{ "Event": { "published": true, "date": "2026-04-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-02", "timestamp": 1775174581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "505ad2f0-296f-4bb4-a12a-73a3f7f8f3f6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a1a900-2e53-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775107295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775107295, "uuid": "7729c37f-8503-4c50-b1df-ecd4eb32aa22", "comment": "Malware payload (RemcosRAT)", "value": "19f77f8c6592a72ccb901076306b45d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775107295, "uuid": "9099c532-86d0-45ef-9dc7-d89d99946669", "comment": "Malware payload (RemcosRAT)", "value": "01f70dc5175c6daae296b4dbba49897b1fb6e5a294f26b045a6debf7b49faa11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775107295, "uuid": "b1166f54-0197-4379-ac64-960b0e61324d", "comment": "Malware payload (RemcosRAT)", "value": "098758dcbcb7dffda5ac07d7fb74bb2ac781b3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775107295, "uuid": "04bc5c02-a61e-412f-a3a6-7d85df0ca66d", "comment": "Malware payload (RemcosRAT)", "value": "fc4c5c71505230b6ac9ef0dbb7279c724f13b1520d4cd069b1aaa70aee64f027bd1238ad3899eb6e61a7dfb0c770a1bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775107295, "uuid": "651d61fa-0477-46a9-ab35-fda0c77c2c35", "value": "T1DF65010467ABDC02D4BA1BB588F0D37407F8AD51E422C2076FE67DDFBA267922985353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775107295, "uuid": "7dbc34ed-c9a2-490c-9a8e-9789887bfddd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775107295, "uuid": "e089529b-bd04-4942-837d-8dfce64b50fa", "value": "24576:2vFSJJSHwmuA9O3sWkZfFRQJR1PbCGcZ0YSJvXO/LbrNueFZF9npMK:6qUwmuA9OcZfglTCGcZ0YSvO/LNu+ZFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775107295, "uuid": "dcd55c2e-e7fd-41b5-a680-e82f04c73e3d", "value": 1479168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775107295, "uuid": "29765907-10d8-43d9-8c3b-4575784a76bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775107295, "uuid": "e886d72f-75ac-4acd-8c24-3a118d8fbe64", "value": "ISF CT-262-0326 CFS - DRAFT D866 HBL.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8887b3-2e81-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775127067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127067, "uuid": "7a9215c4-db01-4558-9181-fd6a62c616f9", "comment": "Malware payload (AgentTesla)", "value": "cb1e346325e26e03748524850f1f69d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127067, "uuid": "d2df4177-a1ac-419a-b4e3-b970da6c58a6", "comment": "Malware payload (AgentTesla)", "value": "02347caafa65553288f340c64964dae9706cde2b7da0272baa1698c68261f20f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127067, "uuid": "20a6690a-43a3-46e8-878b-24f19e4b7547", "comment": "Malware payload (AgentTesla)", "value": "2c8ae5b3e4fe7ba580c754fa1f496d914b8f62b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127067, "uuid": "5bb47489-db9e-42fe-8e94-7fc4066db0ab", "comment": "Malware payload (AgentTesla)", "value": "3b3aabd509a758089a9c825a8414fd0127bbfcd90fd94142d9abaeb92c26b75b4e4d9e04ba4bfc17cd3ec920df8c4e0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127067, "uuid": "8b5b4e16-df3a-4d1a-bf79-6ebcbcb818a5", "value": "T1C355021459C83FB4CFAC261D40FE150EA3F14E8A5456B98EEB33BD86BFB7604461B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127067, "uuid": "46e39337-155b-44f4-845c-0c0f2ee85b4e", "value": "24576:iEoA6ErA0sOA4vZgJGcUX9Ydgfgp7AYAG+j:i1jMAkpX+gwAYlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127067, "uuid": "07ada169-4bfb-4ce9-a8af-12b62b0f777f", "value": 1346590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127067, "uuid": "070ae7c2-bf29-4e37-ad86-c51cf9d32120", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127067, "uuid": "36c58334-0abb-4861-bea0-4607e7998638", "value": "Payment invoive_FAC-2026-001C_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a073df-2e45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775101281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101281, "uuid": "d2d22f18-4c62-424d-aaf5-44b95467c5a0", "comment": "Malware payload", "value": "5e38da9abc9a93413a6f956b60457405", "object_relation": "md5", "Tag": [ { "name": "5108426900", "colour": "#20ADC2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101281, "uuid": "ec7e1a08-6fb5-448f-abfb-b67051deca14", "comment": "Malware payload", "value": "02ddca944cc81683d08173ff92d36f61ffd154fd6b4060e4128341a186fd3830", "object_relation": "sha256", "Tag": [ { "name": "5108426900", "colour": "#20ADC2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101281, "uuid": "b641f400-c84b-4ef8-a4aa-cc3ac7532051", "comment": "Malware payload", "value": "11624c0d9c590de746e0b0f5f547454acbcd2193", "object_relation": "sha1", "Tag": [ { "name": "5108426900", "colour": "#20ADC2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101281, "uuid": "18dc7282-00bb-4a1b-813b-8734821ca82a", "comment": "Malware payload", "value": "83d5187c27c8cfb8903176fb9d3596ccb39039e4cd5a21ba0c103a164df28d6590cfc56c8c60cb97fdeeaaa20ea19eb9", "object_relation": "sha3-384", "Tag": [ { "name": "5108426900", "colour": "#20ADC2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101281, "uuid": "0711ff06-0da6-44bb-b7d2-3b5258db40dd", "value": "T12754DF20D2E8119DF5F34F09EDBD25024EBAFE560A1E4CEF09159F0D0AA194D9E73A72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101281, "uuid": "cce97066-6c24-4434-a884-2b0f4f6781ba", "value": "6144:scic+Lkgvp14FWjoSFyASmf6cNXHn7QOMDtPnT5ljwB0veL:tifxpcW8Ey7mf6anyTvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775101281, "uuid": "82680c7f-ccd8-405e-934f-ca2b75bc3b2d", "value": 306380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775101281, "uuid": "be1c7cde-588b-43f9-917e-78dcc6c8cccf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101281, "uuid": "f1889990-d4c0-4a54-b258-e6e6a748a771", "value": "SKM 5108426900.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27ac073-2eb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775148878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148878, "uuid": "8a53f026-a61b-41ba-9dbc-4e06e78e831a", "comment": "Malware payload", "value": "9c823f85eca3d328887bfd622bcc5df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148878, "uuid": "deee640d-4d17-4109-85a7-bb8f2ea6bde8", "comment": "Malware payload", "value": "02f1f39c71e42de51997b8a2f1495d8ff9862a42cb77ce3d4cbcd035fff95d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148878, "uuid": "c607ecd9-f337-4afe-b4de-248d1dbbeaa9", "comment": "Malware payload", "value": "78fab37bf594c68e4d8cdb2662862319ada25293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148878, "uuid": "bf6c9dd2-845f-4c7b-a468-b9dc43905cc2", "comment": "Malware payload", "value": "cad739ddc13a7141023275d3453a23252518f08334c3b64c3d0b770544aa08772a81fb887e170e2c827417eb212cbdb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flystudio", "colour": "#D3D460", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148878, "uuid": "837d68b4-716c-447c-bce3-7430d7bfeee4", "value": "T1EA664C4E93904A64FC4537BC5BDAD4F026DCAD19E074A065EABB6B037F168A2043DFB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148878, "uuid": "1b3d7b4e-350b-472d-a9da-1cc5949bffc9", "value": "3c3d4597c00a147cb9057797225dbf86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148878, "uuid": "0ea592cc-5a1c-4f33-831e-ff30212053f2", "value": "98304:6bwQWjRb1XoFE2C+7Lr7om72B/QHz4PnisnJc:3QWjRbUfom+QTMisnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775148878, "uuid": "69bc9ffa-af26-4e39-a06c-dedef0445d49", "value": 6619136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775148878, "uuid": "9dadc05f-ab48-456e-b627-c312e531c5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148878, "uuid": "a33c65ec-4a0c-45c1-bfa5-ae35cf1edea3", "value": "EQuake_Insider_3.3.1.52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f70ae4-2ed6-11f1-a769-42010a9c0008", "comment": "Malware payload (WraithBot)", "timestamp": 1775163354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163354, "uuid": "e7e91e40-ace3-4e60-bc82-87318bf03386", "comment": "Malware payload (WraithBot)", "value": "67661bdf4e4f3cabd300e776f785358f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WraithBot", "colour": "#9CC3F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163354, "uuid": "e060270c-aeb4-4ed8-80fa-d4854809df83", "comment": "Malware payload (WraithBot)", "value": "04d8f7258ab93a2ec9c18e14636b5d0d1fb6fa0ac7c82b29973d213473c57602", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WraithBot", "colour": "#9CC3F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163354, "uuid": "c34ccddd-5a9e-4810-b791-7a5ce3fc067e", "comment": "Malware payload (WraithBot)", "value": "245695b29409d751cf09e38a47ab54b75bfad7de", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WraithBot", "colour": "#9CC3F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163354, "uuid": "e35a5903-5506-4482-b29b-da444f8a3b89", "comment": "Malware payload (WraithBot)", "value": "d3f46346288ed54133523b44885a3472d53641e201f3246ba5894c089bdd113ec4d99128d14143eaba8c373c2522ef86", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "WraithBot", "colour": "#9CC3F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163354, "uuid": "20dd78fb-40c3-4221-8fd1-fa0e4672a344", "value": "T12A823BA5FC498FF1F8A054FD841AB51B5BFB79386824DA83C396D7E89C78180A81D243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163354, "uuid": "a47506f7-7e79-4f82-9e51-491ac2158350", "value": "fd8e9a542752add4f4a89157bc270436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163354, "uuid": "7548dd3f-9180-4f39-a47a-de795a7a2ab0", "value": "384:epCNRbihXWCassEs9Gm1/SzaWGcuRV2snK:epIVuHaEs9dn9RvnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775163354, "uuid": "6248c4dd-d0b2-4807-a8d1-2b5e37f32339", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775163354, "uuid": "53284603-2537-4958-8586-f5adf89b0949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163354, "uuid": "fd5fdeb8-05c5-451c-a89f-537bbea0c26b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af632034-2ecd-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775159637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159637, "uuid": "6b946348-9d37-4de7-8340-e9dda085b2a0", "comment": "Malware payload (CoinMiner)", "value": "8e678b61fb0dab4f332e26cd18b4aee3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159637, "uuid": "6661d40a-bf2c-4bf2-99ff-95cc8f564629", "comment": "Malware payload (CoinMiner)", "value": "067eca89df2fad3905ea5987350f68362fba8b2241393c2c79522f11736e3192", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159637, "uuid": "e5d907ca-5227-453f-a0d2-e88ce2957708", "comment": "Malware payload (CoinMiner)", "value": "197c4251c2347785ee3ae1afe6cbe6cfbeb38ac7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159637, "uuid": "36c168fc-542c-4a75-9842-334e5a42f57a", "comment": "Malware payload (CoinMiner)", "value": "220ae481745df9973350b0980fe8089a063db40c95256e00838c55ed762b8d205312cc0668aa6019ee5a0687d4efee3b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159637, "uuid": "2e738cee-e1a4-410b-bbb2-e2acc9f868b5", "value": "T1CE22392F6E494231D3A04DB016B54A9A257C1233A787F3EBF3B3D2590FE56449450FAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159637, "uuid": "15a13719-4050-47f3-8b5e-2dbbd535d344", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159637, "uuid": "1ea3c0b4-cbf0-42a8-9b62-f8f857040e79", "value": "192:y1YsoG2wdI6qB6x+eFbiPFJxTEZmFhSorcY2:EYsoaa65wEiPFwZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775159637, "uuid": "0c7c9a6c-2a3b-40ad-be8c-b8e4feb84317", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775159637, "uuid": "40074abc-fe22-4cd4-967b-844cf057c23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159637, "uuid": "c4362f27-3ccd-44f2-b494-f45e8c490d45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08dde0a-2e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1775125708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125708, "uuid": "f7b9ace5-d09b-4851-8b8c-be8f8b21f6e5", "comment": "Malware payload (CryptOne)", "value": "ac1dc00048a7da05e82bb7cd86b48bcf", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125708, "uuid": "d81cb187-02fb-43ef-a5d5-543291de876a", "comment": "Malware payload (CryptOne)", "value": "06941db07504f7009da0493b394d4a7c32207b310af2eb8a3bdc620538b9bd6f", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125708, "uuid": "6fad15e6-c015-4636-8ee7-11c88d427467", "comment": "Malware payload (CryptOne)", "value": "beb72d4ddad41167d1016711b978f3676655ff36", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125708, "uuid": "6ba7b96e-ee45-4c1f-ae07-099957fff277", "comment": "Malware payload (CryptOne)", "value": "4293f37023c22274bbb5184a808fc749028154c2f1bc09e82247fe1f856d6340ee0335ca2e595a3e00dea8354b44e383", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125708, "uuid": "88c40dd9-ef65-47e2-abd4-3681962878fd", "value": "T15AA58D577CD008BAD46AE33289B651E2BA71F8184B3237C72E51AB782F72BD05D39744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125708, "uuid": "0bd3db8e-c612-4a82-ad0d-a6ca0d1bba8c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125708, "uuid": "a91db7cc-8a43-4929-b6a3-89a214cfb696", "value": "24576:yfvuP5LMFvvZnTBpoaZ3WpX2I3uZzaevWHLL5rsCGiWPrWR:yfvuBMFVT7oaZ+7xevWr2tK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125708, "uuid": "1789ca47-ed89-477c-99bb-6467f8f7f338", "value": 2215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125708, "uuid": "4ec1f8f7-b7f4-4621-a729-15ed26250116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125708, "uuid": "88de87d4-dc88-4d1d-b970-de0590b38d80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248a9a42-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095838, "uuid": "b147b59f-a853-4adf-833d-b76578ce26b8", "comment": "Malware payload (Mirai)", "value": "74c1f6c42b89a0acd243d81b673f45b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095838, "uuid": "498d6c37-07ee-413e-b550-91fc69a21ee1", "comment": "Malware payload (Mirai)", "value": "079c423edfb7021aa08ab7a315deebad704958d78df5b781b398869379cda7a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095838, "uuid": "2ef800f1-6903-470e-82bb-657cfdd14ed4", "comment": "Malware payload (Mirai)", "value": "a32e7e84f074f6f48e06681e43eba3c0bc128c49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095838, "uuid": "2a039043-2ba4-46d7-b93e-98f55f943680", "comment": "Malware payload (Mirai)", "value": "ed649da28ab81cae71d6f07d8d43df55211dd2bf92b02ce94e1510b633e54df501f48967dd30cbc4efa1ce8d6f1155eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095838, "uuid": "fece8bfd-4cb2-4b6c-bea3-40c767599ee6", "value": "T16BC31B45FC405B23C6D612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095838, "uuid": "8ccb5ee1-a91d-4aa9-9303-ac323be9360b", "value": "1536:p/Ka0rG5yC/cMChygtiOBdWFAcJX4VlgXTAXYFkWUGZrSo51WhrV1l3GwywEReQD:ZKaprMh7sOXWFh4UXcYFkWpZlvWNUmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095838, "uuid": "6be43d52-3121-4574-a2e0-b4ded974c143", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095838, "uuid": "02a5b677-cf40-49e9-bc26-4a9dd4b1d583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095838, "uuid": "75f4e229-4d81-44cf-9cb5-534ec5840726", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447a9d8c-2eba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775151297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151297, "uuid": "a4027abb-1bbf-4d4a-bf00-fac25772b5d7", "comment": "Malware payload", "value": "202aab5ad5cc8ccb49d903f8a465cfd1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151297, "uuid": "3d3937ec-c77c-4ada-9724-82969ad39b1f", "comment": "Malware payload", "value": "0960616a0aeb78083983043d46d7fb6283550f5ea6335a5e88a3194fed9afdf4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151297, "uuid": "329ebd19-95bc-47cb-92fc-91b2f17a904f", "comment": "Malware payload", "value": "dd6ff395225b80fea9c91569efe602742e17ee44", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151297, "uuid": "eb8f953b-f137-4938-bf0e-7549e1329343", "comment": "Malware payload", "value": "3d45f5f1093e4f0c762451b2b505634c0bc266f5d6a1510bf8217391d51fd1ea413dc7233aa96310f40f820873714541", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151297, "uuid": "7d2bbd68-72ca-43be-8cbe-1b6dac9e407f", "value": "T156D6334ABBD47C2FCCB381364BB60BB909968C5B9716E7534165B12C8DBFAC00D96BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151297, "uuid": "61dc5126-23ce-4ec6-a4b8-e4b08bd0b7be", "value": "393216:XK0depil8+wMg8gjxCOJ/2zTWTV2Vrfns0JWoLK3ZMp5HKtfp:aJ4g8g1C8uzTQ2lslpiwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775151297, "uuid": "38fa2a89-24de-4819-80a4-4ab3746d0626", "value": 13784212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775151297, "uuid": "b218a1eb-c621-468a-8293-eb62af823022", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151297, "uuid": "dbb9751f-f18c-4c10-aea7-d278a112d30b", "value": "Protezione Cliente.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fa6f42-2e91-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1775133802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133802, "uuid": "ee95fd7b-7ab0-418d-a11a-e0c4f692f1ba", "comment": "Malware payload (SpyNote)", "value": "27bf0bcc63f5297d3677787ecfada5a9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133802, "uuid": "aa68c900-57eb-40c0-a662-ad2657b38338", "comment": "Malware payload (SpyNote)", "value": "09702ee08682153ab1862d45e2374699a62b6b3929a34ba30778f971ed09ef26", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133802, "uuid": "02ff4204-8a47-4b6d-a6df-0a834888ad67", "comment": "Malware payload (SpyNote)", "value": "55c8a32d287f746fc486d0cc4b8df1ecaf5ba387", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133802, "uuid": "5573c29f-3aff-43b9-993b-ea1a87bafde5", "comment": "Malware payload (SpyNote)", "value": "8da0cbfe5fa8bdd9270ef4822bd06e0a23ced89e7f9911fa72a0b62d76e0a0c9868bc2c146728095423c58da9f1a7c44", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133802, "uuid": "59a61243-0b84-40f6-9dbf-c83240ad8067", "value": "T17D26E017FB9294A2D9B58335456683BA74679C240663C6A71C4AB33C3D37BC067E2FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133802, "uuid": "827aa4c4-325f-4515-984e-36e51c4e305f", "value": "24576:rh+MW89DiCIwKNr07TO0pNGqlDtsLPmqj8yxTGjfQO:lzWeD9Mr0XO0pY86iqj6jP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775133802, "uuid": "53f3cce9-9bf0-42f6-8e9b-983b3d8bd19d", "value": 4439003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775133802, "uuid": "51b63f73-4fc8-4a8c-9dea-46c7254e6478", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133802, "uuid": "14b69a10-0191-443d-872a-efe7654ba8c9", "value": "VPN.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bca9a16-2eb2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775147954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147954, "uuid": "e84531f6-0980-4e07-a67a-6c727a3fbc22", "comment": "Malware payload", "value": "d1babf2c5a7b153d5ff01d3971f2bbba", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147954, "uuid": "de14de44-dc32-4636-a4cd-b849568fd5cd", "comment": "Malware payload", "value": "0ab588dcfdaa58554066e74f2af1820d2ec7e8349d2c6b3b2064dd51c502b14b", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147954, "uuid": "977d3cd2-0186-4674-a785-6ef5210f3ebd", "comment": "Malware payload", "value": "5457ce0e61169728ca9d08b2d15c7fcd5828ab1e", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147954, "uuid": "228cbf83-acda-4dfd-8de7-cf71b50e2eaf", "comment": "Malware payload", "value": "2409b2a5826be871376e8bd9ad94440a42d98cd70df48fa22e2a94c28e1811091e419e33a1414ca25e86761615d8372e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147954, "uuid": "8bb887b6-a805-41e2-890d-4be841fa0ab5", "value": "T12F858C4B7CD148BAC46AA33288B261D67B72FC191B3273D32F50A6783F76AD05875724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147954, "uuid": "f0fd9126-5885-4c77-a6db-0cf833c455b6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147954, "uuid": "79b3dd1f-7224-4627-bd20-bd070490e7a3", "value": "24576:pHBu7m9f2GvPVZewMTaPA3JTmzVcH0Y+uqG6WcRfRK2g:pHUm9ff5M2sBmzeHWuO99g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775147954, "uuid": "05801225-fefb-4400-8217-54830ac79799", "value": 1844368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775147954, "uuid": "b1555d97-d7c5-4eaa-b007-4238636d98c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147954, "uuid": "c1e9a11b-8632-4e22-ac19-1b9e64f79689", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e458eb83-2eb8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775150706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150706, "uuid": "3a4eeea6-e69d-4d24-a053-652f27aa7410", "comment": "Malware payload", "value": "c73287138dbdc2b6fb072ed609bdb125", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150706, "uuid": "a723234c-20c3-4db3-94fc-2be3d187540a", "comment": "Malware payload", "value": "0c65c5d4d1d138293df6b106eaf3ca73bac9c9f834f2821276b6fe816ca20ca0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150706, "uuid": "d79bddc9-9556-4622-bd8a-1f1948211ecd", "comment": "Malware payload", "value": "b9461a473fc4025de164cce49bf7c7da45e6836e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150706, "uuid": "0c4e1952-2c1f-476d-8046-868ab69f8eb8", "comment": "Malware payload", "value": "d6509c47023cadb3175a192250adb67a38601244e00f4fbb7a1dcd2243db6793fe2c2743c2209446f29b8c99c33799e4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150706, "uuid": "9ca65ad7-1824-43f7-970b-f5a6f110b7fe", "value": "T107823A0FB8424216E0D210B49666967BD9B9987A33C814DBF7D48ADE0B78AD1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150706, "uuid": "2485e95f-3c1c-4bcb-ae5e-72d319a6e9f5", "value": "ca5592c42b764400102051895df05794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150706, "uuid": "b619cc0d-c88b-4feb-a943-4c5452883039", "value": "192:AW01kgzngjoWLMuDLRei6DUilEwp4leSDbMQKUSvu9zwwHX4OiMgW1I7bMvJxTmj:AhbmMutAZ6wp40weu9NHRg7gav8U9cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775150706, "uuid": "2c3216db-06e4-406d-af97-5b509ca1d29f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775150706, "uuid": "a453c4fc-609b-46bb-9dd3-4aeb0f7a0153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150706, "uuid": "a2189a89-12ad-4b92-bed3-d81ac9280801", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a7b8bd-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125366, "uuid": "27d8c4a4-3da8-4d55-8bd5-7b0c9c208bc7", "comment": "Malware payload (Mirai)", "value": "692e85469f0e3781e93fd1d460963c8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125366, "uuid": "8fea189a-fb0b-47fd-ad57-176b63371583", "comment": "Malware payload (Mirai)", "value": "0d0c3335d2e29a6b7d121727fe015d53ab8179c4fc0930e7ee5d7f899199a8c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125366, "uuid": "55be5892-10fb-43fe-8e88-492511cf5ae7", "comment": "Malware payload (Mirai)", "value": "bb960164eda1da1d58154f5c606f7af69c285007", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125366, "uuid": "ee711b0f-66e9-4c9d-b911-015584956bb5", "comment": "Malware payload (Mirai)", "value": "1cc1f8d6c2f8a427f19469811ff42afa96d54c7a34c5be22bfec11de3905d8eb0536dfac64c48944a65eb6ddd25e9297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125366, "uuid": "59d4309a-9918-4302-88c9-23bc492a4c9b", "value": "T1DD632986B9828A53C6D423FBF62D01CD332663A8E1DF3252AD122F5137C682B0D7B557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125366, "uuid": "60dc3c5a-7759-4de6-9a9d-f986a4ed63f1", "value": "1536:9BB4qBH2nQVQf/OzQok/lF6dcEAm1ZrQh2F6+HZAY:9BFBH2QSf/OkoIF5mvsh2F6+HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125366, "uuid": "6895ec1a-35f2-44a1-89ab-ba82566ffbe1", "value": 67004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125366, "uuid": "46c62cef-56d8-4ad0-b8ba-4f2925743a0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125366, "uuid": "fe12a990-171e-404e-8108-6e3103080635", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf8170e-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125298, "uuid": "bfe1847f-22c0-4d09-b9b1-7c368b0eff84", "comment": "Malware payload (Mirai)", "value": "173c708a0dce62b59597aebc81fae5a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125298, "uuid": "afb73a48-ea23-4752-a03c-efc8117874c9", "comment": "Malware payload (Mirai)", "value": "0d2cb19d3edbc84bb321695479263f8dca95f3666a5c085efc6760f3ebc39326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125298, "uuid": "c3853f42-e325-4372-a142-6d7342cc23b6", "comment": "Malware payload (Mirai)", "value": "0a4cff8db1b4e85159c51367456fbef01d30ce68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125298, "uuid": "35e9dc3c-9cb3-4e2c-9476-17554f5fddae", "comment": "Malware payload (Mirai)", "value": "75dfd75c1b4c3bb98f263e0477e0870a7260c6748b4bc56ab6cd4370b3014c0ebce6f9d473e24e84bce9bae330833380", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125298, "uuid": "fff9ba73-4de6-4f74-b6d9-23acceae5b34", "value": "T1D9935C13B9C480FCC849C13087AFB536D963F17E1279B29B73D4EA127E8DE511E6A680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125298, "uuid": "0fdcfb0e-d87f-4644-b2b9-be4d7eb4caa9", "value": "1536:yc50J45j1WS60TzxMyQk8TCzyRgQQ1h1Ms6fuftHHZlmpnahB:vf5j1W0TzxV8QyR+1h1Ms6feHHXmQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125298, "uuid": "97e5d990-90cf-4c25-bc67-27c61f7b574b", "value": 88928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125298, "uuid": "10d8e4cb-478a-40b1-bee2-c948169964aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125298, "uuid": "208b2502-30b7-4932-be2c-41e615415c01", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172c3963-2e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775137047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137047, "uuid": "c40578de-8343-4755-9e2a-c6219ed4c030", "comment": "Malware payload", "value": "2288950147cb1c20ed587a059c9496d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137047, "uuid": "a624562b-184d-4743-8d0e-2053c6287465", "comment": "Malware payload", "value": "0d8cc1710212924a9233cca7d2917676479bd6203cf671849f81e5d9c7448e8b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137047, "uuid": "780c0445-3647-49ae-b5be-ee2b517e3fc0", "comment": "Malware payload", "value": "dc142f4d518358d4563e2607f08836bfd1c2ed98", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137047, "uuid": "df4fc6f4-e7d5-48c8-b412-1a32af6b4218", "comment": "Malware payload", "value": "d3e23c1a8f671b5a9d265b765245b711f1c7b4a6b62501ffe599c0133474863f7bfb19fdcb5022d8dafcd4455b53046e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137047, "uuid": "f2c59a1a-fb44-49a1-9dec-2823d9fb8d4c", "value": "T1DAE02682851F18E2F05713B2C24616A14B94626049826F968C747AA08E092611D6B2AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137047, "uuid": "49f7eca5-1867-481b-91eb-c8e4981b9585", "value": "6:5jSyZ3wFLLrbcK13smItUNn5FQpH/Wg3GaKsORopFSyZ3wELEt+lK:5jXZ3AXcK13smItabsH/f30R4Z3ZgtaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775137047, "uuid": "b7a27562-82af-4232-9833-708e1a927de7", "value": 339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775137047, "uuid": "9b6f4a56-7c51-4ee1-a1b6-27ea6dfe8a02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137047, "uuid": "2856f0c0-cbec-45e2-b1fd-7b608af16aee", "value": "RE_08745689.