299-1a9aa17d2110", "comment": "Malware payload (Mirai)", "value": "d99b7e2a66f9e9358b8355478f423670a9d383c6c431979758eb7c0a0d53c083", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293163, "uuid": "72b31e4f-8acc-4a15-978e-d5ce8e5a1c6d", "comment": "Malware payload (Mirai)", "value": "425d937658688774f75aa55e582ad873d59ee707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771293163, "uuid": "01ce162a-1241-4515-b39e-fb4060873aa9", "comment": "Malware payload (Mirai)", "value": "9b4e50852c74a8497025d225bcd49272602dae370fdfcfe8d226392821543285c361f0d1cc4817d0b6ee7a60b90deb63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293163, "uuid": "38bfc49d-c900-4a77-a20c-db96358ec52c", "value": "T169B43A55F8809FA1C6C12976F64D86AC33134779C3EB72069A245B343BEB86B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293163, "uuid": "e03add44-34f2-40a3-bb3a-a139b0562eb1", "value": "12288:xbQV6S86XxBO265zdyZhU5KnaB4XNIN+P4gpjrMn:xboZ56FdwhU5KnTqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771293163, "uuid": "c741d82b-7aac-4199-99f0-3dfe2ca61c0d", "value": 516976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771293163, "uuid": "2685d574-f58d-46e9-bd3a-e6b966f8b3ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771293163, "uuid": "2e509901-239f-422d-a5f7-1de439de021e", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b7ac3f-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356507, "uuid": "4eb557df-b17e-41b5-a7e4-abe32032a607", "comment": "Malware payload (Mirai)", "value": "e25d311d60fb4d7b6079804d1392b2e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356507, "uuid": "61c4ce85-c410-4656-ab0a-ae73773ddbac", "comment": "Malware payload (Mirai)", "value": "d9e3664ac549e597977393a429a479fa2df95a73aea1828f45979025d7a2ccb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356507, "uuid": "831f412a-ecee-47e0-adb5-df97fda68a06", "comment": "Malware payload (Mirai)", "value": "b3d067eb87f464042a64750e6b5b19348099d786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356507, "uuid": "1bf20338-ca99-4152-9bfd-dfd6458aa48a", "comment": "Malware payload (Mirai)", "value": "6233871a929bd4f44c6491c80e15d4d008bf6bed619fd7631f6273304ee42d6915b64b82b4b19fb64a52c4a5708783d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356507, "uuid": "634f88d8-1154-42d8-ab77-1b3815552412", "value": "T1E513016B32B6947CC41524BB014F12CDF9BB249ADE4B8FBF50AD52EFEC539154319880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356507, "uuid": "749f2968-ead4-49c4-b499-1ad8139db619", "value": "768:SAMjByj6AmSw7jj5EjXsT227gKpA6PP6Wf9J96yIIbT2C+x0rwb:d8y+vS+REjXsTYKpAyP6Wfb9lBPYjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356507, "uuid": "ba022be7-1956-4797-8cdc-e9b68bce050c", "value": 45108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356507, "uuid": "e42f09c6-afa2-4fd6-9394-2abcd9b2f7b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356507, "uuid": "28a60c83-a64d-4552-b5ce-e5d942b218ca", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5abbe03-0b9f-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771291653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291653, "uuid": "1cff7490-c2d5-4fdb-b872-c6d70dcfc46d", "comment": "Malware payload (Mirai)", "value": "aaeff1b096a170d819f45f7bbbb160c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291653, "uuid": "3ff6f6cf-c864-4c70-ad32-642f545261ce", "comment": "Malware payload (Mirai)", "value": "da6b8a75f377000287e1fad7d0b7073cb1dd88b6b75d0239d4a14a800bc557b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291653, "uuid": "9060ccda-f087-4d59-b695-e071d8934019", "comment": "Malware payload (Mirai)", "value": "d7c404691e3734885a9a3a1fb2d4cd10b3cffb37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771291653, "uuid": "04380dc1-0766-45c3-8a2f-40714da8dba9", "comment": "Malware payload (Mirai)", "value": "2d252e3df186d45fa96c6c667ff3f01fc8043859c20897146b60176b53e02fc18847999284b55fa5ad821d507d107020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291653, "uuid": "eecd48e2-e801-4841-8db1-286fdeb0838f", "value": "T1BCD3980A7F228F6EF669877443F74E31975837D61AE1D684E1ACE5441F202CE241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291653, "uuid": "141c2620-5920-4487-be7d-942a6ba0ece6", "value": "3072:J+Fa0R2VJ3VInbaDUnr91Xt5NmpsCmczCcc/wtiq:J+FnRadSnRjVtCGcptiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771291653, "uuid": "3bd54edb-73aa-4b29-8de1-ab630545f9a1", "value": 132880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771291653, "uuid": "8d2fc5dc-e1f3-4092-a58b-bcb963cdfd62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771291653, "uuid": "837637b0-e57d-4d93-b125-94077745d190", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc188fe1-0c36-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771356491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356491, "uuid": "db1e0a0b-0fe2-4726-b6af-4484caf37d07", "comment": "Malware payload (Mirai)", "value": "8677bb4b1339604200ebdd3399801868", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356491, "uuid": "734440a2-9e99-4680-a4ee-72f62cb3bc7d", "comment": "Malware payload (Mirai)", "value": "daa0c1be97b68f3073f7b02845e9b8c6085dfcd5d32a80e4b39fe79f78b4ff1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356491, "uuid": "e57ff706-fa50-4e9d-81f2-ff4842cd809b", "comment": "Malware payload (Mirai)", "value": "21a0ab98ab51dcdcbf57c8066aef3d8fe50b7fb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771356491, "uuid": "ac31d9cb-c6b1-4d0b-8771-d74874dd1c0a", "comment": "Malware payload (Mirai)", "value": "fd1dcc7a32bd8ea417ea2c883c2e96eaa0a4d592d1d2af1ea62a70ccbdd744498c2b6ed58d6238eb2e98d839cd2d57f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356491, "uuid": "cfb71d35-c12d-42b8-a6f9-e888030647ef", "value": "T1D62301AEB64D94EFCEED3EBE42AE1B464D1371C333845B43CBA648C475A90057AE4039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356491, "uuid": "1cfa5c03-b536-4fd9-9a35-9e6512ddfaac", "value": "768:l7paSl+zipwOavSeqRdE8BsUCuxuips0FKO/v23nkrjAWi:l0Sl+xhpqRd5Cusx0FKCve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771356491, "uuid": "607c0e0a-d304-4ada-a0f1-d2301c92571d", "value": 