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5be1c8f-2e57-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775109074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109074, "uuid": "fd6bb034-c4de-416e-8741-b65c6cff9aac", "comment": "Malware payload (LummaStealer)", "value": "63f8de3058f913742faaa8004f404d10", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109074, "uuid": "e984e9b4-e6f2-4950-9cec-fc0dbc6ebe33", "comment": "Malware payload (LummaStealer)", "value": "0dfed1b9b09e103d363e6a9ee3371cf99db771f4d7b1f4b350255e3faf333327", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109074, "uuid": "71f7c691-8dc4-480e-b73a-938ee0781fb5", "comment": "Malware payload (LummaStealer)", "value": "2a49101a5fcf532fbc145e3f2551756f81157bc3", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109074, "uuid": "665e5f58-a657-4c52-899e-7bf954315a02", "comment": "Malware payload (LummaStealer)", "value": "188a7e704410eeb97028664e7d9de2cacd10edb8dd935359269a8ebeedea1783864bd0cdb7cf5670c2f425f4abaf7cd8", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109074, "uuid": "e0604087-89fd-4cb3-a362-e16ffbecb912", "value": "T16B655B00FD8746F6E41217325AF762EF673A99090F329A87EA447739FA772D11832352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109074, "uuid": "8c6e90ac-b9e6-4551-a3c9-ed6cc1575b93", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109074, "uuid": "9d83cd69-27e7-4cc6-8bd8-2944185ed155", "value": "24576:6km0e3Za/nQvLK9BITt7b40ez4gIqYN8jyIrcbl09JeGzwo2HdxOcwvwrSnH4/iY:6ucgy9s8BxzoWVwvwmHuiYIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109074, "uuid": "bea79fcc-64a2-40f9-8710-7f161413f1c4", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109074, "uuid": "7927aac3-eeb1-4996-a31b-de738f4a441f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109074, "uuid": "9ceebe47-8a7b-4766-8155-5b9f43054105", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c429f22-2ead-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775145700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145700, "uuid": "e8e41636-fee9-4904-ad3e-4d65c7750768", "comment": "Malware payload", "value": "63f9a6db81dd11cb164adbbb5c8d4356", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145700, "uuid": "7a14ff54-fe5f-488e-b740-26aa52b90dda", "comment": "Malware payload", "value": "0ef7afad81d11926f72f2d639e430c23e77cdf94d2b53bb4c59c5ef40ed8d538", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145700, "uuid": "768f2a16-5636-4de0-9960-6515f8999ab9", "comment": "Malware payload", "value": "e1e1c080b3ec8943ae924458b479ede621e56a12", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145700, "uuid": "b5272f47-3429-4159-b684-a2c8dc85fe28", "comment": "Malware payload", "value": "cd595e823ef584236c3a172ca19647bb0c2608a2d18eea15ba1b60586245ae5275f4ef5ea217825a692b1412ea7ab352", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145700, "uuid": "ce5dd1d9-b7db-48b9-b278-e780b5a5d680", "value": "T16CE423EA1D0B9640D1DF1170DC3B697657764B040226AB30C3B8D7FF4F60E26AA7E1A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145700, "uuid": "ba7ba2fd-464a-4647-a537-b191a8ca5bf0", "value": "922a2109c065982c33037e696c8c2197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145700, "uuid": "d9ee06f1-f596-439d-8092-b3461147dcef", "value": "12288:Ja76dyCzvTxUIKQaSdHCdx29BO5yQAwEBNAeFXjVs7cfey:1yoTW9+dHCdeO58bA8Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775145700, "uuid": "59110640-3bde-4e44-a964-92a63e727ea6", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775145700, "uuid": "8f5021e3-1ae3-445b-9263-1882fe7c0c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145700, "uuid": "51732778-0a75-43e4-809e-cbe104aabf20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74dae3e-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125371, "uuid": "c01341c8-87c5-4274-91a1-5e3a3bc00e92", "comment": "Malware payload (Mirai)", "value": "e8c415b4cc959b16c98bb53aa58d4ad3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125371, "uuid": "ef114330-12dc-45fd-8b69-faf5ce9a3bed", "comment": "Malware payload (Mirai)", "value": "12ead33440cbf019a3731d09bbdb9de0fb97316323d3758a12ab9caa69eee154", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125371, "uuid": "1de39f77-47e4-45ef-8b9d-e349dc2ed4e2", "comment": "Malware payload (Mirai)", "value": "d96c8ce61257ab3b39d3a701cbd2d08400b66d3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125371, "uuid": "6f20e677-7241-4a8a-a292-675ef2c3823f", "comment": "Malware payload (Mirai)", "value": "1d50215b72f27cab804f19e9f66e6a7969013824b2689bef919246a5ec937e920aca4da3a19e3a370e2d641f7b2d008b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125371, "uuid": "04f250a7-edce-49c8-b2e6-e50afded79d6", "value": "T109432C95FC9245A9C7C117BA771A968A336263A9C2CF7313CC0C0B5176C9A4F4E6BB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125371, "uuid": "c66a0ffd-881e-46d2-b122-80b20c7a4dc1", "value": "768:cVgcik7nohvan+Ybl8dGsf/eMZr5IrdJKZ6n43767oM72F30nIz3:cVgcikav67ekgecNIrdJKZ63o0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125371, "uuid": "03ad8ca5-eddb-46b4-a2f8-2c48c1b55d78", "value": 55344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125371, "uuid": "9640985b-bac5-4d51-b6ab-5731eb54cc85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125371, "uuid": "b1db83c2-0b42-4823-a902-294549c4bc2a", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4608de8e-2e83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775127677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127677, "uuid": "eaa66251-24f2-42ba-9b55-db7cc67afdb4", "comment": "Malware payload", "value": "19f3c827839373e60dac7ccf15fb8b60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127677, "uuid": "8b3206a3-99ff-4060-bd53-73e21a8ccaf5", "comment": "Malware payload", "value": "1310cb173cb1d94c4facda56a406768eb2937679d013069eab327cf4bfa4d30b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127677, "uuid": "0110f781-cdbe-4e2e-83cd-61606de6b118", "comment": "Malware payload", "value": "4b88bbe510b732f26d0f899a4720000aa0464479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127677, "uuid": "38992891-3b85-4b76-a456-51f2eda7937a", "comment": "Malware payload", "value": "64b67b1e2669a6a105cc4ae83afdcaf93003ce46c068ad45da02e0e10a21c4184706ba5a5c4275c39e2c5f480b7726a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127677, "uuid": "0689f8e8-8ef8-4214-877a-732c9b0ce32b", "value": "T12237331CE6BD0630F174417A8B8B4A17D7F2B5CA4732D4AF23946EA90F4F6E49232752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127677, "uuid": "4a62db05-65ce-4d72-94df-f9312d1c5537", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127677, "uuid": "e21dc247-c807-4389-9997-24eefb5ce0f7", "value": "393216:DtOCOQURlP8FGo71cPB5tcTkDV/gLkzZ0NmkQgUb5n1mP9oLz:pOCOQYGFGHBTxV/gLkzZ0NLhUdn1SCLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127677, "uuid": "b9d7f10c-2799-43ef-8269-f32f6274d231", "value": 22374712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127677, "uuid": "767bd2c5-80b9-4b17-af1b-d6f2410c7139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127677, "uuid": "4c54b1cc-d554-4fc6-9daa-3e34704a6e66", "value": "1117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2757abb9-2e5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775112164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112164, "uuid": "58a052ab-ed33-4451-a9e0-013bdd9b9c9a", "comment": "Malware payload (Mirai)", "value": "061aeca52caf72fed4587f4bffbfe959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112164, "uuid": "d220b80e-30e3-4a4b-96df-259423032939", "comment": "Malware payload (Mirai)", "value": "159c73d8e746064ba1187265ac47ac3bdd35642275c68a10d8fe45722652d336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112164, "uuid": "61984939-265e-40b3-a5a8-bf547b8df438", "comment": "Malware payload (Mirai)", "value": "9d4b691be70c22d47f8b0f1aee6ea927e6800464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112164, "uuid": "061480b1-c589-4ef2-92f7-7ea36114c094", "comment": "Malware payload (Mirai)", "value": "17bee3b668313f2458813514419b60b83869cc33230ed92dacd2322e45092dae96447df7d02e3d392c989fb13b76ac82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112164, "uuid": "a3a7d4a7-82c7-407d-81b8-5073c905b0b6", "value": "T134F31A45BC918F27CAD622BBFB5E428D332617A8D3EE71029D255F2537CA85B0D37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112164, "uuid": "a13982fa-38a6-45f4-b81e-b024884a68f3", "value": "3072:rVZkrfIxfnYL90Mwv9LF4HRH/n9TIXc7:rjTfa0fVLF4xH/ZIXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775112164, "uuid": "00114a91-3f6c-4454-92c1-c507673f29b7", "value": 170752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775112164, "uuid": "94854ad3-3e3b-4c68-8de2-a3090e0f6673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112164, "uuid": "17008dd8-ef05-4b70-869f-482dffc0f720", "value": "rebirth.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca530f68-2e2a-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1775089674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775089674, "uuid": "f62d46c6-48d4-4847-abec-fd576e40da3f", "comment": "Malware payload (SyncroRMM)", "value": "f02eaeb1d7faa774395b4984a3c7c00b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775089674, "uuid": "403c2af5-326e-4b79-afcb-427180ad256d", "comment": "Malware payload (SyncroRMM)", "value": "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775089674, "uuid": "fd01dea5-6ee3-43c3-b2ee-d3180fa2568e", "comment": "Malware payload (SyncroRMM)", "value": "7873c21dd7208134fc44528641e2ed6ca8ee3357", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775089674, "uuid": "5bb480cf-ef75-4719-98c5-9fee79e66c51", "comment": "Malware payload (SyncroRMM)", "value": "54312893080f6a01be1fb77e9a11a86007898a4187405482eeddca706917ea8a4e186c3c1800b2cd304a6a5853402fb5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775089674, "uuid": "9dd8f47a-1209-4817-93c9-573bd472934a", "value": "T140461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775089674, "uuid": "65106d94-80a7-4a07-8f73-da42a0d251fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775089674, "uuid": "947def12-8baa-4532-83d7-fadeefde7618", "value": "98304:Ch/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:Ch/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775089674, "uuid": "248eecf3-7fe3-4adc-91d7-d0580af7fedf", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775089674, "uuid": "5e03ce06-08b9-4284-83de-73a0e2779457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775089674, "uuid": "c50605c4-03e9-427e-b4d3-549dd5302bb0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ce426f-2ed8-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775164259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164259, "uuid": "95b7c8f8-4f99-4719-8ac2-b12a648af0c3", "comment": "Malware payload (Smoke Loader)", "value": "1e2dff1284170abec99f68a0e367729e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164259, "uuid": "2979a9ec-428c-4ce0-9146-b53c05afa163", "comment": "Malware payload (Smoke Loader)", "value": "1713b425157a02715f62c250ab2ca039f02923be43ed8715044a99f9947c7be3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164259, "uuid": "58a57def-5c35-442a-9801-caf0ff08499a", "comment": "Malware payload (Smoke Loader)", "value": "98c2bb6d9a4df9f61b4730bdab274e0c80f7098a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164259, "uuid": "3b6bcf99-7386-4b7f-b710-c07a805453f5", "comment": "Malware payload (Smoke Loader)", "value": "c0d992e12dfe2aa5dd0793f9491577a97715e380b005199b9976b241365536a9ae4790ceb80b260dfdd217d1098a2ebd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "padaz-pics", "colour": "#E5FDA4", "exportable": true, "hide_tag": false }, { "name": "parky-pics", "colour": "#433F13", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164259, "uuid": "f0235fab-fd93-4cc9-8bcb-262bc15d70dd", "value": "T1BF36BF46B2A401ECD177C179CA869A17E7B1780903709BDF17E0466A6FA3AF05E7F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164259, "uuid": "8d6fc012-49ef-4d32-a010-1fbdd321640b", "value": "10f3ddd82e8c39f44ceacd313bbd2fb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164259, "uuid": "523ec54b-539b-44e0-a659-344df75aeb5e", "value": "98304:vRwpB0a1kPogHEpb7xoVIwYxwSNZb4XgRzox:pw/0a1k7HCb72IwqwSNZb4XgRzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775164259, "uuid": "c0ade5c2-b5df-46e3-a9b3-5b8e73747755", "value": 5084160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775164259, "uuid": "558e48d3-47bd-449d-b13a-ab7c59283fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164259, "uuid": "3a36832f-7b1f-4311-9cc2-1eb8ae506fa3", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5123e72-2e34-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1775093906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775093906, "uuid": "f96c5f07-3fd0-4c0f-a50f-505e1e11792b", "comment": "Malware payload (Tofsee)", "value": "a106222b3f7f1565fb3ef965903af570", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775093906, "uuid": "2432f61d-5d9b-4f3d-993c-c177a9727854", "comment": "Malware payload (Tofsee)", "value": "171fff8f86c59aec72d7f18456f115da2aafa67cbe87de69e8a47f80d7ee3d1f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775093906, "uuid": "00e4a6fa-cbc8-4b8d-b789-d3abb1f87996", "comment": "Malware payload (Tofsee)", "value": "c4a88b54952cfed7a7075adf3cf9ddc4aec93ef5", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775093906, "uuid": "f8ddfd15-0799-4c37-bb2a-1ef9120c55c0", "comment": "Malware payload (Tofsee)", "value": "cd611fc1a5f9ddca8de9b9290319e6eee12a389244973a1122bfb41232fa022a774155b20c7ccc3732eb30955f22e2a7", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775093906, "uuid": "3901d192-b72e-40f1-8ccf-ed87765b48aa", "value": "T12A760137B28A673EE06E5A3759F2D220583B7A21651F8C1697F40C4CDF2A0A01E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775093906, "uuid": "0dce6495-a43b-4e1d-a649-96db2b115ac5", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775093906, "uuid": "d69a76ca-f7d0-424f-9f9d-eb49d5e08397", "value": "98304:4N66pUcIIplsI3ueuWpigp6OLrNAC6ZqQ:8pJprXpiaPLrGC6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775093906, "uuid": "609e1feb-9d84-41d6-a755-4519ffe10ced", "value": 7721372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775093906, "uuid": "6804ba2b-adf5-4bc2-9144-03d91454c7c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775093906, "uuid": "a42bfcd8-4b4f-4646-bcf3-661b8978b8dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f62f586-2eb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775149302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149302, "uuid": "505c6ea3-dad5-4567-9a60-2bab75f7c44f", "comment": "Malware payload (Mirai)", "value": "8b46f625506feafe8be7d2c0d583039b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149302, "uuid": "02849011-6dd2-40d2-8614-522e0cce5203", "comment": "Malware payload (Mirai)", "value": "1794dda4c20bd94854d5d6c6ee535f5769d7662dd7130ecd16a27487af94af48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149302, "uuid": "618461d9-2e8f-453a-b3f7-fc36d9151240", "comment": "Malware payload (Mirai)", "value": "bcaf4d9157223c97bed34b42fdcb436605f95363", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149302, "uuid": "440ebb18-f7f7-448e-87c2-6da352c3be23", "comment": "Malware payload (Mirai)", "value": "f24003d6cfd72e5e2a6d582fb0821ff56e564e76323dc24d4b23b0ac2aa98e3fc404147934816a566070481057e37d19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149302, "uuid": "9192a929-e7d9-47df-9452-0c5028997537", "value": "T13204A75E2F238F7EF6A8873447B74A25975923D623E1E684D1ECC1045F2029E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149302, "uuid": "4ce43eb1-4d84-49d7-b243-782f641f51a2", "value": "3072:v0dWaWnqziCNT6oMUysCz42RseODgHBpwrhkY:MgPnqziCNrfw40gDapwFkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775149302, "uuid": "2c505bdf-f1ca-4a61-9b2b-b34ba8cbb037", "value": 181888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775149302, "uuid": "3a1db838-fdb5-43ff-b8d5-85543b7891b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149302, "uuid": "3ca297f3-5795-4977-ba6c-e64b806ac81c", "value": "upnnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4210d4ae-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095888, "uuid": "f3ba8d7c-dfe5-462b-89d7-e8771125e15a", "comment": "Malware payload (Mirai)", "value": "ed3461a121c1684f59653192bf118840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095888, "uuid": "107c9740-521e-4063-8e0c-6aebbaa12ee8", "comment": "Malware payload (Mirai)", "value": "184582c73e42035e4db9c0a298f65cda04dd19c5bc5faf02b47700c8e158b9cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095888, "uuid": "506a8b21-b887-4fd3-aa79-385b48f7c3ca", "comment": "Malware payload (Mirai)", "value": "29a1aa2b326264897dfc7d82d96d5f0c884329f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095888, "uuid": "b0a45f17-4015-4c00-8f5e-3877f00f5c89", "comment": "Malware payload (Mirai)", "value": "03d0f8a7b25debb1caf3c7f12b4eeaca27b651f201cbf39481eb7a5e68c025f2aba7fc0d4ace39a3aafe6a9ade93d8dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095888, "uuid": "a4d173e6-e2bb-408f-a0e2-bfaf24db131f", "value": "T1D3E329C7F800DEFAF80AE33648570905B630BBE115921B372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095888, "uuid": "368d7631-b3c5-4e35-a53b-a06d33c17101", "value": "3072:GmzTDH86JG78FenJljAX0Gidw+w9EEVvjbiQLZrEyqKY9f:G2TDH86JOHjAX03dC9EMLmyql9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095888, "uuid": "5f3f1dee-8358-45e5-8b62-6c35adc269ee", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095888, "uuid": "42a8536c-7999-44b6-9a76-1e98ec6cf947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095888, "uuid": "0a5e707c-ecae-477d-a3d1-02ccd7b0b59b", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47f4d96-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153713, "uuid": "ea8e9735-ac26-49b6-9912-92c1fbf80997", "comment": "Malware payload", "value": "4f9d269c00e0b1c77c52a795bd3b4b72", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153713, "uuid": "ceb73076-7438-41f1-978b-4ef720e667c9", "comment": "Malware payload", "value": "189af922b12f73d17d9c1e169861f99b2bc9b57634fe5fbec76881ce57d20f0f", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153713, "uuid": "34f8c367-dae3-47c0-9371-5dcca138cd69", "comment": "Malware payload", "value": "53603671286cc1b63ffa178fc4947f218b2cec55", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153713, "uuid": "7cc1abc8-60e2-43cb-a5b7-3eb933616699", "comment": "Malware payload", "value": "7833e6da400d890d8679f2fea24e1ee3cf85a9621829e922e56039043c0f1a68b745ef83a6687bf7c71cb7b55001c119", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153713, "uuid": "78d81880-cfde-4c32-8eba-a6545f8dcfda", "value": "T1A5A4F11E7FD2CA65D037967501E5C193F8095A8DD006AB2F27F49D9B8E2CC490B0AEDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153713, "uuid": "1d758a15-1b4b-4b54-9403-fb1b91730444", "value": "12288:1H77Xqio9mn9ut+XGOOZvPByXKvX2dg4IwaCH:1H77Nwm6ZUXKcJIvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153713, "uuid": "288c854f-75f7-4f44-af41-5b00e9cc8662", "value": 467058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153713, "uuid": "72630fcc-e87d-4b6e-a6bb-7c8a64e1db75", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153713, "uuid": "3ac80884-1220-4099-bb2d-a34b030f420c", "value": "189af922b12f73d17d9c1e169861f99b2bc9b57634fe5fbec76881ce57d20f0f.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21cf75d-2e79-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775123563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123563, "uuid": "2194593e-5d00-4f2a-b293-98761456a713", "comment": "Malware payload (QuasarRAT)", "value": "81137690bdc74ad0b27945b36b9e41f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123563, "uuid": "72d47dc3-19c0-4d76-865e-363fdef4e5b0", "comment": "Malware payload (QuasarRAT)", "value": "18a1f4ed77c4b109d3bddf21854abc26376f8846d7d43af248e44341fab7012d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123563, "uuid": "9f20c27e-129e-4326-88ae-9d62856b5ea4", "comment": "Malware payload (QuasarRAT)", "value": "b216caeb12e60970edfe40ca20f9947f0248df42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123563, "uuid": "2ec792c7-22a8-47fc-9d6e-a78928a4da19", "comment": "Malware payload (QuasarRAT)", "value": "2638c1cb3e58883373cdd09a847f30a7de43d31eee2d5d95d79c3d3b5491f33aa16261bc91d239411ac64c9bc27cdbe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123563, "uuid": "4f904b1d-8799-400a-9b71-2f878ed963a1", "value": "T173C5012177F5810AF3BF1BB9ABB6005E1BB7B513D67AD39E1888605D1EA37409E00367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123563, "uuid": "04c90426-c6b2-4c96-84d4-c72140835582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123563, "uuid": "2a99630f-4470-490f-a6ca-a97cd645f74e", "value": "49152:ooDVBiNgLmnc/N+ZZXZQOLHM7wRPirm2NnPTKKm77LrwCB6uand:PDV8NgScVIxpL7oZNn2Km77LrwkFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775123563, "uuid": "8f0a325f-54c2-4863-b5b4-ac5ac76419df", "value": 2709504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775123563, "uuid": "9680f88b-a0ab-4e40-8063-8848c84f82f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123563, "uuid": "d2a15fea-4f9e-422d-a1ad-7a17d2f81b57", "value": "Client-built.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc2ce4e-2ea0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775140142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775140142, "uuid": "e8b1efc4-0b4b-4fb4-b004-4d75ad431451", "comment": "Malware payload (Mirai)", "value": "edbf9482503b53f5e14aad85f4e0dc0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775140142, "uuid": "385c5357-7830-4585-a144-63462c69d559", "comment": "Malware payload (Mirai)", "value": "1c2219f1d3badcd05f2a7a148016dccce79d21dd5659278ea3741ed364f44035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775140142, "uuid": "19fc2bb9-8ac2-4b33-8c1c-7c0d0f7d7fcf", "comment": "Malware payload (Mirai)", "value": "e385c440fe23975cff149a79fbfc2eb1a8c5061b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775140142, "uuid": "4b24415a-e679-4637-89a0-77d1639a741e", "comment": "Malware payload (Mirai)", "value": "9c10f2c070d3f841c3f83a25f364063e512f93e525d82c92104730c8707509db8141e6ff34251f80494c8bf2fbb4f6ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775140142, "uuid": "beffcf9e-de50-4a24-b0a6-7f472a1da6a8", "value": "T152E3F856F8819F12D5C111BAFE0D524E37231BB8E2DE72029D246F717B8B8BB0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775140142, "uuid": "509442c7-ea2c-4e37-9e8a-78d14067f087", "value": "3072:YyKY30cQ/7t1X9oR2a5WN0kier7bbQRCC9zevms:Yy5BM/X9oYaUWDa7bbzC9zMms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775140142, "uuid": "7e93c320-ad9b-42ee-ae02-d17b26c190b1", "value": 147856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775140142, "uuid": "0f4b5e54-9b26-41ad-8f9c-81a46c71b722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775140142, "uuid": "a250dca9-3863-4639-ad04-31e3ab555ab7", "value": "systmed-login", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f9dbee-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153707, "uuid": "3a261816-a4eb-4d7c-93d2-272b82a62bf9", "comment": "Malware payload", "value": "2291f87797d53bb2e1c9aaea26c9e6f1", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153707, "uuid": "4715881d-cd13-45ba-b40f-aca084e2c963", "comment": "Malware payload", "value": "1c84c50d8537855b9c9f58a238d81d2077e65ebc32088c9afeaf2ed1a8badf30", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153707, "uuid": "85765a92-c32e-42e4-923c-b582fec9ffb4", "comment": "Malware payload", "value": "52400f63ef03e6dfcbbd8118cd846a0b4eebbb7e", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153707, "uuid": "32122eb2-1c12-469c-9585-016998a55103", "comment": "Malware payload", "value": "9e7c5702bb34898771f866f0d08a5712534042927e9707f97c1363963e8da6e15ccdf8e18be8a0d7229b0bd0d4face86", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153707, "uuid": "23fe0713-4642-4240-b7c1-f79ac992da75", "value": "T1C375F112FEE4C465F123A97761A281A3FE2A4794C543E66704E49AC748E8C460F2FFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153707, "uuid": "b533f459-51ea-4902-b59f-25e99b297519", "value": "49152:m+TKzaANtO7vSGQnBeKbu/YOGBxTsmyMBlSYIJoJsq:mC4N0jQBeKbkYOIzTSYIaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153707, "uuid": "aeae81ec-d7c5-4742-b629-f8d497ab8b7a", "value": 1631220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153707, "uuid": "5e6eb3fc-7aa5-4acd-a5e6-9e47f789e521", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153707, "uuid": "52b8da2a-f3c2-421a-ae04-79c240d87ff6", "value": "1c84c50d8537855b9c9f58a238d81d2077e65ebc32088c9afeaf2ed1a8badf30.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbc8689-2e86-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775129029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775129029, "uuid": "6c8a0cde-eabc-428f-8400-210de006f71f", "comment": "Malware payload (RustyStealer)", "value": "f51cdee107c868f8e1048a54e3813f58", "object_relation": "md5", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775129029, "uuid": "918f73cf-fdd8-4845-8640-6702b404acb6", "comment": "Malware payload (RustyStealer)", "value": "1e2815e66bf6bf2604368349d86435e5e648ae44910e196e323ca09375e8e1f5", "object_relation": "sha256", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775129029, "uuid": "2dae70bc-83d4-42df-acbb-4bc16ce5a984", "comment": "Malware payload (RustyStealer)", "value": "5af201dc212d301281f6c1cf3bf722371db38543", "object_relation": "sha1", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775129029, "uuid": "cfc1d0cd-c4c6-487c-8b18-5bd94bf24bb8", "comment": "Malware payload (RustyStealer)", "value": "e19c8970c3fce5aaecae3f67bdd64d2ac99d03e51326c8ac786f497522dea007c358b7267131aa60bf0c00791348a66a", "object_relation": "sha3-384", "Tag": [ { "name": "bill-proof-cc", "colour": "#BF318F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775129029, "uuid": "1b5f9056-83e7-4c77-b2d1-466eb7729af7", "value": "T1DF76B0B5362068B7F52F02F7E5A53DDD93B22A21D74A55CDA0B0F2C22933562FD1AC48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775129029, "uuid": "310ee2cf-8654-4312-89cc-d079deadc17b", "value": "24576:46VZ5EYqayxgSaLALAEo3qlPM42zcPb7VxEIuxSWCIaEVc35sY5sRyPKobxe7ufd:467q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775129029, "uuid": "09b53e44-4c0d-486b-badf-4e959337bda8", "value": 7204864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775129029, "uuid": "8373ee57-7c33-4eac-9ae9-b241ce133539", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775129029, "uuid": "c4bfe793-fc5c-435d-afdf-02621b5fcd59", "value": "Heroic.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc0b92d-2e81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775127125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127125, "uuid": "9427873f-8a74-428e-ae58-88a9e4fd1d4c", "comment": "Malware payload", "value": "d7ae94ee07f973f9535a1fde0de90930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lridia-space", "colour": "#E46E59", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127125, "uuid": "f04949b5-2729-4b2c-951d-9274f59658ee", "comment": "Malware payload", "value": "1e371ac1c69da56b193dd34c2eef06e64279be9d31ee517890f3898a46815c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lridia-space", "colour": "#E46E59", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127125, "uuid": "4347f518-8bd4-44a7-b6e9-eb74059b6257", "comment": "Malware payload", "value": "953c18c9b6e04d8ba5373a49245ef79977ac54ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lridia-space", "colour": "#E46E59", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127125, "uuid": "e7a42f8b-71d0-48fc-8270-b87d187ab293", "comment": "Malware payload", "value": "df4fc6dd8d24fdd7fe4c258b65acfe61182d4f00cc02754ef9bbe344b7e70299d9358b890b97c3bfdcbf4bac00840632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lridia-space", "colour": "#E46E59", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127125, "uuid": "da0dbf00-d54a-40bc-aa92-258425834722", "value": "T1D9D623EC54D163A4D4D38B00728B839971C1765E42ED5C1A39EB7D022B61CAF264EEFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127125, "uuid": "0d2d8250-cb06-4b10-a8ae-67c96af1424b", "value": "4615e544751c07cd514566e672ec2ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127125, "uuid": "812acc99-2365-4c28-97a9-2d39a7947322", "value": "393216:lp6/CIx25vhCkuKLJcT6XkHo9eIYdDQa3x4:lp/v0aDXu3DQQx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127125, "uuid": "3ddfd48d-bf83-479d-ad9e-f4dee2498a86", "value": 12897232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127125, "uuid": "97a05cb3-c720-4dab-8b19-8c39aaf7a50c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127125, "uuid": "47b63b64-5b41-479f-8eb3-6c79d3f69da8", "value": "8gpas83yga.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9848ca3-2ec2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775154929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775154929, "uuid": "dd00574b-a3cb-47e6-b72b-0daf0955d861", "comment": "Malware payload", "value": "e86341a51e521c3dc3282544853930f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775154929, "uuid": "745f688a-9a4f-4ffd-893c-9ccc487634ab", "comment": "Malware payload", "value": "1e5f4b3055968c4c7ca140c4ffa06c318472481a1717a9887a62dc2a509859f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775154929, "uuid": "7fa2e31b-4e97-4893-92b1-e38a96f5a973", "comment": "Malware payload", "value": "73ceeb35c5f07054db3c3885304229ef616f679e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775154929, "uuid": "e34eb57d-ea94-4043-8068-dcd653be61d0", "comment": "Malware payload", "value": "0add64f698e81d383b8c8494092d7947be8b93e63785287d6c0814d7f0d3e8f81b79a102981b172adbbd08b7bb2708d8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775154929, "uuid": "7034af0d-9172-4174-838d-2d691c0782cf", "value": "T13785235267D932E7D8B582B295770083DFE1F83587F25AFF2294A13E8D031914A3A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775154929, "uuid": "e4358acc-c507-4b14-b7f1-df0239a9704d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775154929, "uuid": "cdd87ed0-e4ff-468b-857c-96dbacbffa85", "value": "49152:MQNF9azI+mX59Si4TdqBcbtqtpfEoHONG:MQn96InTMMsstNEouN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775154929, "uuid": "10cfd7f0-4cb7-4b6c-88ec-c291e1b3a104", "value": 1731072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775154929, "uuid": "b775697c-7bb8-4727-9931-99474021da0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775154929, "uuid": "cbc26cc6-74b9-46a4-804d-616979e126fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f874a73e-2eaa-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775144727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144727, "uuid": "4283fefa-06c3-40d3-879d-12f233a0c745", "comment": "Malware payload (njrat)", "value": "2ea92ca6e7819edd34d4be8edba53e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144727, "uuid": "d8da0a6d-0ca1-4f44-8d57-045a9e30342a", "comment": "Malware payload (njrat)", "value": "1ff47164250163792113c7fb4aacbd4f43d5bcb75622e8fd23e92d9049555394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144727, "uuid": "8045ee0f-fe5b-4b82-9652-fcb3c4b2f637", "comment": "Malware payload (njrat)", "value": "59463860594b62d55e922dcddb785ca6858e8fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144727, "uuid": "8e3b111c-45ba-4ffe-8282-05dbb4cbd3be", "comment": "Malware payload (njrat)", "value": "04c6b43eabdb43a30b8e080d37a3085d38781f9a49479bb0c8a1e91dc0646a323448cc131a77b76f37eca2c6b3425c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144727, "uuid": "28205b62-77a7-4109-a62f-24ba03dd720c", "value": "T174A22A4E3FB88855C9BD177489A59A100370E1870523EE2A8CC564DBAF73BD92D4CBF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144727, "uuid": "d9900979-969d-4995-a882-e39056472dd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144727, "uuid": "e2dd85d6-5c8f-47c3-a0f5-92eb346a87d6", "value": "384:J8aZYC9twBNdcvFaly2H0ddJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZHN:RY+sNKqNHVSdRpcnuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775144727, "uuid": "fa1e16af-43d4-4501-89be-63001ec888ac", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775144727, "uuid": "bda0cd35-4e4d-453f-83d5-256283a0da35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144727, "uuid": "ce6b9fcc-6ff5-41ad-9661-53477ad5125e", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4fc16c-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125409, "uuid": "520704e5-6c23-4595-892a-e17bd0b2aafd", "comment": "Malware payload (Mirai)", "value": "63fb72e2d1cc5a147ceea0d35962fd4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125409, "uuid": "3393655f-6a44-4e85-a456-ebeb924ec2c6", "comment": "Malware payload (Mirai)", "value": "207df8bd9aeb27d73e67f4219d8ac9694f81ab8440dbd9a2d8214a34a85a8e0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125409, "uuid": "c6af13a1-7a1e-405f-85f2-ac4f62de7932", "comment": "Malware payload (Mirai)", "value": "50bbb10732920f586c0a7e36deecfcb7433b62ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125409, "uuid": "80e6b1f2-792c-4a29-a1a2-e5d3dd933462", "comment": "Malware payload (Mirai)", "value": "18588d378b5b5d6e60f069f460c33a122fde922dbdafd56be0da7d09e65dada68cbec4dc25cbec4b25fd7ea4e6dea5fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125409, "uuid": "44a5fca0-3478-4558-a9d5-9389b2aeb6bf", "value": "T1BAA338D7B401DDBDF84EDA7B4053490AB130E3620A831F36626BB967FD351981927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125409, "uuid": "74030639-586a-4c94-a517-d68b8d7082d7", "value": "1536:QszQ1QMf9sBikTlnCpONBjk4nwlHt6C8n3aH7IH6J3KSp56Kn7S1U4vqr4KXm:QZswkJnCpkW+wlHt6ad3KQ5Zcvqr4Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125409, "uuid": "b765f2b7-8af0-45d1-a245-45652e036412", "value": 99852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125409, "uuid": "67655363-81f4-4945-a2bf-cf786906c22b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125409, "uuid": "74c4db13-d45d-46ed-acd9-c69e631313bc", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfada36e-2ed7-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775163959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163959, "uuid": "cee44886-fba3-4a33-9f6c-a225023d5b13", "comment": "Malware payload (Smoke Loader)", "value": "c7c8e72c08850a61a536846a33398813", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163959, "uuid": "64762195-d1ca-4b02-ba16-3e907ae60ba7", "comment": "Malware payload (Smoke Loader)", "value": "217a5cd208e22b37784fb81ae87ee4227fa01c52cb5839b6a3516e47f985d285", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163959, "uuid": "1acf83b2-2b4d-47e9-ae6c-2fe0ca721d5c", "comment": "Malware payload (Smoke Loader)", "value": "3d1bb68b5f26c56aec5b7fc8404d2db974c0f9b0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163959, "uuid": "1df044dc-525d-4f69-8c88-c9f65d7caf99", "comment": "Malware payload (Smoke Loader)", "value": "2b38e4890c882c200c0a8dfb20bfb163dd267435595c91be2896b21ffb9a423c1541ee7399ea1cd44bba2ecf6f5ae7d6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163959, "uuid": "b6a1f64f-415e-48f3-8007-4ecf22562c03", "value": "T133655B4B7CD048B9D0BA533289F6A2927B72F8190B3223D32F50A6783F7ABD05975754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163959, "uuid": "4ed3f8b6-176a-44f6-b220-0578ff64c4ee", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163959, "uuid": "5cdebbad-ebf6-4e1d-946a-1b7a62a6c6c8", "value": "24576:LmVfV7T9E358hmauO+m2FrV/1DVPJ/LJ8YjQfhso1kmGRWQrGlx:LmVt7o57/LJ8YCO9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775163959, "uuid": "db0a3569-1535-4632-bab4-8f6d3dcf3571", "value": 1475200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775163959, "uuid": "f8a4ab58-cf02-4e07-b7e9-5d548dd6e401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163959, "uuid": "bee6b3ae-d844-4cba-831c-9aa252e532cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbfd4e5-2e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1775118080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775118080, "uuid": "fc9713ef-7efb-4232-a908-511148def685", "comment": "Malware payload (ChromElevator)", "value": "d86a50b88c8d5ee02b9f9acbd13fcbd4", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775118080, "uuid": "a3e2d1c8-44e7-4105-8505-7cb4b84fd3be", "comment": "Malware payload (ChromElevator)", "value": "2181f44279af82a7099775c2dbdb78b0e0533bceec02c43db5dbe58d9dbbc641", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775118080, "uuid": "6d7855ad-642f-4e2d-a50f-7f6e1f192bde", "comment": "Malware payload (ChromElevator)", "value": "ab47a1817f062b644850a8c2116ca3490a8c3709", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775118080, "uuid": "de080c5c-8cd4-444f-94cf-1ebdb47c3fb3", "comment": "Malware payload (ChromElevator)", "value": "c000008468b4ead6356bdcec68d4ed79b7365ae54dd5396558a360480c4c7c0d0eb910e1e9c2135df2c8c353394bf040", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775118080, "uuid": "75315539-525a-402c-a3eb-fc6869991aa2", "value": "T12BE5027B18B5ADB0C6375FF05A04D142AB2C4F1C9EEF2F775E6564A52A160883B01BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775118080, "uuid": "ba2cc9a4-fef8-4eff-b6bd-7af2ee4a59ff", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775118080, "uuid": "a5a5eb30-6fe2-40ca-849e-edc52bdca98a", "value": "98304:fpnkf54/xZ3A8r8mwhsO1LbvTdeYAe+UkAZQ3mtB7WMS/:ftM54/PAT7seoYAex43mPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775118080, "uuid": "d4753315-adcf-4f72-abf9-006e325a8279", "value": 3207680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775118080, "uuid": "5da499bc-6eec-4801-838c-6fa2ab2022d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775118080, "uuid": "9ad3dd0c-87bc-4f4c-a9e7-7563df9f9bb0", "value": "Riva-s Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89b279e-2e6b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775117535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775117535, "uuid": "202d45b9-8bbe-4c41-aed0-c425c5c54736", "comment": "Malware payload", "value": "65877ba3b44a794f40af6c85e226f52e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775117535, "uuid": "95808349-4704-496f-a197-386781dc8388", "comment": "Malware payload", "value": "2184da03ffbf70aebf7d2beff4d47acff05db867ae078fc900b046cef73ea171", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775117535, "uuid": "f4724ad4-0bf9-4d98-9307-bb7ee1dc503b", "comment": "Malware payload", "value": "8d4742fcb2d693f4a75008e839fa301e1aa19e59", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775117535, "uuid": "b0cb35a1-e56d-4315-b3ed-6a1f9264c3c4", "comment": "Malware payload", "value": "921ed234b37c0e18a48231ab9afeeba01c9ff7017ce19c56b7a1b133b5a5aa66f20fe9970ec223455797b8ae556b9fb8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775117535, "uuid": "e9aa5fbe-a07b-41d9-b0f8-e107d7ea677c", "value": "T101B2D06FE1768633E08B59B9C0847876BE5B4F8041D86F66046558DB38923DBCE093B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775117535, "uuid": "9ecb741f-248c-4d10-8079-a97719e4517b", "value": "384:u3w9gntc65SjY1D4quFLH332AV5cuPtS/ZI2lkc/rwksbHTCcxjQhK/j7nSlx0Pi:g9n6JY1D4BqAgBnjsb2q8o/j7scP7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775117535, "uuid": "30d2fee5-ea28-4fc9-a9f4-03b08320f99c", "value": 25657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775117535, "uuid": "f4f05522-770d-4133-b716-24412b569dd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775117535, "uuid": "4cee4f1f-d1ba-43c4-af08-799b8a5e840b", "value": "dupe.real-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ca0beb-2ee2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775168670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775168670, "uuid": "d5c2e64d-4ad1-454f-8350-fff28a64853d", "comment": "Malware payload", "value": "7d22944bbe8d5156c0760c7f6f2ae550", "object_relation": "md5", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775168670, "uuid": "4af32750-b30a-41db-8c61-fc7637b0534c", "comment": "Malware payload", "value": "2280cfb15d560a94cddab186221fac94f967dfe7359d1c083bf66eab85380fbf", "object_relation": "sha256", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775168670, "uuid": "e6d06567-1352-4037-adb7-5456f92c4363", "comment": "Malware payload", "value": "f9b15820720e99b25b20524840b8e965cf0def03", "object_relation": "sha1", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775168670, "uuid": "0148f724-e7be-4ca2-80c1-5abc6982338b", "comment": "Malware payload", "value": "bdac7a951a1c6bdf15ffd394ecfd7185acad55cdabab1b7318fac853ffa95c7f98d8c7b802278f3b60cb8959411c8aaf", "object_relation": "sha3-384", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775168670, "uuid": "7a6248fe-6ff0-42ac-9eb0-79eb99b43ed3", "value": "T1D785390BBC9449FAC4AA9231897661927B71BC490F3123D73E90B37D2F726E06DB9744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775168670, "uuid": "e872c8c9-089e-4652-89a5-859f1dd37c04", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775168670, "uuid": "cd155be9-9a2c-4ec0-9dab-1df607cb1029", "value": "24576:FojePG5mlwzqqr2HF/H7GwvZpFuJrrzlBeleX7KDg77V5YgWjZun:Fo6ymlMZgFTGwvYJrdXQen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775168670, "uuid": "c9545bd1-6554-4d21-b1c8-a6065ef828d2", "value": 1820160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775168670, "uuid": "d50a335e-8594-4daa-8166-a9f1cf152206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775168670, "uuid": "26e8c333-4ee6-45ba-8a8a-26803ae1c509", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc05144f-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153699, "uuid": "8b9c7186-fdff-452d-9c13-47576385fc40", "comment": "Malware payload", "value": "15133a2ea0c715db25f3138801e4bb81", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153699, "uuid": "f27ef2d2-d141-4dc1-a1f2-fa322f6bd473", "comment": "Malware payload", "value": "242f5497cb5d2a3135834603ded729506fe11e61ba45451a2de134eb28668284", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153699, "uuid": "2d8fa1c7-019c-4a94-99a4-5cabb2d794f2", "comment": "Malware payload", "value": "a7cd3c0bf4dc039939108ec028fa33fb959bfe98", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153699, "uuid": "d359f217-ffae-43f2-b28d-375ce4696844", "comment": "Malware payload", "value": "53bdccd85464f3605d707d2e6c2ced4e242f2ae9cb8b3c0fc61e4f881128df73647af12d3537f59d9cb06701c9ef5e65", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153699, "uuid": "c8580cb6-734e-4dfa-9da2-049362c43d8d", "value": "T14DA4F115BEC1DDE7E237537941D4C193E808569DD006E62FA5A81D4ACE2FC4A0F0ABDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153699, "uuid": "b740dbc8-beef-45c9-ad66-c93ea92236b6", "value": "12288:he6M/einmEwdW+NWfptMJ6CoKoVKd0g4Iwtr:he6MZnmgtxCoS0JIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153699, "uuid": "95570057-80d1-43fe-bc37-d80cdb2a2363", "value": 466932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153699, "uuid": "2d5949ef-8727-4b30-abc4-59828b7e3625", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153699, "uuid": "49109eec-63d2-4032-93df-f115f4fe957b", "value": "242f5497cb5d2a3135834603ded729506fe11e61ba45451a2de134eb28668284.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bd06a6-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125321, "uuid": "60a562d6-bf7d-429c-ad3d-5acd3a4ef059", "comment": "Malware payload (Mirai)", "value": "d94ff792bb63bcf5e7b881e6d18c885b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125321, "uuid": "e7285fcb-0cc8-4881-9580-85cbe0b1776d", "comment": "Malware payload (Mirai)", "value": "255d5d2364463b66f6682e0062273376bfd53edb192547c68466f47565da19eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125321, "uuid": "caade4dc-865e-4ac3-a969-ead36c7973e4", "comment": "Malware payload (Mirai)", "value": "43917596ea02a5ce183d0fa84164ab26e7c8de1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125321, "uuid": "503039e9-c34a-4ee1-a6ec-6a1f8b92ceae", "comment": "Malware payload (Mirai)", "value": "2fde711472946a43bcf4dce95dcc67346abe4ec476b0b90552aa19db7f98d6b12d2acc5ee1cfe599ea7525ebd8a7435b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125321, "uuid": "ccb84f5d-db3a-47ce-9f61-9e64f910a04d", "value": "T1F9C3AEC3FA8714A1C46206F103C71BAD6F93A221CE5FE4E7AC1DB63B5A7A4DB1516381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125321, "uuid": "9ee3940c-87ff-457e-a214-7fcf43826477", "value": "1536:qrMjtT/2h9gqbLjVfAXEAlWuoPVkfFELl5gx1chxs55xgRCE3/LWG:qrWT/i9kXEqn+CFELwx1cMgdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125321, "uuid": "4f4f2ee1-be28-4df9-b1e8-50f65f8b2ba4", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125321, "uuid": "b4798b43-39cd-4e82-b79e-1eb3542a0ca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125321, "uuid": "ddbb5849-24ad-48db-bc20-831b81027888", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ab6248-2eb7-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775150297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150297, "uuid": "a21557cb-f150-4c48-ad3c-92d9710e9343", "comment": "Malware payload (LummaStealer)", "value": "b7776f9056e93bae42733607cd10d4eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150297, "uuid": "3d5c0cbf-31f8-4831-8736-e3cf83b55dcd", "comment": "Malware payload (LummaStealer)", "value": "26541cd26b08929911eaf9d3d09d2bdf06ae314b3c76bd02d2a75248033c875f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150297, "uuid": "3ad6b13c-524c-420e-a4ff-8e7712e7ea55", "comment": "Malware payload (LummaStealer)", "value": "05981d70b6fee535dc7b4b41ec9d96165a244bf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150297, "uuid": "2e90638b-f33c-4963-852b-7d273606c840", "comment": "Malware payload (LummaStealer)", "value": "2b53260ae40a8fc2b8dd99330e14b8ed28a4272cfba32b8b8016b0a210dece68fb80ba9caea8f0f33b16030d47371503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150297, "uuid": "f408a50b-4094-4edb-8127-9eae4801d241", "value": "T1CAE53A62A58561CFC4CA46349517CD73EEAC83F50F1248C3AC6CA4FA7EA3DC611B9D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150297, "uuid": "883a9beb-0189-42d7-9ab2-a2db3139e965", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150297, "uuid": "d6bf6456-2f3c-4f2f-87de-d64eea5df05e", "value": "49152:3LGoyqA7FSnNqxVks9r5bAlDccB4rzCYzSlEddbFWC:38qQsNqxVkm6lAvGYz/dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775150297, "uuid": "9e05a39f-5287-4c2f-b7b4-8b853f387621", "value": 3274752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775150297, "uuid": "581c4064-cd73-424e-b0ad-0597f9f94ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150297, "uuid": "a860b569-96a4-4189-91d5-55b211a48f4b", "value": "26541cd26b08929911eaf9d3d09d2bdf06ae314b3c76bd02d2a75248033c875f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4302ed8d-2e83-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1775127672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127672, "uuid": "d908edbb-348a-4569-801a-0205153c09eb", "comment": "Malware payload (ScarfaceStealer)", "value": "0f2a3dd5dcbf1942c9dd60625375fd78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127672, "uuid": "36fa14de-5020-4a15-bd9f-1aba84effec2", "comment": "Malware payload (ScarfaceStealer)", "value": "273220ff86844cef705dca2fed8a434b2a1546ba1f249a48af9140525371e3e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127672, "uuid": "e75627b5-159c-4e44-a128-14d1d7f31ca5", "comment": "Malware payload (ScarfaceStealer)", "value": "10119355099f9c23cf3ddcfeaccba851e67f0b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127672, "uuid": "f5f4c551-1567-4a78-8ab1-ea6a5eb1077b", "comment": "Malware payload (ScarfaceStealer)", "value": "66702c2a4e16b0a53ddefb0237fd2a9f8953e67ff606a74cadbefaa3ceb09f921b4e01014d6ba5ef1302186332f50f4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127672, "uuid": "825f51e7-992e-4ad9-abc8-4f529cc77cbd", "value": "T17F187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127672, "uuid": "9c00c0c8-ab03-4cac-ac1a-9bdcde6a753a", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127672, "uuid": "2dee97b7-a246-457d-ab82-497300c2eace", "value": "786432:pAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:pAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127672, "uuid": "0364e1ae-a696-4f2c-8a8f-cb3360d0ea2e", "value": 