47256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771356491, "uuid": "5bd162d2-0323-423c-b9ce-66ecb97074a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771356491, "uuid": "4eb4ba93-9e98-4624-a439-e148da0c79ac", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8fd6c6-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353836, "uuid": "48e1451f-43aa-4abf-a83f-c360c4b4006f", "comment": "Malware payload", "value": "c00bf60a98812ae5f57926516c0f242c", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353836, "uuid": "37f0873e-b93d-4a77-a6be-e2c2a41d0df1", "comment": "Malware payload", "value": "dacb30c307569031f51f7b36f54e39c2f26e9295ffa404a17941c8733cb9784f", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353836, "uuid": "cf165567-ee3e-4f3e-b0b0-00c338e6d2c1", "comment": "Malware payload", "value": "afec4ecfdc9fe17bb6fab0227c386255e372207f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353836, "uuid": "eeb7212d-5429-4e80-8804-a797178c97ef", "comment": "Malware payload", "value": "e518740098a9cf61fd242e25e79fc7d8bf662945367452d59f4700a669d6add640296646096104edf4c17e2630f7631e", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353836, "uuid": "48b31673-40a6-4585-9040-927689130447", "value": "T1AE362335BE440D16C8504372BA3E3E351F7DB203428C6ACA2DACD3577B4BEEA167A495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353836, "uuid": "ffac2e63-f572-4479-94d8-a73842c417f1", "value": "49152:DwPj46zGeV1FjAAX88sM67F/eGdVZJ7x0csqP/9ielXf3FBYon:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353836, "uuid": "79da256c-7da3-400d-b0aa-edebbafcc4ef", "value": 5345280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353836, "uuid": "c2f8c0b1-b4d2-44ba-8178-15d2ffd79339", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353836, "uuid": "41144b22-07f8-43ee-8d6b-16669403a4bb", "value": "Rpt6JZK2-ALZKHK3437_AnI40N7A.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579fa646-0c14-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771341693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341693, "uuid": "b178ef86-da80-44ef-bda7-23e863c2576d", "comment": "Malware payload (Grandoreiro)", "value": "675e897977b2e5cae7d6514123fcb85b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341693, "uuid": "d2029277-4ae7-43a0-85f8-131368eda03f", "comment": "Malware payload (Grandoreiro)", "value": "db2b4b770c0f3133f3c16145317adc61d3722e3897e11fcb415e08cf29a8e8a8", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341693, "uuid": "75cff721-2488-4394-9ede-8bf1b5af9350", "comment": "Malware payload (Grandoreiro)", "value": "bf7f0003cd9f093daa9287b512e0b44dd07d1149", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771341693, "uuid": "ee96a201-dd93-49cc-ab49-e96fa89fa1dc", "comment": "Malware payload (Grandoreiro)", "value": "e5aa75d31aabc03f6e8d12ac6487359696f53e1a8675985e8da462437a53186b8d94c390bff4c3eaf416016ff50057c6", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341693, "uuid": "30018069-9cc0-4ec7-a805-bbe1badf063c", "value": "T16F663331AE915C3BC3E04735795F3A224F3D76130A8DE1E674AC6896274AED2E07F096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341693, "uuid": "7e3fc390-6877-4c0c-84b4-014202949e91", "value": "49152:OwvGZv1I2UFytTRNHDkJesDt/GuNh6b8KWFXdE1noigK8kReL9DOrTjXuNhWzXut:wkPyWXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771341693, "uuid": "0b7a2f78-33cd-4ea5-bc26-d7cef4c7df3f", "value": 6776832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771341693, "uuid": "edb5d912-4239-4365-9155-aa5f75486f5a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771341693, "uuid": "f18eaa4b-5734-46a5-b5c9-f1180bd2118e", "value": "0Mrc-Antl841572HFHP96VU.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4bb505-0c52-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771368199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771368199, "uuid": "8c3a4a66-6878-4e0b-9cbf-7eb3793fc8ce", "comment": "Malware payload (Mirai)", "value": "fc3aed8c44471b963bf9f5c73774b35f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771368199, "uuid": "841a2e00-81ef-40b2-9655-8294c2e5df41", "comment": "Malware payload (Mirai)", "value": "db5af46ca41ba7b49819cb4d70c9b6791410e36445801d5c09708589cc58de48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771368199, "uuid": "581516c1-bf79-4b31-9ee8-d0cb466b5d7b", "comment": "Malware payload (Mirai)", "value": "c2fc27b8f75c3abe411ced44402c31e267a15e79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771368199, "uuid": "511a4540-d372-4b51-9d22-2af2a68f10f4", "comment": "Malware payload (Mirai)", "value": "468599b36fbfdf752a0e8e70d554908d657aaea9db887d426a61115e17bf7e4bb504df4a3d4356f5f81cdec7b65967a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771368199, "uuid": "e25cb01f-765b-47f4-be92-aba8f50c9242", "value": "T11A056C1BB2B374BDC557C03443EBCAB2A935B43502226E7B55C8D6303E56E701B1AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771368199, "uuid": "3ec1554c-e698-4e8a-ac0e-3037f726fb72", "value": "12288:mAusGq838R4sE0D/JkqEvdh3obv9qvdoUbt5H7ETbg3xNZdzuFY5JykrtY4Ub+HX:esTr4shkqEVa1qloUbtiA31/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771368199, "uuid": "741534e4-5c0d-4efa-a8b2-24eb7c9b73f2", "value": 850696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771368199, "uuid": "3d7e4f21-d73f-408b-a26f-d65275112277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771368199, "uuid": "05601363-2744-415c-acf3-8c5491b24e9f", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7778527-0bf8-11f1-a129-42010a9c0007", "comment": "Malware payload (Lazagne)", "timestamp": 1771329908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329908, "uuid": "4ef4bef0-06be-4315-bce6-fbbf044de842", "comment": "Malware