90277888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127672, "uuid": "af59b608-1d0e-4682-b897-76f061e608aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127672, "uuid": "e704fa2d-1e48-433a-9f1d-0c5afad16428", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6215b4cd-2ee4-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1775169385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775169385, "uuid": "a511d5ae-d972-43d9-88b1-fe18373c8233", "comment": "Malware payload (SyncroRMM)", "value": "205d0040267baf8c7b6349a8de452eb4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775169385, "uuid": "73a746f2-f7ae-49e1-9e05-44758db4c322", "comment": "Malware payload (SyncroRMM)", "value": "2816414c2fcfa443d614b66be879dcce5ed506bd816334911954ce3ce8213aac", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775169385, "uuid": "eed2e23f-0e45-4570-aefe-856701b6003b", "comment": "Malware payload (SyncroRMM)", "value": "7c5e6ce08debf0f2d9162deec381dba672fa9667", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775169385, "uuid": "eac8296d-67e1-49eb-a84d-ca63b1837098", "comment": "Malware payload (SyncroRMM)", "value": "95976713f56c01fbf9076123bef59bcffba91578277de7c57357dca86d8173cbae8a5d36038a83cd540c36eac078088d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775169385, "uuid": "e9e0d9f8-a466-47d7-a62f-0f996970c165", "value": "T17D461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775169385, "uuid": "02c1b512-0817-4e2d-a21e-523b43a9b02d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775169385, "uuid": "81bf7354-223d-486d-8bb8-f226f81e304a", "value": "98304:ch/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:ch/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775169385, "uuid": "e0d191f6-b199-476c-8961-a0e11ea65f50", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775169385, "uuid": "18c4e7b7-8011-4b5b-b88e-f5d98aa1310e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775169385, "uuid": "c2a0d22f-3adf-4faa-bc1f-750b2b10e8f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b172c5-2e3a-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775096478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775096478, "uuid": "ff29eb2f-d4ab-4a16-8488-342c1336d813", "comment": "Malware payload (RatonRAT)", "value": "f1ac96f6fbb196159a0c8ced405d3a87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775096478, "uuid": "f273af51-1f07-4a16-8700-5cf52fb99456", "comment": "Malware payload (RatonRAT)", "value": "2b6ed5e201539bd8a9d407080e38cb9e50091395f4d077f21c0a3c6c4475a1b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775096478, "uuid": "f71d6313-3c31-4553-a40b-768a92726e02", "comment": "Malware payload (RatonRAT)", "value": "21c8e527c6dfe7d3d40c6dd5c541e41ad9b94eee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775096478, "uuid": "43db5123-a89b-40c0-af44-5bcc4348d5d0", "comment": "Malware payload (RatonRAT)", "value": "90d422e7e0bf009e1f89c776bf35f94c3fe7b86d72091f6c193e731b1aff259fd4e1684e472e48ae6c61c4141b7ad2b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775096478, "uuid": "88e4d7bb-7225-417a-977e-e9c3948b0659", "value": "T18DD5010C33FACA08F2AF4BF4A87585654771FE179C62D76C59A1799E14B2F08BA10723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775096478, "uuid": "6d427429-d381-40b4-aa70-20c0fa0aa4e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775096478, "uuid": "53aa56c2-e8e4-4ad8-a817-8b5472a3364a", "value": "49152:AqgVUlsHjkmiGWU5FLGpMZ7iKPJ5W16sclR0BxMfzaRw4GsG:AqgVUuHjkDGjzqpgmwQ13uRxfzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775096478, "uuid": "b4a3b9d0-1f94-47a0-8e2d-b81e8ec3e4a1", "value": 3003904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775096478, "uuid": "1dfbe44b-b2a5-4d4b-b76b-7f9257e86555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775096478, "uuid": "a1f96e45-ca0b-4d77-8271-2f20205ab42c", "value": "ratonClient67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f35c2f2-2e92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775134189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134189, "uuid": "f23897c9-e8eb-4e33-98f9-601b7ab6e586", "comment": "Malware payload", "value": "a9bd78eea829facf9068c600560a686c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134189, "uuid": "cdb25209-972e-4c8d-b9e1-148443366578", "comment": "Malware payload", "value": "2bedd77cc5402b2a151ae4f4d9743dbdd12d6368ac16dcf86678bd185315957e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134189, "uuid": "0eba288a-4769-4420-b3bc-8dea62e99bcc", "comment": "Malware payload", "value": "008ecd23558e0f4e98789ed954cd4d2bfe0c91e9", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134189, "uuid": "8592d912-e192-4736-adf6-5b106f9036c3", "comment": "Malware payload", "value": "3b311da9b046d55079d1b23186557307c542b4fb2a0a592d2126272694fd078096b8dbcfbdecd672abbd71ceed15758a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134189, "uuid": "75b5dda0-7dea-4081-9611-cf7bff9d76bc", "value": "T10E23A6F3A09E04D509EB47700E2AB509FF54867BD10CD827684699B79B3D3D97A0F0EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134189, "uuid": "c89b7bcd-da22-4c6f-a24f-125a7e29962f", "value": "768:t7Ek1Uy3ImODcmyar4bLwH3m7nRpq5CD91B6B/c6H:tVOZyaEUWvaCD91ScW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775134189, "uuid": "f831272e-3561-4faf-8e8a-e997fc880ed2", "value": 48407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775134189, "uuid": "d153efb8-f062-4f48-ba59-dd3e0afd356d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134189, "uuid": "a3b8c6d4-f635-421b-929e-ce8216f93e7d", "value": "voicemessage.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924e40b5-2edc-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775166030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166030, "uuid": "badc4f41-11ad-4136-93cd-22b7368b7a7f", "comment": "Malware payload (njrat)", "value": "42e89afa79e0aac8558204a242245e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166030, "uuid": "e50ca3e5-67dc-4df1-aa97-26681a61daf5", "comment": "Malware payload (njrat)", "value": "2c0ed7f8bff17cbcefed1a170fd8b29723538fba2588bafb91be66cdfa81d242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166030, "uuid": "ba832dfb-cbd4-4cd9-be62-22e54f3e9898", "comment": "Malware payload (njrat)", "value": "f1bb5d1cf2dc35ebec17c8a168b70318412e07e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166030, "uuid": "472e6c32-5342-4ab8-a022-38e425cd9aa5", "comment": "Malware payload (njrat)", "value": "2c81a6384cbf0a78ef18cb55d8a7186a0e874fbc9516ae1e288a713bf62601815b60fd28d929751065147b8912f3792c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166030, "uuid": "60136662-bf47-42b1-ac38-1dce3a63bce1", "value": "T16A93D88A73E40961D2FE56778872F3411B74B0971A47F20E49E258A91F37AC8CF44DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166030, "uuid": "27c60325-6813-4eb8-8c7e-9b4461e38b8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166030, "uuid": "9deb6594-80c5-4764-9ec1-628378578c85", "value": "1536:O2d9f84wnJS/I2lXsdLiQW3Y4ztN9ShbYyCX1B:O2d9fwnJS/I2lcNiTN9SYyCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775166030, "uuid": "1ed3fbd8-38cb-4f67-9fca-9c88096636e4", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775166030, "uuid": "573a09bc-7fad-4a01-bb54-eb79ce327dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166030, "uuid": "edda53e0-68e1-4512-ae68-70a253bfbc64", "value": "GammaRayBlast.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9f771a-2ecd-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775159523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159523, "uuid": "7730351e-6200-486a-9cca-23a67946d354", "comment": "Malware payload (CoinMiner)", "value": "49889cba24ba3652ef21576d9c08b959", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159523, "uuid": "1b2f158e-983c-4392-8920-8c28d956fad8", "comment": "Malware payload (CoinMiner)", "value": "2f4afbe3f6077e7d91cbcf5ab027a2fba73b2ed02c2cbf3e918bf170e5a1f9b6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159523, "uuid": "df81f155-33bb-4cf7-aa6b-e4903854075b", "comment": "Malware payload (CoinMiner)", "value": "fb77fe18b299387a9c44cdd0335b7bf3465416fa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159523, "uuid": "af9ba961-d94a-4b55-a713-670b00c0ce78", "comment": "Malware payload (CoinMiner)", "value": "fa09a7db9fc30451bcdc1ca92fb48ed5c5a48e4d8e88493e68c2579312c3e09ddd7755687a72fab683d56c13b626f1ee", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159523, "uuid": "91e44a4d-7112-4079-bb93-d11f541f47b2", "value": "T16122292A7E494231D3A08DF056B14B8A657C26336793B3EBF377D1590FA92448490FAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159523, "uuid": "231485df-bcb2-477f-a3c6-237e8565daf6", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159523, "uuid": "62f583f0-ae2d-4764-86b8-13cafbe3ec23", "value": "192:3foG2wYqBMRx+eFaiPFJxTEZmFhSorc6:3foaY5wFiPFwZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775159523, "uuid": "4baaf31b-e3dd-4e9a-99a6-096ad804a146", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775159523, "uuid": "6f7a21f7-78d0-4ee4-9406-7a87784d6f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159523, "uuid": "8164a63a-1eb5-4ecd-8098-8a6dc1be7dc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac694e2-2e83-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775127819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127819, "uuid": "dad04d5c-0106-4c31-b140-e52563fbb47b", "comment": "Malware payload (QuasarRAT)", "value": "16a123f5f1e6627600586bb3d271288a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127819, "uuid": "2226d41e-43aa-4004-9399-e4f566bfa327", "comment": "Malware payload (QuasarRAT)", "value": "2fe91ae0e4839ae3fb202495f0ab07bdd08c0f06209de131a1660d9a0c834836", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127819, "uuid": "dc0efea5-d316-400d-804f-58be2d9dff21", "comment": "Malware payload (QuasarRAT)", "value": "824f0f62e1f42a45c5112b404604d3d42b457b12", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127819, "uuid": "15610241-6f70-42a4-8c33-1c773a6d71e6", "comment": "Malware payload (QuasarRAT)", "value": "a36c456601d7008b7d321e824dc7f441b26879ca4f0b86d969825b93382384b50983799bd53dd376142ccdf89d39eb96", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Plusdrop", "colour": "#03E525", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127819, "uuid": "4a48b70e-5aa5-4b90-8e9d-e12c7386b253", "value": "T14E57335BD45DEF65D80A5036D14CA6CE21212FEA0D84883AF89E7EF1B2B457390F1E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127819, "uuid": "9c2e8a8c-5987-4db5-afc3-9a93b43862ba", "value": "786432:+Tkq1yVZyJSXhi69IORVwVNxEREnUlio3K:T9VSSxie9RVc4qnUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127819, "uuid": "da1613ea-bec9-4e9a-9e7b-441b487301db", "value": 29708288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127819, "uuid": "f213cb57-61b8-4e1d-8d7b-affb7dabe806", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127819, "uuid": "8350dec7-2967-462e-972a-f1ccfeca01d0", "value": "KLvpn_Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0418ee6-2e78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775123158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123158, "uuid": "129df884-aadd-4675-b645-d992e74c2012", "comment": "Malware payload", "value": "a5c33bf4562489048534db25e324d639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123158, "uuid": "c2df6982-b107-4ef6-8475-c17ee42d0e31", "comment": "Malware payload", "value": "331e362687d355e7421082e8657b8d6be3aef012825205329e0b956f1b391ebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123158, "uuid": "64e8d40b-cc22-486d-b259-c37cfb5693e1", "comment": "Malware payload", "value": "c8ef61f5b8653b8dd29cb1a73756f212bf555f42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123158, "uuid": "0385bdef-4112-4194-b901-cf529493a314", "comment": "Malware payload", "value": "4ab1d10e51b603509043c51b8172ee7aa522bc01fbbcb9b0f78cc169bb03fe0e87f0ff6c6c6efeb39e51b0bf61538a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123158, "uuid": "bc2ef817-7791-4279-b823-d7a2b36054d7", "value": "T19057CFC773C44DA5F2EED23B86979E188263AC11477292FB6442073EAD767C79E34A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123158, "uuid": "312fceba-3232-4e9c-88fc-a39043012ebe", "value": "6170d383c2bccfecef78f4aa59af3255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123158, "uuid": "20f73558-3e4c-4eed-8306-3d8efbee437e", "value": "98304:w9a+HhGdSX7/hCfaZqsOQ3J0TFL0xi5x6Xaq8rbmJe11e82A:YGdSX7/DZqsOnxYohHr6AZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775123158, "uuid": "8490ba26-3dfa-40e8-a745-d7cbecbb6037", "value": 28691968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775123158, "uuid": "731eff24-a653-4ebd-8baa-fb5dc253d091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123158, "uuid": "240a1011-9dfa-4ea8-98d1-24589d6ae380", "value": "vsdbg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4c2601-2e70-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1775119693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775119693, "uuid": "627c7915-25f0-45c9-b505-22721f192f4d", "comment": "Malware payload (STRRAT)", "value": "7925c4ba0f66c2fe7fb1ff45c0272d53", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775119693, "uuid": "dba641fe-7bcd-4a32-aa03-ef046f87ed8b", "comment": "Malware payload (STRRAT)", "value": "33e0e57bf00686dee10f561befa34d584dbcdf9877534c8e206ce1cb132d3d34", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775119693, "uuid": "4f28876a-4c22-43e5-912c-6c2c2c5a72d5", "comment": "Malware payload (STRRAT)", "value": "4ab588703c6fe7fd16015422856ef21836c2786f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775119693, "uuid": "d0c1866c-02d7-4c87-85ff-9eb15fdd4a0b", "comment": "Malware payload (STRRAT)", "value": "30760a6bba9afa9d0d8c6b7e718ab4e4d15ab5c4f27dff388c4d4814158c97ac5e5792fb21ef313bde7814fb970633af", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775119693, "uuid": "1bd4c30a-617d-45b4-ad68-67d7aad77362", "value": "T1D414F19E3EFAC5B5C01740BB46145E37B21C0159F895A61F7AFC2C8A0D74DAA4712ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775119693, "uuid": "8646ff44-928b-46a2-9fa5-94c9117538fd", "value": "6144:waWVW2EqPNBI+NvT45NTObVs/DU8tTW5/:aCqrI+N7+TDdY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775119693, "uuid": "243cb4b9-d7c6-4c33-82e3-b98c41a4eaf6", "value": 207588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775119693, "uuid": "4f02d822-4602-424f-bd6f-3c65039df06c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775119693, "uuid": "c8813ac5-2cfe-41fd-879a-612082139cd5", "value": "Product Purchase.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9e257e-2eb9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775151039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151039, "uuid": "b303b278-1c4a-40c7-bacf-30efcde312af", "comment": "Malware payload", "value": "8bb372e850815c15cc1482646a5692a8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151039, "uuid": "282b681c-eb7a-4a3e-912d-bbac546b0529", "comment": "Malware payload", "value": "34e11dc3d0a4d95e8e7bc520b140f7028f44788b0be359cddf435fa0582365f1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151039, "uuid": "1c1ff160-b038-4b61-84ed-4031216adf96", "comment": "Malware payload", "value": "cb6ccc74e88d48d2a301c458069f62f957d54396", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151039, "uuid": "1ed16765-f325-4171-8759-78985e1998aa", "comment": "Malware payload", "value": "acb883cc32fb3bc2f6759f9d63c3ee2767f607af1015b06415a6529648954d2520c8f6098595b448069c5906fedee8d1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151039, "uuid": "0ea33c10-7d87-48f3-a922-785bd8d9ded9", "value": "T1B3823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151039, "uuid": "868ad82c-ae81-47ac-8636-caeb6bd30f3c", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151039, "uuid": "fca76f84-1129-4c4a-bc0b-9ad23a67df6b", "value": "384:YI78VGI2VxOwflsx0pu9NHRgqav8U9cJ:lHdsx089na0Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775151039, "uuid": "3b6d4ada-9478-4fd1-a4a1-59ed6b3a5d00", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775151039, "uuid": "9d5e76ac-74ec-45e7-92b7-a7a43d4522da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151039, "uuid": "2699ff22-17cb-4e95-90b2-aabf5a18de06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217f36a3-2e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775137065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137065, "uuid": "cdb8bd97-2aa4-40f6-acae-520bc53434e7", "comment": "Malware payload", "value": "c16d472e4d0aa93aa6944ddd79582c5e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137065, "uuid": "e5d3aa7a-e26d-4038-9d5f-eb4747697066", "comment": "Malware payload", "value": "354e069edf6d52b43326a8f6408e95c0bd4c5cb6da3a81971036e18f8b2ca8c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137065, "uuid": "fe8afb23-8ea2-4773-b66e-8375a90219b1", "comment": "Malware payload", "value": "f304bf4025ea57d75a8bff5204c0a8418de63903", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137065, "uuid": "d6858811-1e06-4c46-b5f9-5b651817dc8d", "comment": "Malware payload", "value": "2ffe1189e7f4a79eb3d01289f007117dbccc33103d4aa20ea202b0375bb514bb67fda440b0994517e3ff4568dd915b9c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137065, "uuid": "e807fbb8-4e5a-449c-ae51-5803bc480e82", "value": "T1A6E0EB812768C0D0E82063D2294882A582F845833C0CF1E7FE418BC66F2BAB053C4CDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137065, "uuid": "64e1d053-bf71-4f0c-a98f-9828e5e20cb1", "value": "6:hFqrTFILwCfLKzd+2iN7yeJMs5ZvM4XJ2wZfQSAqoUF045:rqrGEGKAHNJ+sjMaJ2wZ4SAnUFX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775137065, "uuid": "c8fd42cc-dcfd-4cc2-8915-70cf86895269", "value": 296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775137065, "uuid": "b98fffdc-a84d-4469-aa65-716274698d8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137065, "uuid": "381d687a-d0ff-40b6-ac66-81c9243b0d9b", "value": "ccv.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109338e6-2e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775122863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122863, "uuid": "e91c12ca-5763-42e1-9799-74aef0a32562", "comment": "Malware payload (Mirai)", "value": "b1fce9132404e7e8dac5e559af8e3feb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122863, "uuid": "d7b0c245-83c5-409e-b8a0-942a72544846", "comment": "Malware payload (Mirai)", "value": "37a85dfc3f11a29ef6097819ab914eabbf08e4509cb48e19a5d803611060607b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122863, "uuid": "7b690fa2-4c1a-47ad-8161-bea820d9e7cb", "comment": "Malware payload (Mirai)", "value": "f1ed47cdc351c21c2cfca7855479525b879dc65c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122863, "uuid": "ccf0a4e3-8a04-4129-9f1c-6436646e6740", "comment": "Malware payload (Mirai)", "value": "1d6a1733fdd79953133ba97f87eb6938e2e0c235eecaa35c637b2e69714b7a342c372b9283a0abc5e047985d93b0fc53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122863, "uuid": "d546b2b1-4cb6-4e2e-8fa4-138779fecf1e", "value": "T13A53E846B9829E11C5C8077BFE1E118D33137798D3DEB222DE116F11BBCA56B0A7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122863, "uuid": "d8cd0257-4873-4c4b-b82a-fcfd32af0eac", "value": "1536:wRn78zEyaRDCvEsDCbscC6msIrqrrYmPOIRiM/3qFsIwbZnE:aSEJDCv7SscYrs/3qFsIwbZnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775122863, "uuid": "0c6f27ca-3439-4aba-aa26-c70d31225226", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775122863, "uuid": "1c9167b0-aef5-4e39-856e-514a61cc8f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122863, "uuid": "97d77919-a1ee-4775-8009-97265ae9cbc7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e47103f-2e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775117786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775117786, "uuid": "1fce3482-ff9c-42b7-ba54-6001630ad80b", "comment": "Malware payload (RatonRAT)", "value": "630af585ae193745523cef41cea76336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775117786, "uuid": "6071aad9-6606-42e7-b6f4-e835bed417f2", "comment": "Malware payload (RatonRAT)", "value": "37b5b05b16bd471e6395cafe355c8abab118fe4693baa7e869036238c220812d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775117786, "uuid": "316b45f8-9f6e-4102-90fa-b65694e45019", "comment": "Malware payload (RatonRAT)", "value": "9a622e388162f4d02ca9d7fa87eb7a38d98117fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775117786, "uuid": "31dabe3d-a917-417e-be8b-d4bd261dc84c", "comment": "Malware payload (RatonRAT)", "value": "3298b45f27647c355a2200c41a8625e53bb3603fd0449b8d695682960b28c5e9036943088b081b1de29ad005e962219c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775117786, "uuid": "139ab0f0-dab8-4155-b608-c98a1dd312d8", "value": "T1C4934B0473FC3929E7FF8FBE69B510500F72BA179E31D64D598A60980A71B829E10F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775117786, "uuid": "49017d34-5ef5-43d6-918d-11d589896378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775117786, "uuid": "37b3ddee-8c8e-498d-8b9b-5d94a748c96f", "value": "1536:sgBRi6a6WfaGhTsqa4tsi5DQMGF7cSbRKp+CkSC8Ov1N:sgBU6TWfLAX4tnBGZcSbRKzkSCfv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775117786, "uuid": "eb74a6fc-817f-4ecf-9c5b-93c3ce285612", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775117786, "uuid": "d51bc334-3300-42e9-8c4b-cb32b98cffc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775117786, "uuid": "10b8b10a-30bb-4a0b-8fc5-a1cc342d7803", "value": "Solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfb934e-2e82-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1775127528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127528, "uuid": "ee94c3f6-ffda-43a0-ab88-a080e7a66638", "comment": "Malware payload (ScarfaceStealer)", "value": "66c51df111ecb4bb64bd00b28a5be8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127528, "uuid": "1f639191-1f89-47a2-af50-5bc71b4a62b9", "comment": "Malware payload (ScarfaceStealer)", "value": "37c5b6a429b149fa9542c544aa30d6651d9572e713e081f64582eba0aaac1269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127528, "uuid": "3d92c6c9-0cda-4cb4-b595-205f4e9c0002", "comment": "Malware payload (ScarfaceStealer)", "value": "4c1e46308806ea70ed64e8c7895660ea2968b285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127528, "uuid": "12390e47-99e1-4a61-876d-40c73740920a", "comment": "Malware payload (ScarfaceStealer)", "value": "f5baf1b8c692b244ae36ceae7615f68221a93c46082baf05400515c37e1998591ae23f57604602ff1bf7906ec1c8e96b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127528, "uuid": "0354e8e3-ebc9-45e5-afb6-38b125f21d17", "value": "T169187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127528, "uuid": "14a6538d-2d5d-4125-b94d-816f2e2b9167", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127528, "uuid": "2c6b07d8-d7f6-403c-b842-f88e14ad3e6f", "value": "786432:XAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:XAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127528, "uuid": "21d7ecd2-45d7-457a-8522-a32e7e7f2c76", "value": 90245120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127528, "uuid": "c400d5bc-7cdb-4230-9792-ef847b53619d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127528, "uuid": "423b48a0-03b9-4e2b-a364-c354b8ffd2ed", "value": "37c5b6a429b149fa9542c544aa30d6651d9572e713e081f64582eba0aaac1269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e50ab6-2e86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775129178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775129178, "uuid": "a444c87f-a370-4756-90b9-2d517666c74b", "comment": "Malware payload", "value": "2e59f7cbe7ad23fbae276cda57b3ad90", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775129178, "uuid": "c55196ea-193b-4d87-9ad3-d00fa150dd88", "comment": "Malware payload", "value": "3877ef81288520aca410885207b0647c79955655adb023a0c50df0255a8e8b00", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775129178, "uuid": "732757c1-1d28-4c0d-a40b-18b0c3660b1b", "comment": "Malware payload", "value": "6ce61d418f49f0a89000de72fc07c4e8b2d2e038", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775129178, "uuid": "06d49c51-31ab-4c0f-90e5-1a61cb05f013", "comment": "Malware payload", "value": "1017ddec37a37b2b588d1652a9588b3973cc251f5311d85ef91389418b02fd77e9ec335af9585bef47ce83cbf16e2a68", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775129178, "uuid": "89ef82f4-9fce-4b8f-a634-233470c45991", "value": "T1B823C7F3639E06158C2B4A6C1E9D8127FF44C06BC11A681774BE147B4A3E2D5EABF1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775129178, "uuid": "22cf8b18-5564-4e43-9d3d-2f5c84eaeba2", "value": "768:2gUn6UMARWDH3CrIdAh0Gugw+8LZXVrGFkOwDfLxA:2gV5bCrl7bSZXVrGALK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775129178, "uuid": "4102d2c8-0bd9-43c4-b8f1-05f3d1badc7a", "value": 49483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775129178, "uuid": "1a931c31-66e8-4d88-b2d6-29dffdcde4b2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775129178, "uuid": "a551a38c-855d-4779-a390-760f1ca2248a", "value": "voicemessage.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502a23b0-2ea0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775140149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775140149, "uuid": "8f295439-5463-4564-ac28-ce855cc23a40", "comment": "Malware payload (Mirai)", "value": "003473c3230411fe210a458a4ab2d005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775140149, "uuid": "675d61a9-31e8-4f89-9b28-cbf74e36a898", "comment": "Malware payload (Mirai)", "value": "3956cc41fa0eeb99e07dab7f27178d8d392d2275183c9812312348eef1b80f89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775140149, "uuid": "92b70c49-c756-4e87-b5b9-49d82bb831f9", "comment": "Malware payload (Mirai)", "value": "4577c238bb25c003733f0db0bbf66a250306c036", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775140149, "uuid": "480af194-90f7-415d-8bfa-458a51a785d3", "comment": "Malware payload (Mirai)", "value": "b6e286903888a165e6dc293b1454e5f92d82c08efc4dd88899e72ae9d61383084591e2259f2bc0f875213ca6ee3e3d80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775140149, "uuid": "9dbf8fda-8186-43de-838c-f4a672244b9c", "value": "T133A36CC1FA83C1F1E85304716163AB3EC732D8645035EA59EB9A8F36D933941A7273AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775140149, "uuid": "2739a658-0bb1-4618-8423-27b64b9d6d92", "value": "1536:GWrYWK51zZmXJ0/+O1lMWqc66uq0g8APxp1/F:GWsr51zZmK+Wv66uq04F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775140149, "uuid": "812e09a8-8d0f-47fc-a529-5153562ead44", "value": 98380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775140149, "uuid": "51a4491e-95ba-4c56-8593-0030bdf326ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775140149, "uuid": "4d849ade-1716-49e3-a6e9-eb06bf246a27", "value": "httppd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d77a161-2ed6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775163365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163365, "uuid": "d934e451-b371-499b-9821-6a5f58ebb826", "comment": "Malware payload", "value": "645a083662f867128c8a52e3dfe3bca9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163365, "uuid": "c79177aa-d1c8-4f08-99dd-7debc3743078", "comment": "Malware payload", "value": "3c4485a4eb1a0655a521bb3274e8c81c0358a33a0348f1e8292a6f94df36c3b1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163365, "uuid": "2980172b-b569-49c0-8539-e3a0a385755b", "comment": "Malware payload", "value": "3522697c5d2a0393b261ee9b9453986e18e1a72e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163365, "uuid": "55dee06a-735e-488a-9b1b-2a2837201327", "comment": "Malware payload", "value": "ab83a650cadc6a5c2058485084ec2cd64171a5db5477893e0ccadde2929cc79d04995bf8e71d6aa27fd77fa6e06ef9e1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163365, "uuid": "a90aaa79-a8e5-4f94-bfe1-69bf26c85a25", "value": "T1B916F90AA9179375E12E83FD490A8366D5903C3F9338DEBF13DED8250A5D07823AB567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163365, "uuid": "4c1fdae4-42e8-41cc-ad67-aecf7535ced2", "value": "c4c5b7eeb6a65687446c62dc250c5433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163365, "uuid": "0f3197dc-f9dd-40dd-93ba-6efc9a60f19b", "value": "49152:2TbS28a682DsH9/m+ORLl8clnb4Ogpt3UQzSIuV8+HlBWQYPhK2YoH+Sga:2TbCvTxMOMUQzduVBFBodH+Sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775163365, "uuid": "4e7b7803-e884-4ddb-95d5-d0a0cc78a1cc", "value": 4288512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775163365, "uuid": "a5503c13-f579-424d-9f25-f5f781253d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163365, "uuid": "0deca439-5c25-49a7-b1c8-c463aa7ee894", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6725d500-2e55-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1775107976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775107976, "uuid": "3284e2e5-d23e-4b50-9b3c-534122fa0162", "comment": "Malware payload (CryptOne)", "value": "6d6416ce49695bba5ea93e1f4d32ffac", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775107976, "uuid": "17ba46ba-45c9-4670-994d-1d9c78d3b468", "comment": "Malware payload (CryptOne)", "value": "3c59bb045893542c46ab33820401577b30423d26f56f326414e15c54ea38e311", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775107976, "uuid": "0be4b01a-ae26-4f44-8dca-32d66372a32e", "comment": "Malware payload (CryptOne)", "value": "83c417620c1d40ca47b0f469d77721d3e3de7e42", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775107976, "uuid": "f9159a29-36d6-4835-8190-9ac6d655ad0f", "comment": "Malware payload (CryptOne)", "value": "99578f53c8024aba73a668bbb5ef9c797515539d62c293e831149dd2c2da1685ffb0f21e2a763f5d5816098c9ba555b8", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775107976, "uuid": "38deaf81-a678-4054-87bd-3480ba79a85b", "value": "T14FB58D037CE104B5C0AAD736C9B6A2927A31BC484B3533D72F64AA743F763D09A7A745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775107976, "uuid": "0856844d-f545-481a-924f-278b5b299410", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775107976, "uuid": "da7cf3b9-4775-45a8-8c74-d2afbb596744", "value": "49152:XfMxjrLgHIXMbg40Wz178eOFmpgQKnOYpun8ldaF:XSngHIXMt0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775107976, "uuid": "932d4789-0bee-47a4-8e8f-8c248cb186a8", "value": 2311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775107976, "uuid": "3f8ed6a6-04ca-49d6-a4b7-381b8b651e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775107976, "uuid": "d9d6a9db-351b-4162-90a9-500804cf3a5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7a8279-2e8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775131612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131612, "uuid": "d6d36ba7-1744-47a5-9c74-5078557498af", "comment": "Malware payload", "value": "b5ea8c6b6fc0294adfb1084149d98933", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131612, "uuid": "39b5e1f4-2955-49a7-9b11-85a5df856714", "comment": "Malware payload", "value": "3c5ca1d037d3d3ac89fb1415a4b374e4ead9f36c466b7917fa4f009e0a834b5f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131612, "uuid": "7d3cc1e0-c3ae-435a-9ddf-d44a75d1cebf", "comment": "Malware payload", "value": "66a9e431a2a6b388800b946d2677686241f84132", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131612, "uuid": "5cebf8fa-e697-495f-93d4-cc72d5c427b0", "comment": "Malware payload", "value": "56782b1c8e118860a156b2f5e588c4890d73d797474e091d68df701d9d7474519fbb2a3a39bdbaefecca31e04ccf39ed", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131612, "uuid": "c2d4116f-5d18-4f82-8c2c-fe44729b305d", "value": "T1E1E1C05033BE9200F2B6C675CD75B764CF4AFD009A7696C80AB2225C9C31B649D21B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131612, "uuid": "0a4fb9ad-fd41-4e06-a0b3-eca35c1ccc61", "value": "24:9kZKk/9nlzgm+G0/gTlF0gJFof1GRziuEbnWwmLey6:9CKEhlMVTYrHFof1vuEawmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775131612, "uuid": "26363022-312d-4c6d-a769-afd85568d20e", "value": 7210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775131612, "uuid": "cc090c97-8bcf-4a65-8162-75548dcab7d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131612, "uuid": "e9f30990-4e00-44db-9998-3fcb5666e1c6", "value": "amz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b10955-2e84-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1775128366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128366, "uuid": "a6f10720-cedf-46c5-ad6a-043a00bab483", "comment": "Malware payload (ScarfaceStealer)", "value": "dca385c6e84481bf682604acc4780745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128366, "uuid": "8702a887-c893-4237-9362-cd366c3259b3", "comment": "Malware payload (ScarfaceStealer)", "value": "3cb55b5a027163e2a3ed05770386a1bd80577f37a4085f30ae46a23fde8bb737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128366, "uuid": "01d43ce4-a889-4177-9182-94e09226de8f", "comment": "Malware payload (ScarfaceStealer)", "value": "d1de926b97a571f249872ab790a695d56f728a0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128366, "uuid": "7446f57e-201b-41dd-8963-e182ff7c1498", "comment": "Malware payload (ScarfaceStealer)", "value": "662f0d8d60298448b31d43fa75159dc0ba00fd1963ca609991ed159cb9654a4f9aea02d060feed7444ce014b1fd98925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128366, "uuid": "b0383e69-74df-4506-be0a-8b964d4d8916", "value": "T114187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128366, "uuid": "c7a3a0cc-1e54-479a-a57d-017b83a01a51", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128366, "uuid": "e6317cb6-c1f0-4554-a097-a002114d28c8", "value": "786432:FAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:FAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775128366, "uuid": "6383f241-00b7-416e-86a4-a80af2aaa17d", "value": 90247168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775128366, "uuid": "1b1e3b8a-9bb0-4cad-8a6e-9f4f4a43f6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128366, "uuid": "17a8b6f1-4862-4d6f-a3e3-0db27243a6d6", "value": "Loader 7.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aff7ad6-2e5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775112170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112170, "uuid": "c1b7cb60-7787-4e59-bb67-7c5f28efb0c9", "comment": "Malware payload (Mirai)", "value": "61c46b430e097c13bba95d2f16ae2544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112170, "uuid": "43c74d28-3dfb-439f-97f1-df1d119b3b5e", "comment": "Malware payload (Mirai)", "value": "3d83173d1a4cd927066a324926b4f5001f2e98825c480de180b6f9eb492cacfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112170, "uuid": "84750606-49f0-486a-96d3-17cb3d2f4676", "comment": "Malware payload (Mirai)", "value": "52684d092c36ed02f5fe4a1405d2195f04eb2d7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112170, "uuid": "65df7550-b0dc-4d1f-9ec1-ef8b5f01d281", "comment": "Malware payload (Mirai)", "value": "cc3efba7ae5d0d5ed00876d9b13f641450a35ba10ec30a94d1b22ac0e4f2d984f4ae68863738c65697b51878f3061ba2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112170, "uuid": "bb317892-fa12-46ff-bf03-3e8c697dad6a", "value": "T1D3041946F8819B15D5D112BAFF1E528E33131B7CE3DE72029D246F247BCA86B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112170, "uuid": "2dd7d081-f394-43f1-a012-409b37f73d37", "value": "3072:ACbd1A3Tcm6Vmym3HCbuVF3jXbNfuG0tea+TTc1EVhfMBC6y:Aiecm6V7m3HtV5XbN2PcaSwyfMBCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775112170, "uuid": "baa037e3-162f-40fd-9b65-6389d62a1487", "value": 180956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775112170, "uuid": "cc01a0bf-b49d-47d6-af89-de48a6e49941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112170, "uuid": "1f02674e-9c92-4e38-8fde-2a94a85bbb14", "value": "rebirth.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a01413-2e50-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775105824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775105824, "uuid": "b811216e-5895-47b4-9c21-03c3f2558951", "comment": "Malware payload (Formbook)", "value": "2385f4fb5b1a1ad95ba4a02125c9331c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775105824, "uuid": "cc8770bd-0790-4779-be75-d5e4f9daf020", "comment": "Malware payload (Formbook)", "value": "3dc175bf861340b97aa3de7ba407113cd540fd4b0b4525f5ee1792932f5785f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775105824, "uuid": "6f9e6360-a2b5-4dea-b8fa-7738d44f92d8", "comment": "Malware payload (Formbook)", "value": "8145a68240d5b659a9acd98d497d6e162f30abe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775105824, "uuid": "72c0888c-2a57-4bba-a12c-ab741311498c", "comment": "Malware payload (Formbook)", "value": "f19550508e6d080b611ad9a7681f181fd515d7420936b26b35e7ef99bb000e4164abe3d63fcbf84e315db0c62df17d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775105824, "uuid": "eee50627-085e-4dfd-94f9-b55f420d5292", "value": "T1C845F104636BDD03C4A61B7088F1E27407B4AD99E423C2175FE57EEFBA397922A45393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775105824, "uuid": "3af26398-f609-4f47-91f7-943e9c7df04c", "value": "24576:VHerIyZk/o4nYU80zOISig68KltUKdli0qSJJSHw:2Iyi/lYU8qOIng6nltLdli0qqUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775105824, "uuid": "57cd602f-cc32-4241-b74d-dfdab323c8f1", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775105824, "uuid": "9d58bf0f-d72e-43cb-bcb9-e2fa1ed5fea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775105824, "uuid": "1b38d1f9-4473-40a3-871a-6f63a838565f", "value": "Request for Quotation No.CNT-CON-000-002820 of EPC for Ain Tsila Development Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0d1e24-2eb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775149051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149051, "uuid": "38f97cb3-5358-42cc-be50-06196e08a3bd", "comment": "Malware payload", "value": "468a2d0f1ee17db95145883fb8907104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149051, "uuid": "adbf3178-3f5d-41e1-8472-ab7a5f24b4a8", "comment": "Malware payload", "value": "4054e6f4b770317d3c847281ce6ea8b19c2fe7efeb4cfd26105eb994cbfa9c4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149051, "uuid": "4ee652cb-cc43-4d0d-b1fb-ab887a2e49f5", "comment": "Malware payload", "value": "794d1354c14f6ff8c15be21c486b6c0997f84e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149051, "uuid": "4c754be8-1ed8-47f6-9e07-d448f3810fd0", "comment": "Malware payload", "value": "64084e4197fc7b40dfc62b396337d1a2aaee220c8b2e5d2448b8bc8ccc3110570ded4f693835756729047762ead06505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149051, "uuid": "9cbeab08-d44e-40b2-a288-b5cf90998bef", "value": "T151C63355BBF009F2E8E314BEC084D550D272B8560F10DEDB43581AAD4F1BAA09D7FBA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149051, "uuid": "b9c909fb-c20f-4dc5-9949-42f6f888d840", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149051, "uuid": "ffcf158c-50fa-4b31-b0cf-7c85396d8455", "value": "196608:44i7kO6KAyzw6yewQGnCU0C3Lp0g7eNRGt+wfm/pf+xfdkRPGlzRxKfrqWOHWPD2:Ti7kJyzHCTdMRGt+9/pWFGRPA0frqW6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775149051, "uuid": "45073e05-dc14-43f8-9e9a-dfccc6a7b51e", "value": 11812061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775149051, "uuid": "755b43b5-40e9-49e8-8880-7954ba6435e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149051, "uuid": "6c6a7545-6ddc-4f9e-b73c-502aac81546f", "value": "Exela.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0d802a-2e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125429, "uuid": "97910d78-6432-4c6b-a880-e5b84b6f785a", "comment": "Malware payload (Mirai)", "value": "dbf42c622efe2117104f21fc88131687", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125429, "uuid": "f735b8f3-c5db-451c-9487-773cd42576bd", "comment": "Malware payload (Mirai)", "value": "4207fdf47060617945453e6e5a38c91a5c7740b07dfe30725f84b30369a7fb0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125429, "uuid": "9168bb28-8e8a-43b2-a299-76bfe8642b74", "comment": "Malware payload (Mirai)", "value": "efde74a16d0f9d5acd173f2d8062299eacfe88bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125429, "uuid": "90bcae4a-e3f8-478b-86fd-0979e8a921e0", "comment": "Malware payload (Mirai)", "value": "361b0225481c5654600a2f3bb9c6965a3a28731ae290f555bb7a9880e65a6113f06d915c85977c537a3ce73778ceed2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125429, "uuid": "2151c89a-2616-45c6-8c0a-147c19151133", "value": "T1BD634DC6F415DE7EF859EB7B4C524E08A272F36146830F265B9BFE57AD31148281BC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125429, "uuid": "08ea1899-7c4c-48ca-99e5-bf6c39b4f09b", "value": "1536:BiI14qrzenBRB2niaIQeuacWjcW0JcWcBLIXE7ZxpJ/80j3:BfrzenBR8IQeuacWjcW0JcWcBkXE7LDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125429, "uuid": "e9e1b755-14de-427b-869b-1dffef36a185", "value": 72112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125429, "uuid": "27b8304e-9e20-4b16-87df-bb5dbe3ca04a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125429, "uuid": "6b05ab88-d914-4093-9a24-1a631fb70ff2", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e0c7b0-2e8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775132715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132715, "uuid": "db14841c-85f7-42e8-bb04-dc7122cce651", "comment": "Malware payload", "value": "1fd9798cde004550e5de29038f8663cf", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132715, "uuid": "de60a3e1-247e-4ee2-8f0e-d9710e81b6d2", "comment": "Malware payload", "value": "42533fbb40fe274c96a31c948ae6e84b6c103f9da6f27c9d1dc5c011f7b719d0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132715, "uuid": "be337e87-6589-4155-ba8f-7767077d111b", "comment": "Malware payload", "value": "9b5d63a248a2c4fc1c29cc1d9c291b37a609577d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132715, "uuid": "1a1b04ed-06eb-4501-ba01-c3f8a01fbd5e", "comment": "Malware payload", "value": "14efbe6e1c43e8f115f2861b91f88049dd8b83ea0dcdf09d60625f66461d8996afe75a7eed3c8cb1b1d88ecfd01a5c36", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132715, "uuid": "f796ee20-735d-4653-8a99-a8f054071d42", "value": "T195312ED4B4029709C70222BE48F98565C8FADB51030EDFC6B2E012E385747288F5B6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132715, "uuid": "97d4926c-1465-47f6-84b0-33697bb7b4e2", "value": "48:8HlTBeEmp0fh30Aix9BVEjzdvI5Za4tBRoKpGMK:8De5CfB0bfV+dvCZa0Fwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775132715, "uuid": "161d104e-4a36-4929-a4f4-05e44b621aa0", "value": 1664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775132715, "uuid": "7e676b7b-6d5e-4c27-b96a-c61cfcee2244", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132715, "uuid": "598acf5e-9bad-4517-b916-007763aabfde", "value": "Q.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72f4bf5-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153690, "uuid": "c478eeff-d31b-47d4-9357-67cfcdb6abd1", "comment": "Malware payload", "value": "6a73dc3e075d1dd557b93170fca0baec", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153690, "uuid": "2339be40-d907-49d1-a2c5-57bd6283c957", "comment": "Malware payload", "value": "42640106825fa9c712f27e3720839a8319e3f965659bc988ec241f4bf19ca55f", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153690, "uuid": "03729264-25e6-41ea-8709-ea71783597f2", "comment": "Malware payload", "value": "a4f72e53619494cd14a59feb6dae0cfa7e7d21e8", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153690, "uuid": "1fee16e0-832e-4c49-a2c5-47adc0dd9f0d", "comment": "Malware payload", "value": "3967f5a1670817d14927791c716ae75de3caf12deb1f24e7cf15bc5afd1e32cac4b7a18682cb059017b574630af8a644", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153690, "uuid": "eb8776e5-a1ab-45e8-a5e2-c149def246ae", "value": "T18043F1ADFD1DE899ED0B317A0887602FAF38559E9340BE77C7B58B449076B1C6483A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153690, "uuid": "873d1780-2923-410e-91b4-118ca05c7adf", "value": "768:deV2PgA79WlMQy4gw5JHPjUu6HRCSdA++iepLQ6gHDmGgpCgLNK6CF+bFXUYXNsu:dMspWlRHgw/HPjUucZgpyHxgpT5CF+v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153690, "uuid": "d9d0208d-5ac9-48c2-a46f-3e8949882730", "value": 55203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153690, "uuid": "eb26f630-0a0c-4e3e-8e13-81a825555abf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153690, "uuid": "1e2e7fe2-5780-484a-9bd5-61b02399a541", "value": "42640106825fa9c712f27e3720839a8319e3f965659bc988ec241f4bf19ca55f.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98559c28-2ede-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775166899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166899, "uuid": "0f3488aa-cd44-4692-9980-0d671ef40943", "comment": "Malware payload (RustyStealer)", "value": "ef54cef50100a1a2a45da8dddcfdb729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166899, "uuid": "d40cb655-224f-4d72-bfb9-2a8a7cec0bf0", "comment": "Malware payload (RustyStealer)", "value": "42caae0666649bd94561b64d976c762bf990ca592f66eb13a68ca9ab3f3b825e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166899, "uuid": "b82371f1-a43d-4377-ba68-1936f557d475", "comment": "Malware payload (RustyStealer)", "value": "9406a4bb458282fdb547e2277f283766ced38bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166899, "uuid": "0c1a0524-204d-4919-bd5b-a57b78779f6c", "comment": "Malware payload (RustyStealer)", "value": "a8e4196ceb498a029eba6aec9b41b276cd92b20d532ed1afb56bd2b9230142c8c94340d634478093a199cd48c8d56b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166899, "uuid": "f8c59d81-22ca-4b72-b545-a715e68511bc", "value": "T19666BFB831446CFB672F52BBC99A3CDD43762772878A98CD6074B3C21913665FE26C18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166899, "uuid": "561e03c4-0095-4107-b6ff-9a8dc037d8b4", "value": "43bde8802b940524fb43cd661cade5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166899, "uuid": "87f5be24-7e95-49f6-b6a2-d6d2a84a30e4", "value": "24576:/In2qHqH34KSEU3qzPAVA/iUD82JGVQhVdaiLyKZn5+mOc1J+0DH8y+wsq6uA63L:U+Tmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775166899, "uuid": "0d7378d2-fb47-44ca-a166-928ef44d62d5", "value": 6966272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775166899, "uuid": "0c2f8441-aa55-4054-b2f8-98e7d597a135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166899, "uuid": "22a0d1bd-82c1-4f23-a627-dc2f6a581ef9", "value": "FeroxV3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fe3f16-2ecf-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775160528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160528, "uuid": "7d4044cb-0585-45fb-8c1c-b79cb5487ab2", "comment": "Malware payload (Phorpiex)", "value": "2e9a0b2a9672f7513036c9feb8db1691", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160528, "uuid": "29a6848b-7a8a-4738-adf3-013299770941", "comment": "Malware payload (Phorpiex)", "value": "432c47f7cf9e99bd12f0403e6700f561d5070a6fd887faa6bf90957e7b231979", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160528, "uuid": "53f9283b-4326-4281-94f1-a092c3f86409", "comment": "Malware payload (Phorpiex)", "value": "966e0a9c433ae2e66445747fb7e44b060796135d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160528, "uuid": "c67c9be6-bf26-4c47-bbeb-015516a9ae6a", "comment": "Malware payload (Phorpiex)", "value": "aaf7cee3457df1d0c62d19fd928d60d22cff9ce77fd06b853c4b27f43ccc7e0463433bf5e3dff57f8257d445d4655755", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160528, "uuid": "dae6dcb4-9696-4eaa-b16c-ad61406e655a", "value": "T1CC823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AAD0A686D5FC3314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160528, "uuid": "dd1a914d-97b3-413c-a879-e2c3f54e27d7", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160528, "uuid": "996cfdb3-f60d-4e6b-a0af-8f2d82a0b8e5", "value": "384:LI78VGI2VxOwflsx0pu9NHRgqav8U9cG:UHdsx089na0Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775160528, "uuid": "c44af6ab-b217-46eb-b172-63e83d1e1df2", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775160528, "uuid": "6a3f53c8-4b6d-424f-9694-c13d3632d9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160528, "uuid": "eef9089e-ced4-4656-ab5e-e4702ab83d05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca91157-2eb1-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1775147552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147552, "uuid": "3826ff97-dd88-4bb2-ba79-66ab5c77686c", "comment": "Malware payload (Grandoreiro)", "value": "368cfa7527a5aca27dd74b4077d66a60", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147552, "uuid": "dd48b117-f2e5-4337-998a-3d5aa6677308", "comment": "Malware payload (Grandoreiro)", "value": "43c3894d7d44499a767bb843f6f16a1946071a0543ff0d121f6cf3aa4f88ef65", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147552, "uuid": "299faf56-c2fa-47e4-aea1-dab4303bfc41", "comment": "Malware payload (Grandoreiro)", "value": "a570171ee6e90a3a6d1ba43bcabe98814ef1dac5", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147552, "uuid": "cf84e063-8a94-4f2a-8475-ec89ef250212", "comment": "Malware payload (Grandoreiro)", "value": "7d276de5ad81fe54d095aa966fd1a519f7f343f3bdfb0af906f8bb85a7b076759687ddc48e985dd4e339eefa0e321363", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147552, "uuid": "9a7c9863-3d8f-4725-83cb-4710009fdcf2", "value": "T17E277C53B285A13AC19B0A395937D764993FBE612E228C4727F83E4D5F359803E3B607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147552, "uuid": "70089931-06ea-4d2f-beac-7c4f611e0030", "value": "393216:tfVULwG/JTeZsSll08FTZiy2tBxzj+ZU:YxTTLxzj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775147552, "uuid": "bec9c586-3d16-487a-ba17-b73d1f608d30", "value": 20956672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775147552, "uuid": "b5a5bc1d-3918-49bf-b006-7bb757dbc99f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147552, "uuid": "0d6fbd50-976a-48c1-8703-6170ebbe493c", "value": "4f2e14.