payload (Lazagne)", "value": "81448745b5d62608b37888b38e9f276a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazagne", "colour": "#9AAB11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329908, "uuid": "39e669e3-3069-4a1a-bd73-61f7edc27ca7", "comment": "Malware payload (Lazagne)", "value": "dc06d62ee95062e714f2566c95b8edaabfd387023b1bf98a09078b84007d5268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazagne", "colour": "#9AAB11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329908, "uuid": "128c2495-38ee-4b87-914a-f36532aefe39", "comment": "Malware payload (Lazagne)", "value": "3197ad76e27ca63e6de1b255f7c0196ea7670bf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazagne", "colour": "#9AAB11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329908, "uuid": "86865408-2949-4cd5-a6fa-355539bcc15a", "comment": "Malware payload (Lazagne)", "value": "3f09c5d17acea891be553ba732bf8042c043bf1cef4d16fb2399154c4d50c428269b7edfb34239a6e79922ccfe189ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazagne", "colour": "#9AAB11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329908, "uuid": "447a8730-b269-4b96-b563-cfe085cfe290", "value": "T18FA6338067F504EBFDFA4A3986A08524D071BC764BA6D8DF13E8435B1F53AC22E36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329908, "uuid": "4630fe2b-8e0e-4935-8931-d7aa7f3b27d9", "value": "5bc16b5845145eb0edb88983820691b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329908, "uuid": "67806e56-6024-4e41-be4b-5d016321f4a6", "value": "196608:EuwX2jlQEjICteEroXxUKQGa3hQgWihENE+sKsXXg+W+TA3Emkkw2mqdteC2hhU7:VLHjInEroXGBGa3h3osKkXg+W+TA3Ll1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771329908, "uuid": "861c21db-7693-40bf-926b-c90f8a3d23d2", "value": 10136093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771329908, "uuid": "e29a7618-021b-4ed0-8ea0-36a49864e41a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771329908, "uuid": "5d08fa78-7450-4008-8050-3c62a0f14e73", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea4adff-0bcd-11f1-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1771311264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311264, "uuid": "afee3be0-e427-4b5e-bd14-c79384617cda", "comment": "Malware payload (Stealc)", "value": "cdedd1c07e270c58c6578ecec7acd36e", "object_relation": "md5", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311264, "uuid": "f601cc33-a597-4d8f-973f-8febe7fa22ac", "comment": "Malware payload (Stealc)", "value": "dc38f3f3c8d495da8c3b0aca8997498e9e4d19738e1e2a425af635d37d0e06b8", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311264, "uuid": "7843af57-17b0-492a-8450-f8fb6265ad07", "comment": "Malware payload (Stealc)", "value": "3ee4abd301d45509e5cb08cc0dda7e10dee708f2", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771311264, "uuid": "d643289d-1846-479b-8e72-1896ddd5f93f", "comment": "Malware payload (Stealc)", "value": "c21c04e6c9b7948016c53dcc209402fde1aeccf9b2193b7deefc03d38e385d48fce87a4f841d7d2d118add01de0efee5", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-190", "colour": "#1E4AF1", "exportable": true, "hide_tag": false }, { "name": "94-154-35-115", "colour": "#B8BCD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311264, "uuid": "b7343b9f-6d8d-4653-8ff6-3e3cf1220d97", "value": "T1C7058D5EE7A502F9D0BBC178CE424552EBB2B8155770978F03E11AA61F372A05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311264, "uuid": "54d3c235-1f86-4870-8c58-9c3f6da7c050", "value": "baedab261d9b0ee2285b2ff329a5eaec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311264, "uuid": "4db4d899-01d6-4545-a36c-ecd8a9bcf035", "value": "12288:AU8VHX4ZPBuvzkOkW7UE+YTRqwJ4O2zv3YZtF15kjHKA:KVH6BuvbkW7xXVVmO2L3UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771311264, "uuid": "f0990c35-bf8b-4452-9410-33d59c13deeb", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771311264, "uuid": "ff308e26-3c83-47aa-9868-147162b4cace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771311264, "uuid": "46b3753e-85e5-4983-a646-e679e97494e8", "value": "dc38f3f3c8d495da8c3b0aca8997498e9e4d19738e1e2a425af635d37d0e06b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786056aa-0bb5-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771300946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300946, "uuid": "bbbdf39f-7269-4481-b5d7-f0084f0d4a06", "comment": "Malware payload", "value": "2a912462d00066b3983f23ff7d69091c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300946, "uuid": "13df343e-de80-49ee-9aad-b5d2c7aedcd8", "comment": "Malware payload", "value": "dccfd62d350184fc137b18acbdd56fceee07f2c7b7f89eb1071e7c4eb0f01bcd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300946, "uuid": "f85740ff-7b30-430e-8c67-c6c1a868a731", "comment": "Malware payload", "value": "80fb96a545acb5c197ed6ff70797e088f02561fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771300946, "uuid": "cec55ce9-a883-4982-8e07-8f38bfe2a1e4", "comment": "Malware payload", "value": "febaa95f90d3db54499044842b233d16444ae5a7b33e84e1902991396b9c1b8531faba481791029eb04e5e40a693a1f3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300946, "uuid": "f991abd6-ea65-4eb0-aa67-d62694333ad9", "value": "T1A1019C8D5E00AF39364AEF30EB2B11426480F1C726E69B9926CAA9F53407FC4B11ED94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300946, "uuid": "7a85d131-c67d-4da2-9ea5-125121def6fb", "value": "12:CAmgLARogLA+gLDgkHgUVxMhVYR2ZX1QVFhZTGG8j1TeWqZFoZMS1MXLvyH0nKjE:CjW+oW7CbZVKhGR8avPNeBgsLGbBsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771300946, "uuid": "ec06d791-af90-456a-ace8-4b987f392996", "value": 701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771300946, "uuid": "ac31a345-59fb-441d-b4a6-7a422a97ab84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771300946, "uuid": "02e5d72d-0254-40ae-922b-298e20787a60", "value": "oto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7fefbb-0c2d-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771352304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352304, "uuid": "407ac04d-3023-4d8d-b673-381283930c0b", "comment": "Malware payload (Mirai)", "value": "2e07b4972ec6f723bdbace8f62948238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352304, "uuid": "56aa5130-2a75-43cd-ae6c-d38a80a11ad3", "comment": "Malware payload (Mirai)", "value": "dcd5021fef1f8d319d6e83cb83ec7474edf1232d2025353e125140ad93269845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352304, "uuid": "95030906-90c8-4f48-996e-0fe221fd8d0a", "comment": "Malware payload (Mirai)", "value": "4db0e64afbbf60380325b5f0f87077f55aacbb61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771352304, "uuid": "70eeb104-a65c-4808-8e37-9bb4d908fec4", "comment": "Malware payload (Mirai)", "value": "3ff125a261f640dd4d87ff006217ba034d89fb500ad3540351a3bb9e1c14cdd757dc59aaf67fb0d7b168350f5ada4977", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352304, "uuid": "c852ad5e-5986-4733-a3dd-292ac1847012", "value": "T120331991BC919902CAD82376FA2E01CD332663A9D1DF3257DD216F1137CA82F0DBB652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352304, "uuid": "b66a7206-2f24-40fc-b9af-dc83ff1c0fd2", "value": "768:N5YbcubUXTrWOLInrLBB8gZrGUSTAdtj/L0gIe7xJNoikQ8BNw4xBgVMr9A2E:T6cuOH/EBwUSsdt/0gIeNJZuxe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771352304, "uuid": "ee7ab462-9563-4697-9b3b-a389aaf12a0c", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771352304, "uuid": "26ae3eec-7990-45b3-badb-b93a8958ca87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771352304, "uuid": "3ce61532-c8d9-4001-8551-8be7d5f9f330", "value": "miraint.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1589f44-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343132, "uuid": "3ae72f94-9bef-4be3-bb46-53af8d481faa", "comment": "Malware payload (Grandoreiro)", "value": "58580faa13d6dd4e2c56b88000138031", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343132, "uuid": "44cd401c-147e-4d04-922b-e573b02ee509", "comment": "Malware payload (Grandoreiro)", "value": "dd52fea64ed4a42b15960a40a307e59b19507ea6218ba91546bf6949296ef052", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343132, "uuid": "108c3cb2-e5b2-4cb5-ba37-7049aa3d561a", "comment": "Malware payload (Grandoreiro)", "value": "6b47fd001dd98671b82e2a7d501ced5746724ef1", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343132, "uuid": "303f4c42-308d-4fad-a8a2-f79ebf22fc78", "comment": "Malware payload (Grandoreiro)", "value": "7e12ed8d72f38289919cf2203fe7898689bf24e2a6f5bcca44276e203dad41919fba71e277ab385d46e223912cb04053", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343132, "uuid": "5586b373-782c-4136-977b-f14def39d933", "value": "T1846633325E9D1C6BCE848775B01F1F216F3C664B8A48E5E6248EA1433687FD4897F8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343132, "uuid": "fb65ec0a-dfea-4400-a914-4c15bb45c0e8", "value": "49152:/W5T5W5LkN/0bPUN/y49SZdL+ZRaHDRu4+xHdd40PlEz6xck+K632SjWPSwPotwY:Xhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343132, "uuid": "0bb594b9-55df-420b-bf5d-b0af62bbc303", "value": 7090176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343132, "uuid": "d2b67c3e-888c-4bf4-9375-d1840e464027", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343132, "uuid": "cc52b758-6c04-4268-a7af-943fe3275126", "value": "BMJB8_Inf-Orm5388AHOE.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec01797-0c32-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771354509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354509, "uuid": "5cf78c9d-1751-425d-adf8-8457bb02d711", "comment": "Malware payload", "value": "90458bed05a3e3e21970c1705da07e5b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354509, "uuid": "265748a8-9217-49ea-9590-e3db150363b7", "comment": "Malware payload", "value": "dd7ef4f7fff9bc2a590f438f9738d46af61a3022d32439ca84bed369205c4d43", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354509, "uuid": "c7f155aa-bc80-4e2f-82fb-cd60697f8253", "comment": "Malware payload", "value": "076cc93c30a9e83cdbae0b8b5c217b3320065886", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771354509, "uuid": "cff162c2-751a-465a-a50a-2a6efc023602", "comment": "Malware payload", "value": "9c6dcb2ac555f10a460da8ffd5aeaabf2f4f4a045abe8ae450203435af3527c4b3c4d0a9c7bc3ce40af09148aeae9758", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354509, "uuid": "a59fbb52-4721-4206-9e29-52ae81dcd00e", "value": "T1E2552304BC508B0BE12A86B5819742E73D7E7D996B8AC547F399330971387B58B4F32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354509, "uuid": "3dbb7b46-a512-481e-99be-c546ba399b01", "value": "24576:/OmSZ/NID0GVlt7hR1YyS9SvYxfx42D2IfUbhQVYTKzNjhJW/CwyKZT0p:mmy/qvZL1YFpr4iOWVYTKzNj/2X1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771354509, "uuid": "8625f9a0-eb37-4984-b68d-9745ccf93709", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771354509, "uuid": "8ee66051-5294-4176-8e72-c7f527c30fae", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771354509, "uuid": "74abf6ae-9f42-4236-ad0d-8efacb533570", "value": "SecuriteInfo.com.Trojan-Downloader.Office.Doc.30823.24264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0999d1a7-0c18-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343280, "uuid": "f67ec463-a6af-4dd7-ae43-f7dfdeab6fe1", "comment": "Malware payload (Grandoreiro)", "value": "ec23857f1a9d6263b3a4a6974240067b", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343280, "uuid": "1b7bba26-2c43-4b54-b669-445a804ee79c", "comment": "Malware payload (Grandoreiro)", "value": "dd7fcf22b484e3d2e6acc2815edbac9658a07ebd8570bc45d5ae5c0eede4ce02", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343280, "uuid": "7b26b385-1003-479e-adf4-74cef850aa8e", "comment": "Malware payload (Grandoreiro)", "value": "018e0f7e377091bc8dbfdb9cc2a09b668a94133b", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343280, "uuid": "f508914b-40aa-415f-8c37-ee4cc95f5f48", "comment": "Malware