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccda5cda-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125326, "uuid": "7f5fb5ae-b654-401c-b535-79edd6f7b04d", "comment": "Malware payload (Mirai)", "value": "d11c8a0c076401d9b255671eb31d0003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125326, "uuid": "47973949-9b48-4065-9bda-0f4e9640c6a1", "comment": "Malware payload (Mirai)", "value": "483ca942ed5a4c55ea812950ef0aa48f9844a303b7b1240fa1468d340c93e768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125326, "uuid": "d058b3c6-a019-49d8-a85e-b02c61602dcc", "comment": "Malware payload (Mirai)", "value": "8f237a87c09e513c4ead969ed138a3fa5d47f4c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125326, "uuid": "46984eb8-8a55-4155-8c11-6e44555123e4", "comment": "Malware payload (Mirai)", "value": "343636ef1317cbe6d0b8dde71e20c30bc0674ebf1deb77fc74c5988cf0ee27163b87a277162b3f07feb9497e9639e2de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125326, "uuid": "04f47e94-e814-4a80-8660-274bf00a3823", "value": "T114635C61A6751F27C0D0E57EA1F74766F2FA070E14A8CA1F3E620D8EAF2456032576BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125326, "uuid": "8a7119df-dda2-474f-8c65-f0c3c2194086", "value": "1536:ImJOCwKOaMZ9jxZzh0mvg+EuvOWqbtYSBr:ImAC4BEDbfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125326, "uuid": "34bd5f3f-60d8-4d78-962e-6ded4248fe07", "value": 71464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125326, "uuid": "53f3df33-10eb-4e2d-87c5-1f0a143c2f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125326, "uuid": "4c9fa2d0-cac3-46a2-bdee-2b5bd03b0216", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26f79d2-2eb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775147267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147267, "uuid": "40a53478-948a-47fb-afa4-b1164ae6801f", "comment": "Malware payload (Mirai)", "value": "8bd22e6c761e25ce61567366fd79789f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147267, "uuid": "cff4db4d-8246-432c-aba0-7ddb71f93eb1", "comment": "Malware payload (Mirai)", "value": "48c9892a21b88e4fa0235ee89452c6060a5209113149e44de9ff4041386ed292", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147267, "uuid": "f5668f19-3ead-45de-a49c-67ac2391a8a0", "comment": "Malware payload (Mirai)", "value": "2471955422531d2998aa94317f81c2c9d13daedd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147267, "uuid": "9a7e276f-0e89-46db-a6dd-87204ab009fb", "comment": "Malware payload (Mirai)", "value": "5e3a8ceff86aa1a8190e73fc6a7e1c381f6dee3c424b83644b3b8a6a66a48b057f98f1cc39536d85289a8e33a42eb73b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147267, "uuid": "a9fe5f93-706a-4d0b-a8aa-1c371cbd914b", "value": "T15CD33905730C0D47E2672EF43B3B27D193EFDA8221A4FA41255FAA8A91B1D33558ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147267, "uuid": "459880b4-3253-44c4-a418-0813310757f7", "value": "1536:fJ1Sz2nNdV56LxZlcqSZAbHm0BBAfhrCY1m46CQJSIHSG6vA/WCsBJvCjWqI3gTi:vVnNdaLx4qKNcob1m42JSUj/Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775147267, "uuid": "7ebb94b9-532e-4cd4-9a63-8d4f2839fc51", "value": 136036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775147267, "uuid": "bde6c927-3842-4dc8-b37b-dc6418c68b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147267, "uuid": "79ea9fc3-cc72-4b89-93d9-57960a708e65", "value": "cronn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea156bdf-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125375, "uuid": "b11d7607-b7d4-4e93-ba66-9a65ba5368b7", "comment": "Malware payload (Mirai)", "value": "bf2ec66c960f14fe2089f35b42bb4854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125375, "uuid": "a4b9488d-1e10-4d6c-baaa-b929ca9053cc", "comment": "Malware payload (Mirai)", "value": "48d2f14841dd0d8ca049ae1739fd06a7af7629569afde82cfaff8ca41a8e22b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125375, "uuid": "6a06280c-7936-453b-abf1-d313d5ecab25", "comment": "Malware payload (Mirai)", "value": "7e61ebad462b973b36b3aee227bb4e09e7302aa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125375, "uuid": "8d312b94-4770-4080-92bd-c66be4757757", "comment": "Malware payload (Mirai)", "value": "cdf760b7e28fee8c5f827c8078be36575ab7376478733fe1646d31058f943909fdadd7f51b7803d5d53ef244be312336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125375, "uuid": "179c2bd4-7119-4c84-aff7-43918ad4e39e", "value": "T16E333BC9AA13D6F0DA160AB0207BFF361677F13B3219DCE7D7A8A963BD42781900519D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125375, "uuid": "1c8706cf-143a-484c-9483-ba599a7fb7fb", "value": "768:kWMYMbrmzvsIr+U+yQcJcxo/yZlGyZiKVhWHpMWU9hvUG:kC0rAUIzwcSUyZlGyTWb4hvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125375, "uuid": "033779f2-2bc8-4a55-8685-8a5f9d31757d", "value": 54736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125375, "uuid": "4d102055-e09f-4f73-b824-c45406a97d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125375, "uuid": "350d9020-5b84-4cf7-b27a-f7472352215a", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022f3278-2ed5-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775162782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775162782, "uuid": "1fc7d0b8-f2ad-47f5-ab7f-aac47d4e797e", "comment": "Malware payload (RustyStealer)", "value": "7930d184de137adf39c538c115e02b77", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775162782, "uuid": "932f9aac-94f7-4158-982b-cea31b8e86cf", "comment": "Malware payload (RustyStealer)", "value": "4920f87d77a06d39793db7f6badae775702facb6bf848ef2f2868a2e022911b3", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775162782, "uuid": "a8c88126-2733-4813-9274-e65d81d44b77", "comment": "Malware payload (RustyStealer)", "value": "bfc564c12ed0079af9336e10ac47fe01be0b20dc", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775162782, "uuid": "5162ae8d-a1ed-4cbe-8e3e-ec97a8765b30", "comment": "Malware payload (RustyStealer)", "value": "ca53820afc6edd4dbfd700e114fadcee231b10ad34e8919858e5ab585a6e876f067c9670e4fd70414112f13bd71bd14f", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775162782, "uuid": "9d25d82f-ec00-42e4-bc44-3e86abeae93c", "value": "T19266B0B435147CF76A2F87BBC6A52DED53762232879F9CC86074B6C10653631FE2A848", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775162782, "uuid": "af85635d-3bc4-4a9f-aa3e-ad37f7bb00ad", "value": "ae3c2ea21d0a1fd83a33d73767c53bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775162782, "uuid": "111b29ec-dca0-495f-b301-929374a4356b", "value": "24576:rJ3s95lNh7G6CJNLjONO+c3V0DHiRV6rBq3ipo2d+YeW1WS4mehdKnDTHzsUwYQI:FOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775162782, "uuid": "79685103-443e-485d-93e4-a82e83365220", "value": 6998016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775162782, "uuid": "da153392-12f4-45e2-a24f-29fb8ba7631c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775162782, "uuid": "bc6c6c87-ab98-445f-847f-560e41f8028b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98702547-2e5b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775110635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110635, "uuid": "72a3f7d6-6709-4a67-9e7b-049c24fa8a51", "comment": "Malware payload (Mirai)", "value": "4412ca9a83ce69bc2544f5e70fe6c92b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110635, "uuid": "883256f9-b8f9-41b2-8e14-b7c8215f3631", "comment": "Malware payload (Mirai)", "value": "49f04a1e271194e9c68ed8251f5235ffc7dda72b902daa9d83a16a03285b9dfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110635, "uuid": "bb27e0ee-8b26-4c4a-8ab5-d988abaeb631", "comment": "Malware payload (Mirai)", "value": "90a6c2c318253ea5c39447b60eb433892a964921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110635, "uuid": "d359edf5-f30e-4d35-903f-7679621b16fa", "comment": "Malware payload (Mirai)", "value": "789b52d108ba9e1d1bbba7e3cce9e1ddc811fcbf3daab6bd8f7d423927f5b3f6cda29ad8a96c0001f39e05f9782929bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110635, "uuid": "7b910d7b-33cf-437a-a4f0-2a1d70cf581f", "value": "T19B042945EA404B13C0D627B9F6DF42453333AB9497EB73069528ABB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110635, "uuid": "686c4853-ab3f-4663-927f-3f7e9afdce5e", "value": "3072:OLe6vhWZQIvuCeeuaMuTuRez43IVIL5ZQy38YhTfYo+M/RgDlplLn:ee6vhtIv1ruaMuTuReErL5738+x+M/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775110635, "uuid": "a7b276ae-b13d-44e6-962f-688678aab873", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775110635, "uuid": "9bde577a-d6e0-4af9-86cf-c221e95012fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110635, "uuid": "9a568ff8-4ea5-4939-8825-a627118c37a6", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30212df-2eb6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775149791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149791, "uuid": "c71e947e-4e19-4d60-b9e7-ad7c6daed9d6", "comment": "Malware payload (Mirai)", "value": "94c415f5a1ca4139f0d01dab87dbb106", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149791, "uuid": "94b3fecb-e245-4799-8299-59f02acdfefa", "comment": "Malware payload (Mirai)", "value": "4a86870712c9738c2782342ca0ec40922d022999f0f3140a8fecf7f001392b78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149791, "uuid": "4a2e5424-4792-4e40-8377-1f9bacc45917", "comment": "Malware payload (Mirai)", "value": "5a02ee2cffa155a397e144e789baabf664c417dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149791, "uuid": "960465e9-6292-4495-8ee6-6608d3062d4d", "comment": "Malware payload (Mirai)", "value": "ce6c21c1386271705bde95296fe6bf7aba56171297cd6736005d05e6b55a69f5a5bb6df1700601926b7303e9957a01e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149791, "uuid": "c936bb3a-8991-4b8d-9ed1-9ffb476fbc05", "value": "T17BD3ACA3B34F2491C42607F41BC7975D2A2324018E6B9AE73C5F367E6A375DB58063E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149791, "uuid": "ae25d4a9-c4aa-4e5a-bda2-1d56893d84a8", "value": "3072:jUh52qLKdvYjzQ/g0ZO0PWXptDP79OglCt0n6hwZ8lVlq:jUj2q4YjB0M0mtr79dCtq6WZebq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775149791, "uuid": "44c50d06-80bb-407d-b519-9adac0ec0710", "value": 132816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775149791, "uuid": "7b553f06-fd82-4f98-9216-4cb1306b3b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149791, "uuid": "ebe942fb-55d9-422e-80a2-931a4f2d795f", "value": "lighttpdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78bf9eb-2eac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775145557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145557, "uuid": "b10d107c-e324-4d53-a9ba-8c0edc8497f3", "comment": "Malware payload (Mirai)", "value": "8a9a58775d237bbaf7053e1acc408171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145557, "uuid": "76401e9d-efad-45dd-86a5-bb15a4ae871b", "comment": "Malware payload (Mirai)", "value": "4a89dceadd396eae52f77e7a0db39248bfc0421c6615f732ace330affc9440da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145557, "uuid": "8a88e994-d668-41f1-9ff6-968cfe7fe3e8", "comment": "Malware payload (Mirai)", "value": "5e4773acf98d1b341da8dddde5fa5f7810a39ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145557, "uuid": "fd2ec3d6-e57d-4a97-b528-6519748cf48a", "comment": "Malware payload (Mirai)", "value": "a35ed5f130ebcb0e44bd7c23a1e0e132a1fd2a6b4f5a82555661d337a20bb28c488ad761b8d050e2c6540e62717e80d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145557, "uuid": "d349cd05-94c7-4aa2-8670-77ad3b0f6d1d", "value": "T1CAE209D6B4A1965FC4C4233ABB1A051D7712A3F4D3DF3B03DE995A82358E62E8A37D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145557, "uuid": "0d43195a-14e5-4468-a7c1-126a54ec6b6c", "value": "768:rmZCyT9psJSeIemBAl+9MlLoL5jEScRJbMDdS1JKmzGn:rYpIzIfSl+9Ml8jjcRZwdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775145557, "uuid": "2ccc6933-edef-4b75-982d-0af3fd583ab9", "value": 31572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775145557, "uuid": "f952bf46-0aaa-44e3-b010-6a13c34790ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145557, "uuid": "1929cda1-b6c8-4bcd-bf36-eb0a9d361b3e", "value": "dbsu-daemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9025c94-2eb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Heodo)", "timestamp": 1775149398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149398, "uuid": "b12581e9-4793-4584-a677-c9d87ae804dd", "comment": "Malware payload (Heodo)", "value": "7316a36c619c7e42918e03aacf74783c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149398, "uuid": "0e5464d2-0dcc-415c-af77-1cc1a9e1447e", "comment": "Malware payload (Heodo)", "value": "4aed0f0c266ad694c47c0661bb5c0a4519d02fdeb9d76abade9145ec6791f77f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149398, "uuid": "b6627f86-0be8-446c-91e9-26d44e24d2bb", "comment": "Malware payload (Heodo)", "value": "4e29920b2d81831f74bf4babe8d08791fdfd13b0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149398, "uuid": "b6fcc02e-cbf3-4e48-832e-185e9f3ccb19", "comment": "Malware payload (Heodo)", "value": "d610cfcdb5e965cfcf01b53d5efcea58eecf167f023eefbf32568b2229a03f20eb41ae0021fc79870716c555e760f326", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149398, "uuid": "51e928e2-12c9-43c4-a607-017b7f291da9", "value": "T111A633602A5504FBFDF761398541D969AAA2B8732339C78F97C84A750F236C26D3CE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149398, "uuid": "0ab004e6-ee43-4ecc-a582-7aa50c3935ff", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149398, "uuid": "620fce51-fbe8-4273-9e5d-a6d712c4a131", "value": "196608:2L6Jx67P7NtiFUN5ihQSi6XERHvUWvonhxjno/w3iFCxHQbRpXjCqfrS45p:26oNtv5ihQz60RHdexro/w3uCxHQbu+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775149398, "uuid": "99971d36-9628-465e-ac32-390036aac2a3", "value": 10207633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775149398, "uuid": "a2c77ac5-f052-4cc8-abc6-c89091b37626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149398, "uuid": "13fa944c-d423-4cd9-8a06-23d34447d2d8", "value": "Infinity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b674208-2edc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775165938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165938, "uuid": "a354ec32-dd09-46b0-a7fe-7c99e5136fe8", "comment": "Malware payload", "value": "f8753e60f6f2eb70088fa7182656d3ac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165938, "uuid": "4e51d96b-0fee-4680-9cfa-6b03ba8b3309", "comment": "Malware payload", "value": "4b025fe6f45e606628df3987e6aefcdc19220c9dd9711be20dbdbfce23c4d742", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165938, "uuid": "9c791364-1c96-4147-a369-d297cdfe49f7", "comment": "Malware payload", "value": "e315798256458400adcae939d48a71ac23cbc286", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165938, "uuid": "81cc028f-47de-4edd-9744-a1fa4baa4669", "comment": "Malware payload", "value": "4e7e8aab41d611ab4d1290c7d9579c7c57ff4a9fa3fcf040d1187bb3de1fb1d8fdbb6b9d3a5b2c4c40cfc280d5bb4ac8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165938, "uuid": "2a3e43db-0e10-4a9f-946e-c706e0f8e16a", "value": "T16533B6A167F9151AF6F38E783CB465958C7BBE726D61E08D8280204F0875B95CE78733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165938, "uuid": "1caf310b-d15a-4d59-a223-7b9750bfda14", "value": "83fa772670ac674cd68ff73f3ef04802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165938, "uuid": "52558f19-2199-48ed-a643-d9a6a75afeff", "value": "768:LezMQ/0vaXDiTLlGCI0App3LdSph6koMsqsq:I4EiTLXA37sp4kofv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775165938, "uuid": "04ecb83c-1818-4273-bb96-4443c8b8bcb9", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775165938, "uuid": "0badfa41-ae40-4167-acc4-97df6affc380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165938, "uuid": "8a2a4a33-1a2f-4149-a087-f570f2b0261e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c04bea-2e4a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775103173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103173, "uuid": "325494ec-32b5-4933-8ba4-5da0adf8aa2b", "comment": "Malware payload (AgentTesla)", "value": "96056c087e105a5a0e549ebcf0903db7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103173, "uuid": "b05bfb14-2888-4dbc-a6aa-15004093bf12", "comment": "Malware payload (AgentTesla)", "value": "4bda75eedbe6b367acf6dfad1046847f5dd74968580a2a76e76f51c48d9a4309", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103173, "uuid": "acc7d0e3-e6ee-45d7-b5aa-5daebd4f416a", "comment": "Malware payload (AgentTesla)", "value": "25135552b97d2ed1682f151517d59892049a9d30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103173, "uuid": "31e42503-8351-4a17-9ec5-474cced95b30", "comment": "Malware payload (AgentTesla)", "value": "c44bc9d5fa6bc4faba9a08cc80da977e17754d01c84c0cbe19c3f88f75f02832b49dfda04673c3411f4a20f875a93de9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103173, "uuid": "9f83fa8b-64f7-4dea-8a35-0adadd430f40", "value": "T1F345CF0273C1D062FFAB92734B56F6115BBC79260123AA2F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103173, "uuid": "c514b655-70f6-408a-8472-8368edd5491f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103173, "uuid": "636ac44c-dba3-4525-a411-51d9354e2959", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXdall+PQ3u08ir6:KPVt/LZeJbInQRallKQ+hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775103173, "uuid": "28ec2875-2711-4b93-ad0c-03c02a9a126b", "value": 1230848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775103173, "uuid": "ae09ec70-c523-4066-87da-8fed362e1554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103173, "uuid": "f6c5af6a-b615-4129-9c28-726d689399f0", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12931fa1-2e59-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1775109552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109552, "uuid": "c24288d2-c825-4b1f-a83a-e0058f70ef3c", "comment": "Malware payload (SyncroRMM)", "value": "6606887b096566e108f35a45828a0284", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109552, "uuid": "8421f95f-f26e-41be-9b17-a8d6034d91b1", "comment": "Malware payload (SyncroRMM)", "value": "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109552, "uuid": "ca230fa8-78b0-4b2c-99a9-073c0004f330", "comment": "Malware payload (SyncroRMM)", "value": "225da89702e5c66adb4ac141eef452a8408fb0b4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109552, "uuid": "72b704f3-120c-4e76-903f-95ded95003d3", "comment": "Malware payload (SyncroRMM)", "value": "f2c1a9c2d18edf176e870f5855fc3ac0d7b2f66fe75895e36361ab35cab0c85d99d4b851e5943f89b7de6b855696a2e9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109552, "uuid": "ea3e12fd-796e-4770-a6e1-e0395eb9c197", "value": "T13D461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109552, "uuid": "89eebbf0-5650-472e-914f-da86f2c597e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109552, "uuid": "7c06b197-e656-4b5d-b684-c7e5d6fb25c7", "value": "98304:hh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:hh/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109552, "uuid": "6cce9a98-9568-4f6e-8fa7-dff9128ce4b7", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109552, "uuid": "0c480cf3-9957-4017-a045-56f95875d8c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109552, "uuid": "d8ce436f-a887-4f64-b1dc-8e23660d9532", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53da127f-2e8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775131136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131136, "uuid": "4d113c24-a961-4e60-9fa9-b0372f4e62ff", "comment": "Malware payload", "value": "8486fb87500f4282a60c278723dc507f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131136, "uuid": "fbcdbfdf-e47e-42c2-b59f-ab2e4beedcc5", "comment": "Malware payload", "value": "4dc4f0f7d86ce580ec9d5afe792681d8c4ce473e96f21cfaa11cec93b1cf2ae6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131136, "uuid": "2f701118-b175-4c09-b8ce-bfdb65c1d0c8", "comment": "Malware payload", "value": "d7107cab8828f07f924369cc2148931bfa53c7af", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131136, "uuid": "a0e0fe90-03f3-45c7-b8b0-0be8395abfe3", "comment": "Malware payload", "value": "934755796c1d123dadf942d9b2ddcd6062c6281e1bcb302d7e3576483353a7832d119c3a62c2888ebf847ab55ad932fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131136, "uuid": "03b7f3f0-70ab-4e53-93cd-0c22f25d16f9", "value": "T105F0DC8CD88D04E296084C5FBBA7A00CDCCAC60E498537E8BC2C641BBB9030CF2CD2D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131136, "uuid": "f03f71aa-d452-4720-b2b6-f40460b68405", "value": "6:hMfG7Lkd+iFnT7vZsdiDvNoDu/IoMhU+D+nwFFHKMhUvnypaWJ7Z4L2NIJy6:uILkdDvZlODuAoM2wFFHKMWykY3NIJy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775131136, "uuid": "b656078d-c604-4fed-a47a-3c0c4d19e4e6", "value": 550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775131136, "uuid": "88319f74-42fc-423e-8949-0649e028945d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131136, "uuid": "115585d1-1718-4fc9-ba76-78472d609284", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9411ed-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125405, "uuid": "939dffb8-2826-4475-a1bc-42120ea10fb0", "comment": "Malware payload (Mirai)", "value": "c558d12d5158779a8abb3a3804409804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125405, "uuid": "5ab44a5c-f67c-4cc3-aa59-358179d7d65f", "comment": "Malware payload (Mirai)", "value": "4f10d73baf67716fabc2fe86b8d603523b70f716fc19d77af3e040870b148072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125405, "uuid": "580af898-6112-46f1-a053-9f065f9e6ba7", "comment": "Malware payload (Mirai)", "value": "f2fa400479da2ef216bd93844293b2c785de63a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125405, "uuid": "c046f437-9d3f-4763-bd91-0641772fef9b", "comment": "Malware payload (Mirai)", "value": "8d2587a888ee25802ae162dc8d87cc7d00d975e425cefad81ac5b48bc0d4d4d609ab97bdb186aa6ae0f95e42c59f61e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125405, "uuid": "19f72e14-39ad-4238-b524-97cf5199648f", "value": "T185836CC6FB43D4F4E8120971217BE7318A73E53D502AEE83C769A872BD12541E75A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125405, "uuid": "f5ec47a2-76c8-4667-965c-ba6d442e70ce", "value": "1536:4NGfle9cPS43Sy6QYXVE143RrFUCeWtsrswWdZ6:4cEWS2Sy6QY6143RhUCeAsz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125405, "uuid": "c506b31a-9433-4017-883f-b3cccbd55288", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125405, "uuid": "3f9e9b92-e9b1-40f9-b5bb-8a0d95dbefcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125405, "uuid": "7943d945-51fe-4c5c-88b5-24cf0bcc1d38", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b9ac51-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153683, "uuid": "df0d7325-2ced-4194-afd2-2cd6d991c060", "comment": "Malware payload", "value": "69cb896353e165c2f99c1e3b7da12937", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153683, "uuid": "a5711c29-0ffc-487a-99ee-dc56a194f59f", "comment": "Malware payload", "value": "4fd6e716ce4b6767ddad2415f77b4f9b6d1546750b0c03280e19756eb1b85e7d", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153683, "uuid": "159438bb-8327-4838-a465-6d176e2bae06", "comment": "Malware payload", "value": "6e925024df7573289a7fc80eacfb50984d1bf6e5", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153683, "uuid": "ca83b25e-04a2-4a61-a122-1b64be0a6295", "comment": "Malware payload", "value": "a469bf30b948dc71e2c66c2a91cac6eb49cfaf912ba052ac5816ac9d299c46fd1b48bf73211c4f0e0c2a8cab9fd7087e", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153683, "uuid": "da5110b2-fffa-4fae-bc4a-b1ee204c3e55", "value": "T1CE34D117FC46C8A5EEE7503019A2406BEE3A02E4D1C4B5521B9BCECB0877C8676D7F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153683, "uuid": "e75310eb-d87e-42e3-b193-f8b3b70ac7e3", "value": "3072:euteRs84b4oz7gt7wtpW6UgwTC4jie0t9vTB2+kILMreVgHZXHiYCelKWLqzlkHs:0RL10Z4Gz7lktXCYXg4Iw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153683, "uuid": "2b320321-450e-4974-ab3a-1c6d4f5d970e", "value": 248111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153683, "uuid": "f4fcbc40-b708-4b8c-a549-e43168468175", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153683, "uuid": "caf40365-2d7f-4bcb-8f42-9aa0e2a588c4", "value": "4fd6e716ce4b6767ddad2415f77b4f9b6d1546750b0c03280e19756eb1b85e7d.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3c1b04-2e91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775133804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133804, "uuid": "bed5abd2-e67b-4a14-a115-7211877879d8", "comment": "Malware payload", "value": "42e8b31abe01a8da3e8e054cdf771098", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "VBS.Agent", "colour": "#B52E52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133804, "uuid": "3db2fb0c-5181-402e-8db4-aa621d4bbaa5", "comment": "Malware payload", "value": "50190feceb5d7db701e0f0b312a2c81b7b2455c06471b16412e1d508867aa562", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "VBS.Agent", "colour": "#B52E52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133804, "uuid": "08d1c2ee-833b-42ed-95ce-a7905ea7101a", "comment": "Malware payload", "value": "134ff4eeca2660662b830c7fee5461562720537d", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "VBS.Agent", "colour": "#B52E52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133804, "uuid": "137262aa-c92c-45d1-8c59-6331e75e9899", "comment": "Malware payload", "value": "f013810ebcdba7184fc476968e6033fb074b5c9e8407911af2bde7bb34a81464591ef3208a21bba7953327b7f0ca38e2", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan-Dropper.Win32.BroExt", "colour": "#390599", "exportable": true, "hide_tag": false }, { "name": "VBS.Agent", "colour": "#B52E52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133804, "uuid": "a0f0940b-44b2-40a6-b419-22ce5f999af7", "value": "T121B48C137D80843ADABA0E36893A97615F3DBD245B30C55BA384751DEEF10C06B76BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133804, "uuid": "85035175-4988-456b-9ce1-d0d6a2931a41", "value": "6144:w/mZE1jOZy2KL4GBiwQtEa4L2s41xRe0VkagiF5p2rrG4:w+8jOZy2KsGU6a4Ks41x5Vk9iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775133804, "uuid": "37b2190c-22aa-4819-8efc-d7d585118add", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775133804, "uuid": "c381e2bd-1ca9-439d-be42-3c7e83b4afcb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133804, "uuid": "1b9b7678-1a16-47b8-87b3-d67b49efda55", "value": "804d7f5b6e.