payload (Grandoreiro)", "value": "7d30b5d8f73cca42ed54f5d705c3073964c9c7315c3217cce7a616eae02fac751c3a44e3fd3cc028da0cebf849fccaa7", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343280, "uuid": "1f30d9b6-73b9-4bde-8fdd-653b93c1f5fd", "value": "T1D8763331EA855C6AC5904335702F2B292F3EB5234B4896D3389CE1573B4BFC9857E8B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343280, "uuid": "46cab659-2297-45c1-8976-cf8b9cf4caa2", "value": "49152:qy0A9FIlevLv5O1G1OPSbKeoVrBDMjwRAT6rnhwQgmS93/JHeGiNLIwWeHawIECP:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343280, "uuid": "e603d2f6-b199-4518-a0ca-298be8388d5a", "value": 7254016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343280, "uuid": "da23218e-8776-4d0e-95d0-e971cbbf461b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343280, "uuid": "c8dff588-1575-4441-af51-681a702fad9c", "value": "Not-Ar51191LMNCEVSQFU5972.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbb9971-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353867, "uuid": "b01bad39-b436-4772-9e06-0c30304433cd", "comment": "Malware payload", "value": "de21a6552a50fb3401bc0d1992284801", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353867, "uuid": "9d5a2d0b-4143-4d3b-8884-0d7b0acf8e3a", "comment": "Malware payload", "value": "dda7104a2f5c814aa89b4878332ba60e4661a1908012e180923235facca4cdf5", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353867, "uuid": "b4756ce4-cb63-4702-b360-0b0da682e33b", "comment": "Malware payload", "value": "205042d9e6022d6bd17deb0cdc4484c45eb94f7e", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353867, "uuid": "38e1c461-0d5c-44e5-9930-a817f58cf622", "comment": "Malware payload", "value": "7977baf460946159378e02dc6b76501ca8a47675489f19bfd556afba1018482f025ce7271df33a7b0323a0366a3dabda", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353867, "uuid": "99b7c4cf-c199-4c6c-9499-3916daaea928", "value": "T12E763331F9511D66C6A48371707E6A392F7E7643808CD2C276ACA18B3747ED6463ECCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353867, "uuid": "7af36234-303b-4aa4-9714-d083533b3aaa", "value": "49152:baAzt9pAq6zTjGqEax7nObc2z9d8vG+eyT+Aw47Ggx03lsSSt9x/YyYw9uFaU4hR:dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353867, "uuid": "d6ef3ef2-cd76-4132-b7eb-2ba204925a52", "value": 7761920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353867, "uuid": "759a4a12-0e38-4274-b658-1d57e759124b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353867, "uuid": "57a09293-47d6-4d09-ba50-c7a666826d3f", "value": "Rslu5033NETBEQ_69LV5L.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07cef0c-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343238, "uuid": "ac57e273-ea74-49ad-b72d-0a5a10eb72bb", "comment": "Malware payload (Grandoreiro)", "value": "09376536ab015e1e8a1755779ef12e35", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343238, "uuid": "823b0f15-fc18-488f-9487-6109c79534d2", "comment": "Malware payload (Grandoreiro)", "value": "dddf44991846f47dea397233e1559df57b3fa2417ee45c480d78680fa360da90", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343238, "uuid": "1a317b50-ca91-4629-b464-8cf651dda0a8", "comment": "Malware payload (Grandoreiro)", "value": "6df52eedd23f3754df31f6b3abeb205b8c9d31ed", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343238, "uuid": "48a70f92-eea8-43ab-b00e-dda098c4a814", "comment": "Malware payload (Grandoreiro)", "value": "491133f1de65c21553df0f7af690a38d7ceeeafb54c8dd94791277f7b422eb61bd85d8dd949dd9c2cf62d6b57e9cd285", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343238, "uuid": "0bf66a94-3137-43e4-b8a1-ae3c14361260", "value": "T199963331AF405D6BC5948339313B6E3D2F3E379388C9B6E761A94283378AFC2461B465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343238, "uuid": "0b42f165-990a-4d82-a1dc-6378b87c3319", "value": "49152:veb45pA2a8/GpH5/9hKkoObNDU2VVkqtSyJ7eR4NpQpiCn+0MIXd/1fPTv9sdAOZ:+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343238, "uuid": "d1e016fe-e6fb-4f4d-b6e5-cb4191a9fab9", "value": 9441280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343238, "uuid": "8021d007-3c16-47d7-bc7e-d0bbe88621e7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343238, "uuid": "9a808501-24bc-4269-b23c-4ae723295bb5", "value": "Hbr2588B2713_ZSJJEVnevgh-Nota28MK67.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91443ef0-0c0c-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771338354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338354, "uuid": "5ff24b50-7541-44ef-bf98-71b6e67a4c9d", "comment": "Malware payload (Mirai)", "value": "8d8a7b1ecc0efa2445f4f039eace3222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338354, "uuid": "37c5fc30-f512-45d6-a7a7-9b86a6043a8f", "comment": "Malware payload (Mirai)", "value": "ddfa2b04d7f884ffddb549abfaf272ce1d87afd7b4147116187e70be3f652e99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338354, "uuid": "e92b646a-e2ac-4360-a654-4f45e6478a9b", "comment": "Malware payload (Mirai)", "value": "36ad61494ae20b2ab198ece1869cace9a9335dcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771338354, "uuid": "273a4e3e-f45c-489d-b841-5b1976f03ab4", "comment": "Malware payload (Mirai)", "value": "5cf663df7a10bf57fae99e7d2a022399c52c170bf354d13bbe364d7d082ceb11afceb4be4a7a73d687a0d1e80237adc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338354, "uuid": "3ceef9fe-b5b3-4adf-a021-c6d1bfce51c2", "value": "T1BCB2F1A7D18D27D6EF7DDFB221A193E137E08BAA33EAC44564C25E11190BA36D002E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338354, "uuid": "2ea93f9b-ee1e-49d0-9d5f-9b9c1163f3d9", "value": "384:MG7ORHfCjNAPH+Z6TV5STrhHKyyCb5NK4wdFY2XMzNY9sfsFOVpmvxxIBVShPSge:3+/C+PH86TvYFKDCb57mXMzGWU8TmnI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771338354, "uuid": "2e935d45-9d00-4324-86d3-d62046eeef7f", "value": 