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5842776b-2e4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775103656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103656, "uuid": "dc4cf450-de89-4ce7-afcb-1eec7ea8ac04", "comment": "Malware payload", "value": "c59f783c63027469dadee7b928d771f9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103656, "uuid": "8a28c64f-b598-4d8d-a0bb-4e54c4d496aa", "comment": "Malware payload", "value": "5070a67e1b10b7b538a9a6fca744157691bea8ea6070b81b6741da8e08490ba9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103656, "uuid": "8726c9c7-c011-4ddc-bfcd-fa00fba63133", "comment": "Malware payload", "value": "bd4746b94203ec608fa738469ed418f4360d84d9", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103656, "uuid": "34e5db8e-1932-4dc4-93bc-f18487a4f4d3", "comment": "Malware payload", "value": "c0b22886dcb021ce59f9652c707c1170d97bd8eb8ab28e0259e9e1cca485a8102f6cad4072bedbc1378a782d8031b717", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103656, "uuid": "60d92955-89a5-4683-8aa1-5ecbb63bd6a0", "value": "T1E6C53313C7E9EDFB3350B9A72698C3E42697F1802309BAE71397F9F44C9559DD888248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103656, "uuid": "0066d007-fe05-4b8a-b989-904d2fd9dbd5", "value": "49152:ifzSA0TXnREgLffZKAdGFuE8KihYnBGAbT2Ubjq7LpMEbyE9MTpE:OzeRDbfQQE878RbaUbKbyikE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775103656, "uuid": "5f8ee9e7-f8ca-462b-9da7-7c6a7420d11e", "value": 2587503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775103656, "uuid": "a011ebf7-d0ac-4653-a77c-ca6045c2659d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103656, "uuid": "a5031fa3-817c-4618-b5c6-c90f75af0e38", "value": "RFQ Import 05834 - QUOTATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4b2f52-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153674, "uuid": "f55e2293-5dd0-4524-9865-c80e6c8291c0", "comment": "Malware payload", "value": "12b520a30daf915bd2c9f9507948c103", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153674, "uuid": "8aedff74-cc36-4474-9fd4-5e248af13104", "comment": "Malware payload", "value": "50f8ad0216e3456ea52403844ec2b93edd40b5dc6fda77b129c721d95f5f7090", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153674, "uuid": "e30b7222-92fa-4bdc-9330-a76444ff3aca", "comment": "Malware payload", "value": "6fb058c6b36e1531df34536c0f4ab50e704d9512", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153674, "uuid": "e5e3a832-727d-4e8e-abfd-3f414601385d", "comment": "Malware payload", "value": "e417a1144fe5d7bd17f4dcb0123fd365c6a961707623400d015b463b2399bee2771821774a8bfbf4a8b8d2a3be69f69e", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153674, "uuid": "28e5bb6e-7915-49ba-aa6a-c7b7f3912d75", "value": "T10B34D11AFC42CCA9DFA7593059E2403EEE3A02E5808275521B978EC3487788777D7F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153674, "uuid": "5fb39d4f-07e9-43bf-8c95-5dc26551dd93", "value": "3072:onTivUswkRs8/05Op7w/HI+U0yTICjosq7R5vBmwQiL6N+lkdRKSkHgYIelKWLqC:iTipRL/0MgDC0Z13QlTkAYNg4IwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153674, "uuid": "388e5443-9005-4296-ace3-db4eed5c377b", "value": 248132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153674, "uuid": "10ae6448-2856-4a92-8922-e46bd69986f9", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153674, "uuid": "a9ad62b9-467b-4ad0-b09f-a44fddc8a26c", "value": "50f8ad0216e3456ea52403844ec2b93edd40b5dc6fda77b129c721d95f5f7090.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88481e4-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125292, "uuid": "43f16eff-6c35-4cfd-8faf-e463d2947d9c", "comment": "Malware payload (Mirai)", "value": "0991addb083ce49d069212befdb2cffd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125292, "uuid": "e468ee06-81c4-44d3-a670-cf98aee21f8c", "comment": "Malware payload (Mirai)", "value": "5186c9f224236fcd06a7e44e54836cdc3766e0c943b6c280fb5f57fdca1a5ac7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125292, "uuid": "83118ed4-6351-4a48-826f-c66cd38dce1e", "comment": "Malware payload (Mirai)", "value": "707aae86ead067de299b6aa2d84a575bf2dedbe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125292, "uuid": "5de35396-fa88-4c1e-9998-8cf986f4013c", "comment": "Malware payload (Mirai)", "value": "63b984ca35a84f4fbe2e257930af5f0698888cfd5747925fb80367a6afc3d539eb35cbe1c4657c4913f6e2f2ce91c01a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125292, "uuid": "e1e51add-d6a0-4485-9f34-df0921f58315", "value": "T10863F985BC818A11C9D813BAF92E118E33136778E2DF7222DD116F1077CA96B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125292, "uuid": "0620dc4d-e61d-4c3d-a5bb-40cc135982f1", "value": "1536:Z/nv/KM+DUhuioTmDSbgqWeILZc30zmI2YixQX+Ks:Z/KM3Mi0mDGgKI+QX+Ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125292, "uuid": "54c3c82c-56ee-4a7d-9257-a42819390da7", "value": 67228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125292, "uuid": "1bd7a499-295e-412d-a381-f2911e3ed9d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125292, "uuid": "e516e1b2-2d8c-4776-ab36-02d2b2328f7e", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e18102-2e81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775127051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127051, "uuid": "86cf515f-ef6e-4c7e-b20e-2b6f019aa4aa", "comment": "Malware payload", "value": "6bf741b0644d58037811078b63cac6e0", "object_relation": "md5", "Tag": [ { "name": "aetherixcore-cc", "colour": "#77B48D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127051, "uuid": "966e0291-21e6-4e34-bdce-77a6bb949f56", "comment": "Malware payload", "value": "52d09137de267243774fec5ae08b065471e2cf4e0c2e3c6de5cec222abd84314", "object_relation": "sha256", "Tag": [ { "name": "aetherixcore-cc", "colour": "#77B48D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127051, "uuid": "32153098-666d-43f0-a29b-bdcc71c1b6bc", "comment": "Malware payload", "value": "26a12d7d6aec7f072a02dc7ff7e78e5f266151ac", "object_relation": "sha1", "Tag": [ { "name": "aetherixcore-cc", "colour": "#77B48D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127051, "uuid": "d5f5c6c3-e8b2-4063-b29e-6d5a6abae24b", "comment": "Malware payload", "value": "c2eb63b08fa17abcc4f1dabe63030c254087fa7f55dbaea825cc271797443b1c8573d7ab0e4b199baa7eb5ed95453645", "object_relation": "sha3-384", "Tag": [ { "name": "aetherixcore-cc", "colour": "#77B48D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127051, "uuid": "45b0c21a-a72b-4166-9c0b-24b4ae93af11", "value": "T1D6D623F888D162E4D4D34A00728B839DB1C1256D45FE5C1A3AE63D422B12DAF674EDFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127051, "uuid": "8bc77c22-c49c-4498-ad72-5376b3242223", "value": "7e00cd48351eea3573de62bcc67345be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127051, "uuid": "7497cef8-1082-40d1-a034-e9e4df7e5bba", "value": "196608:dVyrtO7bqFB3lZDjnFfUj6uFyS4KG22spaFvsAkiEwubo8TCRtJv15uUKLsWTfON:vv7ej5UO1S4KGbXDkLwaXQtr2T2CBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127051, "uuid": "61dab8bb-4688-4b83-a6d4-74b8745713bb", "value": 13004736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127051, "uuid": "16a0b130-62c7-46dc-9719-ee12b8fccb91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127051, "uuid": "96c28b5d-d482-45ff-8185-3acc41c0e3e3", "value": "AetherixCore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f252b1e9-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775125389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125389, "uuid": "c4a51d3b-079d-41f5-bb37-1bc0309a5f0a", "comment": "Malware payload", "value": "c7dbec092c4e38da27c051337d915caa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125389, "uuid": "4c2c1955-7a17-46aa-b280-419324d53dcf", "comment": "Malware payload", "value": "54259a989665b0c068340caa523157c730d421f0e5e40f05e87168ce55fd3b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125389, "uuid": "d9b52ec3-d3e3-4c01-948b-2b86e6185e3b", "comment": "Malware payload", "value": "dbf8be2840723fc903ac8f909e56f6874a3675a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125389, "uuid": "3bafe561-8e49-4591-b632-6c068fffa4f2", "comment": "Malware payload", "value": "fa66af8cc9d49ca784edb6e5f51ee76a81f8000148179a1c90bcb287afdb4dd5a3cc0d0fcebe65d73867af032634df92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125389, "uuid": "40731e01-e71a-4bc8-8e27-768493b10835", "value": "T1D4145C0673A500BAEC678239C9634A45FA7378114761ABDF43A44376EF2F3E0563EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125389, "uuid": "f17d441a-866c-4dac-8cd1-76ce3aeb6e63", "value": "6f79c6e52a1dbddd4621cb9defb4517a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125389, "uuid": "d4bf278d-0f46-4a9f-ac79-af9b6291f91e", "value": "3072:2c684gOVDLrYwedFnLO9skATwdQg1OMVk3vDdB5VNKUf2X5RkFx9fhNEaGI:qPDLrYweLO9sJT43cvDNKU0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125389, "uuid": "f8822cb4-2694-4988-8836-49947f9f4b16", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125389, "uuid": "52d30a1e-9b44-4093-9fb8-1db11711b7c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125389, "uuid": "98c40147-5a62-4ab0-a875-0e0eb2d24baf", "value": "SecuriteInfo.com.Win64.MalwareX-gen.23896969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a8e4f1-2e83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775127710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127710, "uuid": "43275e88-e2a0-45e7-8db2-a2388f9c3db0", "comment": "Malware payload", "value": "f6a74036fd2326337f18c424c57c49fb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127710, "uuid": "f3b62c54-98ee-400e-9352-cf61c6772e35", "comment": "Malware payload", "value": "542feb5ab4ad77196b837adf10e237947ca01c4a69eac7613f8ebafba2d45908", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127710, "uuid": "3c11ee6d-a9f3-48a8-aa5b-c1d1e51cdbfc", "comment": "Malware payload", "value": "b7c915132e72cba30a0cd6a11a5d3948ddec2355", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127710, "uuid": "6e548bf1-3055-4933-b8d8-a0f90566599f", "comment": "Malware payload", "value": "99eeb56f2021c0fad3c68ff96fe40c7128d67eeaad3bd917d527e8dfd6564d0b4c79308660497331ef2c1942af2810b6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127710, "uuid": "e363bec8-b055-4b89-ac11-f09e46206c80", "value": "T138A17D1E5F23EEA42814828157BA291CFB8813579E805850BA7834D917613719ABF3DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127710, "uuid": "92c6eab1-87fa-496a-8ffe-44be9a334d33", "value": "96:k1lxKOZHy/t2OaJnzOOsXpQZm5ZwdMoIvR5VDVa3gz13liqvgu:SlxfS/8JRJsZQEQMoI53mgzziygu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127710, "uuid": "be619ea7-5c62-407d-b422-48b755befa16", "value": 5027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127710, "uuid": "0fee6195-06d6-4642-9d88-ec02c87481ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127710, "uuid": "e155c89e-7c36-4109-99e4-38f019a373fa", "value": "portable_reader_acrbat_v23_01_p2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3547aa-2edb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775165560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165560, "uuid": "0ec60dd8-cbf7-4204-a3bb-f0a107f6523c", "comment": "Malware payload", "value": "c6fe518758f3cf90ee3d29481df7866c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165560, "uuid": "11dc0ae1-aa84-4cc0-aea3-2bab6ed93d75", "comment": "Malware payload", "value": "54a2d3b7976f1a6436075f55320fff3ab30f459c48130e1e86c05ca07687b93f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165560, "uuid": "4986d5d0-4adf-40ea-ab18-8bbb0cb3d52b", "comment": "Malware payload", "value": "086ebcff21262e0ebc65f95b9d5057612ed7fe7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165560, "uuid": "2b9963cf-3882-49db-bda1-86b648689eec", "comment": "Malware payload", "value": "76b86a2f7d6d18edcd2d3b53c50a1b3cbd14046ed997fdde220058a2dd8660fd3bc176cd07ea6ec94dd3bf1e29807fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165560, "uuid": "2a09803d-e8f2-4279-a277-11c02416091f", "value": "T199D623EE44D261B490E3070022CB939E75C1B68C51FC1D2A3CD77D026B69DFE668E9B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165560, "uuid": "f4bb883c-4c8f-4b45-a21a-38da48e34bf2", "value": "938df0f46012988bd4efe5253a339ea1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165560, "uuid": "d1d2d931-d42c-4dc5-a6d9-3517fea3d684", "value": "196608:u51h4ropz6fZi4YhLk+nNicE+/5skrC+MBgkaAxEzCvPztdPzrV+ztTWp5Z9T2B9:gpzOuk+M3Q5skrChgvAezCvJ9zeZWjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775165560, "uuid": "0897180b-a849-4260-ab9a-68d45d28deef", "value": 12756896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775165560, "uuid": "6bece07a-31a3-44b4-be65-d7550bda5938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165560, "uuid": "ce3e2f03-546e-4f5f-bea6-24c28fb18960", "value": "RivalMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1ab3de-2ecc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775159203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159203, "uuid": "b0a62fb6-3400-4b59-af09-aea103fd270d", "comment": "Malware payload", "value": "ca4069130468d93ac7c719bf89f792c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159203, "uuid": "bc9cef39-47a3-46e2-915a-3d90ff5fd96f", "comment": "Malware payload", "value": "54d788b1af6ba0343256e528aadfaae30e2ad214e7a6915dc08f0dddc23b2f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159203, "uuid": "7f205c46-6cb3-49eb-aeb6-1f39aae2e848", "comment": "Malware payload", "value": "7f6ae8f83b6d4cf9d1494221c14437942b9e9152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159203, "uuid": "331b8f37-8765-4363-b447-c511d7d549f4", "comment": "Malware payload", "value": "6be691d4a4c36dcce3196f81729851be725513e935cfd1f8cb96bf977e2ff6bec04bf11421ac80722a5f955648df18bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159203, "uuid": "7af8b480-842f-44d8-b725-156e88e6e2f8", "value": "T1B4163336F13A7838D0E31ABE6D5219203CA7BDA68644DB0F2F1530A657F1397B5097AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159203, "uuid": "c457b677-4208-4fd6-b4ad-8cdbcc7eb8f4", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159203, "uuid": "b3856c50-ea64-4c3b-87c5-377f02d50960", "value": "98304:qGRoaRfCxu9X/K4JIPXZMUiaBEp0eDYmqFxYrP3bwKaDZnq5hTah:qhaR9PKB/di8w0ipmYrfKDsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775159203, "uuid": "6867618b-4c2c-4b7c-82ef-8c3123b2178b", "value": 4386187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775159203, "uuid": "a4bb33b7-80bb-43fc-b7ab-d799ced2c742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159203, "uuid": "c3c79ea1-4341-48b7-afdc-a22a535a2fdf", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c453b1d-2e59-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775109756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109756, "uuid": "c704764b-0237-40c5-972b-d97f822e1d9e", "comment": "Malware payload (PhantomStealer)", "value": "61bfe5980c520bb1ba638b190d41d6d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109756, "uuid": "c2b6f5b4-b0e5-4dca-805e-60823c658821", "comment": "Malware payload (PhantomStealer)", "value": "55344b5a814d9a4b560d7f1062c27f758349da39719f2a67a02a5587d9be6948", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109756, "uuid": "2f9d4964-133b-46ce-abd5-81cdcd10f67e", "comment": "Malware payload (PhantomStealer)", "value": "0bae6d266cb7bc1510091fdcd908e21a5c4e1643", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109756, "uuid": "35927a3e-65db-4047-9bef-5de48b322f18", "comment": "Malware payload (PhantomStealer)", "value": "0cce4915b7be45040dcf759635b9f1956a3ccee4b773087aa430a716e29844f36161601e3211bf9ffa85e990100fd24d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109756, "uuid": "b0127238-fde8-4657-ba5e-68868f2d2721", "value": "T144857C3A65D315D8C706E153EA48367DFE90E9EF33907E9AE60611C7DF621836208D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109756, "uuid": "dba73228-51de-4670-af54-f778419d960e", "value": "192:Uw+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+w+l:1RT2EwSVVd/HVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109756, "uuid": "e6944f38-9d72-47cf-88f9-aecdac2614c0", "value": 1710745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109756, "uuid": "7eaa4517-83a9-466c-84f4-c05a18fa0156", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109756, "uuid": "5c8ef77e-bb0a-4af1-b55b-c5a8b750495d", "value": "shipping Doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3d48a0-2e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1775091662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775091662, "uuid": "2b5d42c4-b49c-4d85-8fbb-2229014d6841", "comment": "Malware payload (HijackLoader)", "value": "f0870f6a024f1ed62c50dca73e2dba7e", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775091662, "uuid": "bf71ca5b-b8eb-43a6-b7a2-f9496e0c17e2", "comment": "Malware payload (HijackLoader)", "value": "55684278ed162f10379c34fada191127a6378b3280ca334dc29e87ca8a119130", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775091662, "uuid": "b1abe3f3-7756-4b28-83f5-935e2e321fd3", "comment": "Malware payload (HijackLoader)", "value": "34f1eb37dfc8b91affa8266e329bbe6cef44a03a", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775091662, "uuid": "fb360576-0ab9-4e7c-9c52-e0db7572f0e3", "comment": "Malware payload (HijackLoader)", "value": "fceb8a6311ffb77c3804606a2fe35c0c20747f4e1b805c6d82176492f5f3865003fcb34eb4373aaa659e112c1117c446", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775091662, "uuid": "f737015e-7595-45af-bce4-09dffbd02ddf", "value": "T1E0363341E3D799B7EA51323A061158101E237E3C16F6948F3C7AC68D9CB8996CD37BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775091662, "uuid": "28be78fd-3776-4246-9ad8-4ba9113f7754", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775091662, "uuid": "1d86890b-8910-494d-a2cc-0c180fdb76ed", "value": "98304:HLwONqMDV2A/o7M0AcxiE+5JsRv+45rEFYMbXE7Ryw4d:HUEF/sBBAJsFMFbXE7Ryjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775091662, "uuid": "b33dff12-bb1c-403f-b3c3-df7cef1ea322", "value": 4931643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775091662, "uuid": "5acda427-3ff4-467d-9b57-4e3a2996cbb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775091662, "uuid": "6a37c1df-31d0-4fdd-8259-981c2c45cb54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4c265f-2ecb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775158824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158824, "uuid": "d905ac65-db1a-4d40-8aa0-3a7e7779b8a5", "comment": "Malware payload (AsyncRAT)", "value": "ef9d4c47772f9b6d7fac16efa3f0ea4f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158824, "uuid": "bc6c35fb-fb77-4e8a-a5dc-429f659d1fb5", "comment": "Malware payload (AsyncRAT)", "value": "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158824, "uuid": "05eb074d-79e2-402a-b144-6d36822b3974", "comment": "Malware payload (AsyncRAT)", "value": "60b6eab8f1f84234fd94e1839a09ad21136b8ab0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158824, "uuid": "d72a7aa5-e33b-4754-aa63-4d78fd8383dc", "comment": "Malware payload (AsyncRAT)", "value": "1b341439ba68d4dd143a362d7d69b98a0b3d9a144061d2fa1835ab94ebf06a090bfcec1353803608c1fd1b1eec8b1f7d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158824, "uuid": "f36f1d12-ad30-4f8a-b301-a03b86ca9751", "value": "T1CE234B0037E9812BF2BE4F7499F22145867EF2633603D64E2DC442D75663FC69642AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158824, "uuid": "4f12adf6-27ca-4edc-b421-cda03fb5ac09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158824, "uuid": "fae13086-6538-4edf-9d83-9717659147e3", "value": "768:ruuwvNT8E2mLWU3FvZmo2q7B1hyJ7WGdQpPI6w5jTZP0bjzjFYoKKv0XnIERhPS1:ruuwvNT8xk2kO4uQG6w5HubjzZYoh0X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775158824, "uuid": "4dd2881f-0bdb-48c4-b29e-ca1e8c8f646b", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775158824, "uuid": "bd70d8e0-6f71-4271-8168-783f28486f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158824, "uuid": "4c02c55e-69d6-4315-a493-b565720bc75e", "value": "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81695938-2e83-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775127777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127777, "uuid": "17ed7e81-1deb-4550-8e3f-06b57429e265", "comment": "Malware payload (LummaStealer)", "value": "f4900952521e549123b0df2d4df1c194", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127777, "uuid": "a178a030-d307-4bae-ac48-988feac94b1c", "comment": "Malware payload (LummaStealer)", "value": "574d5ae7f5c7fd8ffa275e755f285f3a92f2a232a015113eef0329e64e72609e", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127777, "uuid": "4eaa9556-e0b3-4225-b43d-9bf9c79c3742", "comment": "Malware payload (LummaStealer)", "value": "e9e0106214495f6aaf4c4ac6ea89d672211235c3", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127777, "uuid": "5c82a8a6-e484-44b1-a388-26e189b988db", "comment": "Malware payload (LummaStealer)", "value": "ebef44a171872a95707baac65ef779dde9a40846253616278197a5dff2ef10a18c4d974fd07fcbe79a7ddc9178d3c1e4", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127777, "uuid": "4cfb6695-7fc7-4240-bc62-20ce6968a3ea", "value": "T184956D46FC9F16BDE412163255BB12BB23359D0B0F329683FAC4BA3DB9761D409263D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127777, "uuid": "02553ff3-8853-4cb5-9baa-e8b37b6ac230", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127777, "uuid": "5867b979-e95b-4c4d-9848-f3b5de81a8c7", "value": "24576:m3AGf3IvjTQvLAiNvgeE2rDqMabDQUGWAZvZoX9O1AOV7gQnR06a9YPb+G2Z/V99:mdAfitftGbktjnRWG2Z/VxwX2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127777, "uuid": "517517b6-6dae-4aae-a460-2dbf68aab712", "value": 1942688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127777, "uuid": "b80aa30d-e8b3-4ce3-9dd3-7c6173e7c2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127777, "uuid": "3ac9724c-e30b-46e0-8508-db59646618f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d072b61d-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125332, "uuid": "fb272cc6-62f3-4ba7-ab64-d52dcabfdf4d", "comment": "Malware payload (Mirai)", "value": "8a099fbeb4eaf46336123841999b47f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125332, "uuid": "3ee5c96e-c90e-46ec-bbab-7f72eca8a3c7", "comment": "Malware payload (Mirai)", "value": "58f1158fc19f60eb48009af7a9398042ad8a61f091a84fea72ffa0ed28e5968d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125332, "uuid": "76998f24-9d07-4606-aa3e-3cb7e38e3580", "comment": "Malware payload (Mirai)", "value": "3f019f020b8e27719ac84668b2edf56c58ad5f94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125332, "uuid": "b5777927-782d-4b59-81bd-3a500f45dcf4", "comment": "Malware payload (Mirai)", "value": "1ddf071c4f2751db07bf9d1b7e91edeb7ccd7e7342c8e9f954167bf228364c9b40a31dd75e7f8c186d0562b7c8d8146f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125332, "uuid": "b9ba53aa-f507-4390-bd15-cd9eaff9937f", "value": "T199839B23C9361DA8D84804B0B0B48F755BA3E515C4672EF7599AC63AD483EDCF6863F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125332, "uuid": "e4ff7ff1-57a6-48d9-a0e9-d4565fa8698b", "value": "1536:axD+xE86+GZal4XhbFKxvCgF+HRCaWl5WQHyn:al+xsZ8q1Mxz+HRE4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125332, "uuid": "6f1ddec5-b12a-4f3f-950b-a807e7c79967", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125332, "uuid": "17d299f4-e4e9-4d94-b321-09b595eb8866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125332, "uuid": "2cd2a84e-dd2c-4781-9128-5c051ddc7f01", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe2df54-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125352, "uuid": "c0af5456-cf82-4dda-99e4-b750ed382f37", "comment": "Malware payload (Mirai)", "value": "99b03d81af5af050cbfc0723eac38359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125352, "uuid": "e869b368-545c-487e-8a19-ab2e437006c9", "comment": "Malware payload (Mirai)", "value": "5a11d08ab62f97ead0f6a5137563e71dd60955a8b1968854c3845448eb282e29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125352, "uuid": "57e4e3df-6e52-4dfd-89b6-0ca291022f28", "comment": "Malware payload (Mirai)", "value": "c31dbb8dd55b9e456652d837ce387c84fc29b946", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125352, "uuid": "3257680f-96a2-494f-931d-c0d29be45fbb", "comment": "Malware payload (Mirai)", "value": "36adeca9d7538e545cf33a23924b25703b5f40a77724f52b64b80e4ba3fb2ad41f29817a00a362218052c423b6a47dba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125352, "uuid": "0d24894a-09b5-45a8-b609-23c4df4dcf95", "value": "T18D932852FD814622C6D116B7FB5E028E372713A8E2EE72039C155F2137CB96B0EBB542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125352, "uuid": "df0af07b-ac0f-4396-9ac7-87001702ad14", "value": "1536:EFdsDRtW3FiCVvEwJUIPdAcFj94BVVLAMCWPr1o/T7vX+oTJ:EFdYc3FiYDdAcV2TVL7p4TTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125352, "uuid": "89ecaea9-6117-4f70-b7a4-5c1edf8a6d5f", "value": 93364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125352, "uuid": "4f5c21cb-26f4-48b2-b1b4-4bd97b55a9f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125352, "uuid": "502a9c71-2536-4a0d-8bb8-4b3f348a43c0", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a986d6-2ee2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775168452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775168452, "uuid": "91d5ae56-a09f-456c-b4b9-05e745bf3440", "comment": "Malware payload (njrat)", "value": "3ab6596b5f1100644cb68cba0c7d3431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775168452, "uuid": "f990c9bd-8c13-4576-af76-e6430a582b28", "comment": "Malware payload (njrat)", "value": "5ddd3491dcc659e208b08b8b9c430a34ac3ab9f909282c27fc7320b9f8f86e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775168452, "uuid": "56af5b93-254a-408a-a431-7284860bef81", "comment": "Malware payload (njrat)", "value": "c723c31ebbb20326874ecff0811fe0f3e6d1e7d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775168452, "uuid": "037dd73d-f3f0-46f3-bf81-ab50ad5bf6b7", "comment": "Malware payload (njrat)", "value": "538c9bdb759bf87a878382e8fff6c19a95c9b3b7cd8121bae6f7ae6b4b4178b88716d21e38f5933c888b59aae1fde177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775168452, "uuid": "feea1d33-b8b2-4d1f-829f-d65fae9bd7fb", "value": "T1BF93F79DBBE56560E0FE8776AD72B2000F78F0571603E60E48E564A61B37BC44EC4DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775168452, "uuid": "b6960bf7-5ce2-497c-a0f7-80440844b563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775168452, "uuid": "9ce7d09e-4608-41cf-b31d-22545ffddf80", "value": "1536:vv00NzTZU4T700fNASI6gpxwsxTheU8oW:xTZUUBlAP6SdVeUdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775168452, "uuid": "c6f2a7b8-2282-4c2b-bfde-181f7f77bd62", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775168452, "uuid": "cdfc14c3-ee4a-44ca-b43e-e6fb535f06fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775168452, "uuid": "9647ba9e-79bb-42fd-bdaa-39003674cc09", "value": "GammaRay.