24408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771338354, "uuid": "e78e3f8d-553d-4d5e-8f04-0a57300700d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771338354, "uuid": "e43e5f6d-e24d-4065-ad0f-3ced9c9d20dd", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d50ae2-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771342878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342878, "uuid": "7cb6830e-544c-4b95-9f96-976471effce4", "comment": "Malware payload", "value": "5da39f2f825340a1ee82f1cbe459348d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342878, "uuid": "429567a1-06eb-40ff-a131-c2cc42b748d7", "comment": "Malware payload", "value": "de0675e7a8600a9b10f6cf4ec10627fe74b31801f33da2f8ffa9205e5f01a0dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342878, "uuid": "4fb111e6-07d9-4d2e-ac6d-1f31e576ef8d", "comment": "Malware payload", "value": "e5754208189698284ebcb84ec810348609243b79", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342878, "uuid": "813fe9d5-f35b-4b4a-8540-238aaa5f6f07", "comment": "Malware payload", "value": "bc661925a7052a5842e50735b06dafd0d48ccfc6a744b96edfaac33635e787e61a4198a9390e1c1f6848bcd565c5fe29", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342878, "uuid": "1cbfab4b-1229-49fd-9c69-a84faa70d5e0", "value": "T151C2EBC93EC6B1A6037154332D5BA556F26ECC89BC8CC4A9EAA55094FD54704CCB3AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342878, "uuid": "9148aad1-de20-4453-bd34-7c1b3b7b869d", "value": "768:NdL1uxh3TqwbWPMF7hqs+R65SIR5FCBpVMqnSa:huxh3TbOc7hq3AkQ0VTSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342878, "uuid": "b268eb4d-af96-4099-996a-1a50ec298229", "value": 27369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342878, "uuid": "9a55ed28-3374-498f-a82d-b0888bbb2197", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342878, "uuid": "527bc06b-43e3-4292-a4b9-9015684268c6", "value": "PO 2025 SUPPLY REF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b14b8b7-0bd1-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771312896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312896, "uuid": "8ff6304a-a4eb-4454-ac71-12ddae782966", "comment": "Malware payload", "value": "20a149edaee452b8fc1afdf0e396022e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312896, "uuid": "0fd6fc74-f55a-4947-b9f9-50a4e094cebc", "comment": "Malware payload", "value": "de2990baa0beb40f14ef346a1d32b205811fc83ddca4c38c2612a380f49e36b6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312896, "uuid": "18e0d4c9-c1f6-4d8c-82be-10421a2dad3b", "comment": "Malware payload", "value": "1e9a281f18963bc916d8b8cc0a992c1a95b0ec63", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771312896, "uuid": "bc81cfb5-ff24-4ccf-9b2c-f33c39623722", "comment": "Malware payload", "value": "7805dfe151bdda4e97113b44a12be4287ef9ddb076904f3c2e67125c2bdb78ba54d5620e79ecbec3b635eebb6fc4a371", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312896, "uuid": "eab1c8a2-8df9-4a96-a276-9d13e7478bd3", "value": "T16492763BF518DFF40B1E61E4118B7D066098A7A6A53A49BCF4CAC1A87F267104FD64EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312896, "uuid": "e1f604ca-ea87-4dbd-8313-b903e1decda9", "value": "384:p++hQEghL/cTZfj8qvvr6xm9pTqhaSmIdnjWclC4jRz1uhvxij+zXsEJGDIC/qP:ppZ+gaqn8RmIdnCclC4jRz1uhUj+zXse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771312896, "uuid": "5e1f1a24-3ca8-49bb-a370-d433c4137c83", "value": 19694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771312896, "uuid": "9cafeca4-4805-4318-88bb-ba11846dcc2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771312896, "uuid": "f1b6d296-02cd-40b8-a2b9-8fffeb8e6527", "value": "20a149edaee452b8fc1afdf0e396022e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cbc5c9-0c30-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771353843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353843, "uuid": "b8899911-1417-4074-8ffc-01220746605b", "comment": "Malware payload", "value": "758a21dbbb926397ad0b3543b60c5d57", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353843, "uuid": "f6993538-5952-48b4-b628-0c23e8a84869", "comment": "Malware payload", "value": "df4a32cd113b970cdf63a2ee107b45ab31390e039594a133b1e3c2ddf1188487", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353843, "uuid": "fecdb1b3-cb40-465f-ba7d-f4fd6dce926f", "comment": "Malware payload", "value": "6ea475726105204d65f3a4425318182e3a51a7ad", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771353843, "uuid": "79397026-ddf3-44d8-a083-5289da3722f0", "comment": "Malware payload", "value": "e00305d9309eb7742591b1a11d94b1f299aa31cd6e7c54f0a3678987aa6e479ce3b462884efc5d04ec44c19aafd9e89c", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353843, "uuid": "56bda189-dea6-4e5e-a25b-05f47671ec7b", "value": "T119462335EF165C6BC6404375B03F6A212F3C6707468CD2D729EDA1863B87FE2662E4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353843, "uuid": "18a0b411-2c6a-44a5-b39e-e19193de3916", "value": "49152:R8LH63pm13lMAd0w68TAFUy9j77FDTITP7n8DZ80EtHLZLthq5BgySe++pATVK/:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771353843, "uuid": "8767b704-8117-4107-8d25-af054f021483", "value": 5771264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771353843, "uuid": "2d77f0f1-e4d5-4879-89ac-03e33a8e3d11", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771353843, "uuid": "275459fe-a18c-4aef-aff7-87f74531da88", "value": "RptB5LJK-MJZD428595_An7877H8.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e96deb6-0ba2-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771292715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292715, "uuid": "49bb0af8-e62a-4b42-8b46-12cdb256dbf1", "comment": "Malware payload (Mirai)", "value": "a89b112bb76495bd420ab1d61bbe1259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292715, "uuid": "17815c90-263a-4aae-8ab6-688e5315d0cf", "comment": "Malware payload (Mirai)", "value": "df4c2eb8060177be7bc2b5cdf9a26cc794a316e8708f53d4262ba08cb36a1a5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292715, "uuid": "58b2287d-d904-48a4-8214-46ac195472a9", "comment": "Malware payload (Mirai)", "value": "859948a61452f68da173147f36cef61d2a6ff6c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771292715, "uuid": "17569deb-a4ea-47c5-9b8f-c3e4475608ea", "comment": "Malware payload (Mirai)", "value": "d3cd1e00e9eaf8a426715eb5ffe6023fa8c67c11d464b87366f9f78adf94dafa1b85722abb397a480f209d3188ad54bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292715, "uuid": "d41f6062-1d73-40ba-910b-30278d091419", "value": "T13A157B8DE786E0F1F22344F0025EDBF61934A12A5013FAF6EF45266774727A16F1A21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292715, "uuid": "7f5ae7d1-25b6-42f0-bade-2a7535ace216", "value": "12288:7HJVFD4uIhpjhwQcgpCRCVbjDIF6ckOZjFvJ3mKGPyI/cCepAzFLu:bJVFE9hpjhDpQCNk4tOZfmTxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771292715, "uuid": "423aab3b-3ae7-4413-82cd-81cae48430fd", "value": 878808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771292715, "uuid": "b4f1e87d-7d3c-433b-8b62-76b9ce9adb85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771292715, "uuid": "2d53258f-60ff-4f90-8be9-fccb18101002", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b0a313-0c15-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771342153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342153, "uuid": "b254997e-44f1-4797-939e-086fa4a967d2", "comment": "Malware payload (Grandoreiro)", "value": "8caa8dafda30f0ba8cdc66d318c814d3", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342153, "uuid": "b987d09d-3416-49d2-86dc-920f9b726ecd", "comment": "Malware payload (Grandoreiro)", "value": "df593cb46f0372203189a6ef08decc9bd2a5de1224427b5843558448d9b0ce40", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342153, "uuid": "feb0d963-efb1-4a9f-ab51-27604458f27c", "comment": "Malware payload (Grandoreiro)", "value": "5a8007b8ba574ee2d8f5654713e1bd4791bcf44f", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771342153, "uuid": "5f686f57-c56d-4f75-aaff-c74cc20e70e2", "comment": "Malware payload (Grandoreiro)", "value": "b85ca6d5da37f933e4a8df79a8f33fafafca7578318bb6596dcae3547c9b962cc1cd7174ddf9885276568d84d4d42112", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342153, "uuid": "48b850a1-4535-4f2e-ac1d-da596e601e7a", "value": "T1E7362332BF421C6FC9E14375B12FAA166EBDA413434CD1E7699C90463BC6EC0C97E8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342153, "uuid": "f81a41e1-f769-4067-ab19-9a44a96a9b23", "value": "49152:PY/YmCyDmuG23AuLhurXrjhOM1sBt3J0Ro8b21HgxWHLuRfOD6i9hIZWrfVxafTv:B/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771342153, "uuid": "7f26ed58-2c86-49cf-9c9b-0d9b2d688b7b", "value": 5339136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771342153, "uuid": "3c1477fa-2f7a-4cea-9af0-e7096dca457b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771342153, "uuid": "ebcd47ad-ed9d-40ef-8079-f90924a5b5e7", "value": "45979KMGZ_MdtB23H0-0834.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4d8b74-0bd3-11f1-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1771313705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313705, "uuid": "ccb5ecad-cec8-458c-913b-2d88eba011a1", "comment": "Malware payload (CoinMiner)", "value": "69c36cc23af35d826ec61d8bb44b10cd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-1625093", "colour": "#C03B6F", "exportable": true, "hide_tag": false }, { "name": "pwn-1625093", "colour": "#2B5FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313705, "uuid": "66ce5bb4-a67d-4890-ac2f-a74db3b38217", "comment": "Malware payload (CoinMiner)", "value": "df7325615167b6a9eee6a8e3a7618e1600de66a7ad1bb6a577391cfedd829529", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-1625093", "colour": "#C03B6F", "exportable": true, "hide_tag": false }, { "name": "pwn-1625093", "colour": "#2B5FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313705, "uuid": "f24da150-1047-4ea4-a904-d375cbf0abc7", "comment": "Malware payload (CoinMiner)", "value": "ba65cbb2d3cec67bc14018764675e2648a9a38b8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-1625093", "colour": "#C03B6F", "exportable": true, "hide_tag": false }, { "name": "pwn-1625093", "colour": "#2B5FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313705, "uuid": "993bf380-c2b7-4b57-b065-886254375521", "comment": "Malware payload (CoinMiner)", "value": "3ab0f13e245c1a37f7be889e32098f09a59ab7b8414e4bcaa9c1f2a5bb88bd43124c51d1f9d4d281add102abab4db3ec", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-1625093", "colour": "#C03B6F", "exportable": true, "hide_tag": false }, { "name": "pwn-1625093", "colour": "#2B5FA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313705, "uuid": "716c003e-cf03-4255-b970-f17c432d4a99", "value": "T107F533C7710ED3C0466CA4C42EDBD6D7944D3AFC421EDFBAD214AE82CB95DA27481EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313705, "uuid": "bffcda55-35d8-4fd8-8352-46d80154b816", "value": "49152:6AOuDqsVc5OzkpkIFOo6liCuzTDkAZO61tNVlQnrKIqhIV6v6Zc1lzqZ0ioaarb8:3RWsVaLkILCuzT3D17VlY9m1Jqegd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313705, "uuid": "573c186d-3662-4aa7-bec0-b728ddab871c", "value": 3620449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313705, "uuid": "02654778-fe1b-48d3-9219-17c6d9d94507", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313705, "uuid": "33cb10fe-15c6-4a6a-8c55-dc77768f710b", "value": "gmail.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc665c9-0c23-11f1-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1771348364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348364, "uuid": "74108b65-1806-4de8-bcac-9676728447f6", "comment": "Malware payload (Mirai)", "value": "f07c2c387918ed608d48cbca00dd4f6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348364, "uuid": "90ad1bcf-f94c-4920-8baa-c58a56bd1ea2", "comment": "Malware payload (Mirai)", "value": "dfd32dc90daa92d9a5b31bb1d6bbe0f5c85803229d3e1a2f71534a3a07fc090e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348364, "uuid": "627d3e9b-44b7-4a52-a795-3e085cdf8656", "comment": "Malware payload (Mirai)", "value": "2edbecc80de107ce3459b4fc29a0d54b198edc58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771348364, "uuid": "887839a2-6f1c-49e4-8b36-0cd6867ff900", "comment": "Malware payload (Mirai)", "value": "61054748535d78b5bd0996e1da9c6a9aae97ebda8f156c46fccbb0c8ffaf98c4f8dc13c2b5e20df1115e7cc1ef4c2aae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348364, "uuid": "0691e85f-2b75-4ef4-8f4f-d23f3e6d11e0", "value": "T1BE011E8D2BE4B1879E0C9E08F16A821C7940A6C072B40D55F364B870D8DD210FCA8F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348364, "uuid": "51c3cdeb-08d3-4018-8117-ef438cd56856", "value": "12:3J3X1eLqQXcjQXiNIl5zAQXP0LKjQXuOsQXiCQXc/QX6cSEQXotaKAQXK/iAQXKK:3J3qaZNI7WKRT2bcZtBq/dhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771348364, "uuid": "846d9740-3b4a-4b56-8115-3651f0e58d92", "value": 707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771348364, "uuid": "fff15c99-2fec-4168-a501-d36c9eb19c7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771348364, "uuid": "ecfdb2e1-e1e4-4ec2-bae3-9c6c1f17049b", "value": "abc1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f35326-0bd3-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771313820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313820, "uuid": "1ab17d83-4e7b-44a3-b2ad-057999f13891", "comment": "Malware payload", "value": "f2c501aec5a7b351eb3d2d1666480f17", "object_relation": "md5", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313820, "uuid": "b809d680-6cb9-4a62-8371-b967cc193c79", "comment": "Malware payload", "value": "e038986f3b293387ea46ceaff487ec5e778a6fc80df560869a5f92410b31450d", "object_relation": "sha256", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313820, "uuid": "9986b42a-d3ab-4439-a7d5-9229ed70d952", "comment": "Malware payload", "value": "17d506d0a05d035224b4184758606a0e71f5f610", "object_relation": "sha1", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771313820, "uuid": "0ea073d4-b8ea-4c19-b13c-4a3e169ebdc6", "comment": "Malware payload", "value": "296f4bfc0bc591673cf6205bddfe4c808ef5033bb1357e258ad445fc82a171c6653f17c6e34035e501abec3537fc7657", "object_relation": "sha3-384", "Tag": [ { "name": "bambooware-ru", "colour": "#54288D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313820, "uuid": "b3e513b7-50ca-4894-bd6f-44fc0bfd107e", "value": "T18205BF11F9C180B2E5A2003096A99B736E3DB92447149ED7E3D44FB99E301C5EE3E76E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313820, "uuid": "e5043723-75e2-4fd7-9f3f-3768e1eaafaa", "value": "c46361acbc6129c17dfb2b9feeda77ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313820, "uuid": "442c6a1f-493c-418e-b9c8-bf512e673989", "value": "24576:hjiLe0ZasFcd54GK2z3LMf+Mh0o77viME2:hjn0ZnFcn4N2TZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771313820, "uuid": "3bfd948b-57f0-4a0b-96ff-7e9cf0430be7", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771313820, "uuid": "674314d3-a7cf-465d-92c4-2a8dcf785e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771313820, "uuid": "d549d757-a6b5-4fca-ad16-c33f43efa4f5", "value": "info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab7fb03-0c17-11f1-a129-42010a9c0007", "comment": "Malware payload (Grandoreiro)", "timestamp": 1771343175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343175, "uuid": "6e2797c6-5a3a-4d98-beae-03bcaab7835a", "comment": "Malware payload (Grandoreiro)", "value": "5f0ed99d7e31c25012987a59d8af2c00", "object_relation": "md5", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343175, "uuid": "b19be84b-9f6a-430c-be19-950c52f20374", "comment": "Malware payload (Grandoreiro)", "value": "e04d73e9781456ffc9c0edd3194a4c0f18bb2c73925d89be4e1854e95230cec2", "object_relation": "sha256", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343175, "uuid": "ce155fb9-6d5b-4f43-9569-5766099e09ab", "comment": "Malware payload (Grandoreiro)", "value": "1e3da669dc7a20a004fcd6d85137a4587eb5b560", "object_relation": "sha1", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1771343175, "uuid": "f96e7f18-ef95-4ed7-a319-ddb281e8ae37", "comment": "Malware payload (Grandoreiro)", "value": "bbb405fc862271486e4a435c94392b9bb0c7dd72da8070a4de1c827624bc17e47e00959aadf1cdf490296c45d2981dcc", "object_relation": "sha3-384", "Tag": [ { "name": "endesa2026", "colour": "#8509C2", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343175, "uuid": "4c4f53e0-9167-40db-ad09-fe79cb10b578", "value": "T163863332EE555CBFC294C332307B7D2A1E7DA603818DA8D7756DD1863B5AEC0853B0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343175, "uuid": "e11bbe12-a10a-4695-8ddb-40beb46728c2", "value": "49152:efse5ka7ZOxluSEUdstdC5dL7q6ICpuZZhazi0C7kzRiauBBzv+YiQ8KhOTKGV+D:Duim3YoTfyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1771343175, "uuid": "d050e53e-3623-42a4-8af2-5d3bd5ac068f", "value": 8134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1771343175, "uuid": "c354297a-4c09-4356-992b-3b191b3394a6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1771343175, "uuid": "dcbc177e-2dae-4606-9f8e-675fba4404aa", "value": "C057_89057QHAG-Reg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f2b126-0bf7-11f1-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1771329402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329402, "uuid": "1d95a6d0-03ab-45e4-9325-ee2416f7865e", "comment": "Malware payload", "value": "cbd5ecbc88acacb3b714629d0bc1535c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329402, "uuid": "7b52081a-0121-4956-a82d-d0217d89a7f7", "comment": "Malware payload", "value": "e06dbe87f6cdcfc942f274c4d7883a5ebadf48b7d5eab2a9ef0e900783a8e915", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1771329402, "uuid": "8a09a8aa-7ba4-4d36-8f64-396554ea6974", "comment": "Malware payload", "value": "dd7a39144e8b7d71ddc9c674984683da2c384f15", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true,