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248cae4c-2e92-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775134063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134063, "uuid": "7a4cfd8b-b0b3-4637-b7ab-dc3ef8f3fb81", "comment": "Malware payload (Mirai)", "value": "a53254fd5a91c98d97ef2dcf9210f851", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134063, "uuid": "c39cc0cb-3a83-4ea3-964d-2a4b1ba84248", "comment": "Malware payload (Mirai)", "value": "5e2bc42694b4eddb372a8370937a19cd71db11c8275a0a12ade339f2862fac55", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134063, "uuid": "75a2c625-b522-4f48-8baa-46fc0e92c224", "comment": "Malware payload (Mirai)", "value": "1316b0a5a9b5afd7010f39316580c6e7ddf613f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134063, "uuid": "5662fee2-e6dd-470b-80f0-97a42f3a660c", "comment": "Malware payload (Mirai)", "value": "5817eb68b0e616fd17cfc48fe164bbd3320e904420ba0c139d94be4fd1c6f2173988bc87e8d002a220a6826a6776a00b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134063, "uuid": "2bf4af72-2447-4f0d-92f7-061d2650ae4f", "value": "T139733BC2A783DD7FF9698BB48A628AB833C5059F25E5D5D7D32D3E0D07301819819ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134063, "uuid": "f2c3749b-a9f1-4b9a-a9a8-6949398db319", "value": "1536:DGkrw0OW873d6/4aHYi8EDpt4Z1k91YfLX3IuR1RzpXKTp9tqVsDE/4xWx2Qrgjf:qks8873SLRt4ZGLQrgu04ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775134063, "uuid": "7a39ee2f-4c9e-4e6c-a4d2-811dff51f92a", "value": 79544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775134063, "uuid": "bf922cf6-5be2-4b57-a648-26653619b4e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134063, "uuid": "df5c001b-0d6f-48bc-99f2-7c568892a5d2", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc122e60-2e45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775101273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101273, "uuid": "df0dcda9-f207-49e0-bf73-14a20e24779a", "comment": "Malware payload", "value": "e0fa02b03c1bca8ce7fd9bd1d425e28c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101273, "uuid": "8ce4ebc6-23f2-4275-8a0c-e1321943bda7", "comment": "Malware payload", "value": "63c985f2f40a9c970016a15a20f6229942bc7fcdd70a3e77083fa516fe985b93", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101273, "uuid": "c6ed9fd0-875e-4676-855f-5bea57e00a74", "comment": "Malware payload", "value": "41ce127313e2256be4c251a048cbb35a13334fbe", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101273, "uuid": "49133a75-12c8-47b9-8fee-57dc759f3eb5", "comment": "Malware payload", "value": "b8d95b2ce8fd0aba4f1128cedd35cef51cefbd038e1623c36d1c684cf6a5e92d223c8c19b64c5aa94e8784f8599ed220", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101273, "uuid": "4463182f-b14b-4e34-ad2f-c696afb86053", "value": "T198E31212CC3CD24F7EC0763A3BC14BA749243D49203F4BE1096527BBB5B9457E989A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101273, "uuid": "c601e210-bc41-4f32-aacc-934d6713ebd7", "value": "3072:APDJRDIpBvbAm9KJqhuNbbCXsBcgJU3S2Bg7Qy:Qt+Xb/9HgNn4oQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775101273, "uuid": "34615b3d-d90f-49ce-ab3c-4445a206505b", "value": 154432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775101273, "uuid": "91f83373-1752-4b15-abae-a452a981c989", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101273, "uuid": "38582d06-66ef-4d8e-80ea-89acd09e5153", "value": "SKM 5108426900.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1598a1-2e91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775133697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133697, "uuid": "0af4430c-53b9-4b85-a063-70051f1b39a7", "comment": "Malware payload", "value": "7069bc524e5373e3d85315843be27928", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133697, "uuid": "427b1eea-9818-4108-84c0-e3fe5a843a7d", "comment": "Malware payload", "value": "6450be29aa887d5e3aa882df387d5896bec18b85b6b1338b1b9d82a1a51d5303", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133697, "uuid": "d66df121-5ff0-4c8c-86e2-c7d28fbf78fd", "comment": "Malware payload", "value": "8088eedac6cb4a39bfa94434681d1d213ad18bb3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775133697, "uuid": "3e9ffd84-b116-4170-ab3a-136590aff77b", "comment": "Malware payload", "value": "9e0a896ecfe4df5d755563ae2b8ba14b194434dccd75f23811788a8127ca9b19c93873295ae16231a68347c5bef496e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "ShellCodeRunner", "colour": "#88D464", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133697, "uuid": "5a133a0f-b3a3-4429-9962-f39db9a1da14", "value": "T1C87429113BF088B7D27E0532DDA9AB98F5F6BD728D308917136039AC8D35F418959B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133697, "uuid": "274e78b5-d49b-4765-a366-b0bce2140aa5", "value": "aaeccfa66533bbe60dda5926290380bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133697, "uuid": "ad768251-ced6-4ec4-8ddb-f7737a3de294", "value": "6144:UMHFxIZw2ms9jGUIXo0rjI2RzsSzw6a+6zk5c:UMWZi5w29sUsC5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775133697, "uuid": "8c757fd1-9de8-42dc-90f6-495e07a821e4", "value": 339984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775133697, "uuid": "1cf55c25-2533-46fa-80cd-a8c4e3d2f4e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775133697, "uuid": "db1bde00-c9be-443d-b62a-9bfbd8c915c6", "value": "adsiedit.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32ac0e2-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125310, "uuid": "1ce83f80-3b2a-460d-ad14-aa929eb44b2f", "comment": "Malware payload (Mirai)", "value": "99750e2ee333a74d860f94cf5a727f7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125310, "uuid": "05be045f-df4e-4624-bb09-b78c1d5cd195", "comment": "Malware payload (Mirai)", "value": "645d2fc37a391a513e4fc2cf41fb00aa196c9365f5e18fc1301366c9abc4663f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125310, "uuid": "259c2e95-9ed3-42be-ba7a-120ba968cb39", "comment": "Malware payload (Mirai)", "value": "bf50d9ab8616063d6b721e4f7b9874d2db1a4fee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125310, "uuid": "529c45ec-5629-4836-bcad-8653874085af", "comment": "Malware payload (Mirai)", "value": "c98e8beb079d15b8bdcf3249e83cb7588ca7b9aad7c45f9ff236fe28c1a6fcd09e23f999d82518a06b0a3dd3cab2e9b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125310, "uuid": "84059565-6222-4234-956a-9b377c45a69e", "value": "T149B39E8BF6075A90CC2187F80BCB5BDD3A233212AF6788E77C1E253D59781DE4A06791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125310, "uuid": "503ad5df-f666-4e9b-8c3c-40e0c0255a90", "value": "1536:JDrdsl9QUBAf6HGwdQJAwbsZYae4aJ4gP/LW:lrdslpp9gLbrataJ4gPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125310, "uuid": "b142a2d5-7294-4394-bb0f-fa8c36d6f4c1", "value": 108172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125310, "uuid": "8db2dc43-cf8d-43b7-be0c-12afc8aee3e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125310, "uuid": "2757d2f6-7cd5-49f9-af7c-42b610d914ba", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bd8b16-2e8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775130982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775130982, "uuid": "6efc60bb-513a-465f-b80d-56104b494a02", "comment": "Malware payload (Mirai)", "value": "0f521e057ba61ae49329db721446ae5a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775130982, "uuid": "c429454c-16e8-4542-8a55-f4a33144e6bb", "comment": "Malware payload (Mirai)", "value": "65d10ce7d4cbda9b316b4a4e1d82e0cd111f741b8aa2cf595fd9183de6364a34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775130982, "uuid": "08065cc2-c67d-455c-9ac5-c43450855359", "comment": "Malware payload (Mirai)", "value": "70ddcfe0507ab889835e9ea1952e26fea5b461de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775130982, "uuid": "9479fa06-cee8-408b-982e-7ce5387e4a56", "comment": "Malware payload (Mirai)", "value": "105e8721637fe60d6ff5c6a952fd227606389371d9113cd77d2d5e9949d1de8af92f609490b227c4e350bd5999760216", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775130982, "uuid": "733e3d19-0b14-43ee-a7ab-876966c9b4cb", "value": "T1FC01B1CC3134247075B6D8E65E32AD1831C990963DC63DB878E6B0EA85F5D10B98A8B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775130982, "uuid": "2981049b-c96c-494f-bde9-b00eac312027", "value": "12:YkF1kcClZF70SAaHFKaHFTaHFWjLSFSrLR+FM5gFiLTjLSFSVLR+FMDgFiLXA1Ld:ZDkH/FbzHFFHFGHFWjOF6EFM5gFiPjON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775130982, "uuid": "b15b9697-d1d4-4912-a9bf-218252322342", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775130982, "uuid": "0882c239-0160-4d97-859b-241ddf8bb7c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775130982, "uuid": "0170b98f-81a9-44ff-ab45-959e670ddcb4", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ebbd64-2e77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775122463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122463, "uuid": "cb92dfad-b5c6-4ee1-b03b-5a307d4d2626", "comment": "Malware payload", "value": "d9e5531bed49d6e436ae153f06a2f1ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122463, "uuid": "872b870e-207c-447c-926d-1f190df0c924", "comment": "Malware payload", "value": "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122463, "uuid": "8b4d141d-1986-488d-9891-149703bc57c6", "comment": "Malware payload", "value": "ac5feca8670bcbf500f29b45bb1d1b9f82e6b5f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122463, "uuid": "2f521f46-cbe2-4f2b-baad-6d85bd0ebd8f", "comment": "Malware payload", "value": "5b6ead1d8e4f4c8197f36622f9b943e7458f8775b0aa986180a4c95842e90e038c75c77d34667b2745023391381f9004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122463, "uuid": "105a6ff4-c2f5-4402-900e-1d62e80162a4", "value": "T1F2564A0163288161C4A331BCD39FB915B7B9F84B33D06BC712ED6F09DD8B868867A6D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122463, "uuid": "f01d3e76-584e-4879-9233-e0c2bae69651", "value": "02b2c680af574d02f82636ed71d52b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122463, "uuid": "c0f30b44-f369-413d-aacf-a8ab4a7ce7b5", "value": "49152:wA5nfk9nrSxCh2MB16UZ1o5q8RSPO1amSgvtFuzoNrF4hOFOFOFOTwSOojunYyIW:wgqrSCKrR1amSgvtFuzoNry0yNbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775122463, "uuid": "ad5c105f-89ce-4d4c-bd51-52f148f2853a", "value": 6225408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775122463, "uuid": "c7007b30-e7dd-44e0-93a6-46bf0b62550b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122463, "uuid": "0576c81a-bcab-469f-ba63-2eb62364271a", "value": "Merium V3.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f55b08b-2e8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775132981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132981, "uuid": "20b743d4-8c32-4e26-8122-9ee6e33cd2de", "comment": "Malware payload", "value": "38eacc248c9693f3e06e6babefe456bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132981, "uuid": "fdf2106c-e2d9-4991-b54f-478b956dceb0", "comment": "Malware payload", "value": "679b43410a4208582ae4fadba31d4b032359a66edb42c3f6994ebd6ac22a84e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132981, "uuid": "b6728098-4c41-4b3d-95b0-4aef6506b3f4", "comment": "Malware payload", "value": "0c9f6b3a87f46c4b9b524168a816f06f779cd164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132981, "uuid": "69de585e-29e3-4989-b256-e85c9e85fee8", "comment": "Malware payload", "value": "220bf750e010a252468d312dfd8589ed28f963dbbb44c24046af70e543117596ccea01f62fb73c02ecc79de3dc9f5c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132981, "uuid": "f8541cb7-1b9e-4db6-a8bd-d9852417cad8", "value": "T1D7B68C42FD8B95F5E9031931A0A7727F67354D024B29CBCBEB407B2AF9B76C20936245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132981, "uuid": "3a7f21f2-25cf-4318-bba1-0908f9db1165", "value": "c6fb30ad4dce883317a7260ffcbc1a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132981, "uuid": "c068aa11-a826-402b-b92a-e13ff44b7d74", "value": "98304:AlWAIGILdKy0pS7OfBHRORf2iIcXrK1nEjXBm69HFY1vXQcc+PXYLXXdp:AEGIkp9HERf3Ic5rxHFkvXm8aXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775132981, "uuid": "d83ca1f6-21a2-4aa8-96ef-849fe8d2e91b", "value": 10556928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775132981, "uuid": "1885c8a0-b424-49a1-b3a9-be8cd112b565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132981, "uuid": "a03eecd3-ee7e-440a-b267-586cfa71e72d", "value": "bot_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dc2242-2e69-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775116455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775116455, "uuid": "f65b1d52-2e12-4e60-bc94-7e0aece7cba5", "comment": "Malware payload (QuasarRAT)", "value": "272a26b6a6d4da9123afcb8dfac01267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775116455, "uuid": "82767cd6-a5a9-4747-b91f-ac7bcfe9d73b", "comment": "Malware payload (QuasarRAT)", "value": "67f8d4097eb2a5294526c5991ec6c021ae5c23292bee25265ca6622e35ffb203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775116455, "uuid": "0bf0b352-496f-4954-b998-e76c77a52a23", "comment": "Malware payload (QuasarRAT)", "value": "1a243318696ae453ffc4660deceb5f307c440c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775116455, "uuid": "0d599eea-c70c-4414-86e8-53b98a5af4f8", "comment": "Malware payload (QuasarRAT)", "value": "2623cdbf92e2b82e86ac63ccd671f0362c69230302114c52306cccd6aa2db5c481e4fc334a9a52e9899ff6f5a8e67d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775116455, "uuid": "c9c309d0-8268-4faf-a72f-bc5c433eb04a", "value": "T1A7749D5373A8D93BD1FE1B3AE43A16154BB1D443BB1AE38B5A1855B93C133868D903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775116455, "uuid": "0a7b2f9d-7a4a-499d-a48d-388442b36d06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775116455, "uuid": "67a294e9-5410-416a-8436-d3ac8654e311", "value": "6144:22NHXf500MxSKqs+voSbdFjhfHb45bjq:dd50KKqkuFj9Hb45bjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775116455, "uuid": "bb3edddf-9610-4008-806c-96142183a1fd", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775116455, "uuid": "e77a8e95-1e91-4a20-b530-1a56585694ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775116455, "uuid": "9c540f4a-802e-42fd-981e-81b567eadc9f", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b16e98-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153668, "uuid": "4561f55b-8b8c-406a-b4ca-0196ad1f4c41", "comment": "Malware payload", "value": "5b4e54fe7e32451594fc1bc6a9c82c92", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153668, "uuid": "8df9cf2e-1695-46ce-92fc-ca8c0a87d61e", "comment": "Malware payload", "value": "683822bf87d3e85c3c9f759e586431e72ec03699c2a9ad98bc3a86d80149fe06", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153668, "uuid": "05fbacbe-aa09-4795-8219-584f133b022d", "comment": "Malware payload", "value": "2416cc79e7de05ba286a2fcdc10ce34a09f9d12b", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153668, "uuid": "bb0421e9-6384-4720-b2cf-9905524149b6", "comment": "Malware payload", "value": "9682c0d7a06605aaa7368872b84082d1e94f1593055f54a8cbdd162640d389c0650493c7a2ec69a59ea09224d7b3b7e3", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153668, "uuid": "ea18d555-4926-409f-94ab-2ac003e42e18", "value": "T1A1D53342199C5494DDF28EB6CCD3D43FF6800ED5EAE87F71129CA139E27CA342645E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153668, "uuid": "90a7a0ca-8324-4d0f-9fbf-e209b8a4908b", "value": "49152:OyaTzes7MBqkB0JxcwEpOGMd0rVSZbbaMlgmSwNjyXSM7Y6D6NDz7cO:OyERONy8wEpOP2rVabEm+Xcu6x0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153668, "uuid": "300b2f4a-db21-46d3-b1dd-df7bb5fe6e25", "value": 2777871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153668, "uuid": "6f386ec4-fdc9-41e5-8341-f06c0d46f06e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153668, "uuid": "c5db8b6d-2946-4d74-8778-634d5b56afda", "value": "683822bf87d3e85c3c9f759e586431e72ec03699c2a9ad98bc3a86d80149fe06.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4919be8b-2eb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775148728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148728, "uuid": "2e6451ed-8c84-415f-9fe8-274d29912b9d", "comment": "Malware payload", "value": "d07270ce9fd6f0ce8b176375366d077d", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148728, "uuid": "2e381048-191e-4df1-96fe-bde52bab77ee", "comment": "Malware payload", "value": "690459835383c4eb733c2817d8f9add7417312f7938e150e2429d0b5e2b4b2d0", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148728, "uuid": "7afd8747-3193-4a14-acb3-c5e23526043a", "comment": "Malware payload", "value": "a3d2d7553f8d05c708ea38bddc9ac48427ca8b0c", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148728, "uuid": "e4943626-8286-4d4e-89bd-225b1e5d8ad6", "comment": "Malware payload", "value": "8ee774d6667c6f8567458f1438aa52ecec8eb8db46a06289bca807f9fd0ad5e86522c3b17a4bfb3929f4efe3e3c4597b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148728, "uuid": "957abdcc-a392-4079-9ef1-9a343a417531", "value": "T18196334073964CF9DABB243A84B28E56D6F3BC5D8730D2DF53E412812F631529E39B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148728, "uuid": "b2ec7439-442b-498f-8044-9cf00ebcff5d", "value": "456e8615ad4320c9f54e50319a19df9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148728, "uuid": "77e2a32f-8936-4872-ac09-b5203a24491f", "value": "196608:6f9cRAwuLlA1HeT39IigwT1ncKOVVt4U7WOtQ6N+tzuV:8cRvr1+TtIiFR0VsUR6Xxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775148728, "uuid": "3c5d49fb-cd4f-46b8-a1e9-d0d648da842c", "value": 9446803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775148728, "uuid": "07a71027-7bd5-49fc-81ef-b5229da4ef51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148728, "uuid": "84b3732f-e688-4eb4-b8d1-4b021ac86c04", "value": "cWPnzbjuLFpI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907830c8-2eab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775144982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144982, "uuid": "9ef75fa7-343a-41bc-95bd-7d338b52b8d3", "comment": "Malware payload", "value": "076faf202279358535e9debc0d78762b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144982, "uuid": "15e7761f-46a9-4f62-9de0-09ede6ad349c", "comment": "Malware payload", "value": "6cbdbecf9532279610ae6425b31349cc7ad67367df970bfd3815bb32171f23aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144982, "uuid": "475f6364-41b9-49a8-a5cd-650cfcfb438b", "comment": "Malware payload", "value": "04426ee84e1478517070bb46149723e9362d9da8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144982, "uuid": "e26a3a45-7149-4187-82bf-eb2d621238a6", "comment": "Malware payload", "value": "85cc9264e4804302ad50f97437714b7be3a0d17f19ac7c0458b3266b5dcf07e9663b928f326d6cfcde7cd34da4716d9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144982, "uuid": "45ea5ae3-d84d-4734-b955-85696a2be735", "value": "T1F864D01ADAF91000F7F31FA4A97E68504477BEB32E1E68CD05152D4D5A32E94E8E2B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144982, "uuid": "ef3ae22a-0c94-4199-9715-0c597ecdbe56", "value": "6144:oEdlFdy1L1aLhZxzylb81TbNFrezUpL1iXIPkktMegN7pXSMuiXyGuvZT:ois+LhulgZZFPL44ckINtXSJiXyGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775144982, "uuid": "a25c615c-a365-4bfb-80a2-f480bb454489", "value": 309338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775144982, "uuid": "35b2b79b-c372-41d9-9e89-b08ebb2f0060", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144982, "uuid": "091f60a6-307f-4cc9-930b-43508fed4f2e", "value": "ORDER--GO23B005.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b4fe99-2e9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775138958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138958, "uuid": "e086f42c-39b0-4ba8-8eec-cae7dcbe226c", "comment": "Malware payload (Mirai)", "value": "0546aa0ea49b13c4d7576d7e62246d52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138958, "uuid": "b178eb6a-42a5-4e25-afad-5a6d18588387", "comment": "Malware payload (Mirai)", "value": "6f63e080b5af38f25373d58b18d478189eca4998864517035b1c6667a21028da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138958, "uuid": "cf41cbd7-02ab-4d95-afb5-fd05d3837020", "comment": "Malware payload (Mirai)", "value": "5c996ab69347ad0b36994703ddd3d41eca200141", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138958, "uuid": "856fd189-b7a9-4799-8fc6-4caf8b95a081", "comment": "Malware payload (Mirai)", "value": "c7b2dd5d378e385999a143f5699992bc60c231fdeada8aef3a8e68241a8cdd588d80f5ab314dbe249c27e8c60ce1fd56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138958, "uuid": "82970f74-6681-4e5a-97c0-0842db166dec", "value": "T101D3290B75C0C0FDC8E9C1784BFEB126D972B46D1238B61B27D8A9222F4DE205F6DA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138958, "uuid": "dfb42f94-a69f-41c9-808a-c0b7a18530ed", "value": "3072:y2VW3ZQ79cv7DnTimjdO1xxxhZgA3RJutA0Vh0C:XKvTyVgA2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775138958, "uuid": "fce315e8-9bbf-4e08-a51b-c7c96263ded8", "value": 141480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775138958, "uuid": "b1d7c59b-1134-4055-b569-9e30e4b35f4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138958, "uuid": "edb35009-ce65-4405-95ce-a0f6cf7f59d5", "value": "sshdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b008af-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153654, "uuid": "730ec95a-b75b-4bc8-851d-84ccbc257eb1", "comment": "Malware payload", "value": "ce74aa3241750536d96ed6934aff19fa", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153654, "uuid": "502f0165-b120-4cbf-bdd2-084fe8791262", "comment": "Malware payload", "value": "6feb2c9e611ab9546efb5f818522430bbe7f8bdffd29e9c36e591bf8db578900", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153654, "uuid": "aa716fba-bcba-441f-8bb1-1f05eba44245", "comment": "Malware payload", "value": "d0dbc72bc825f9935413cefe9769672e53bcbe14", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153654, "uuid": "6ebb2538-6095-4159-998d-8d2f02d49409", "comment": "Malware payload", "value": "a8a510109986bcdadcd7dcc9814749a79033e247a8aea6bb7821cccede184699e03df42a1b70d1781b61cf7db13ba34b", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153654, "uuid": "59365d1c-7ffd-40e1-a73b-c1ad17779306", "value": "T134F4F11BFD89C465F22788B66872C072F40926599CE6D42B85D04A8EDC34ECF1B63FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153654, "uuid": "2635982a-1d06-465a-bad1-5632adef9947", "value": "12288:BaB7+99sHtRrFTogC0PRr21TfV2SIpW4N7iNDRX9SsI6yQAPk44g4IwhWN:BakbsNJlogCCUeSIpjRqDRNSsPA4JInN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153654, "uuid": "fd8683aa-9401-4298-adec-aec7eec47ee7", "value": 727733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153654, "uuid": "b5255095-153c-4ad5-86f4-b405fae3b1a3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153654, "uuid": "b02f3e18-ce31-487d-bae7-9cdeef726ec5", "value": "6feb2c9e611ab9546efb5f818522430bbe7f8bdffd29e9c36e591bf8db578900.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e436ece5-2e71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775120212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120212, "uuid": "8acf65e8-bf33-4b08-8e6c-f630854d9d2b", "comment": "Malware payload", "value": "cbd3edbf91fc1fe30dc5387ff5826bf3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120212, "uuid": "cd5b1792-e636-4525-8bbe-9484226df173", "comment": "Malware payload", "value": "70124c2df46ebe1e32a860462c8fe7b31eed825c66180f5abd8abe841b4059ee", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120212, "uuid": "5414a2b7-15e7-4883-bf62-dbfb0bbf0f4b", "comment": "Malware payload", "value": "b462722881fd8cbd21dc16fbae36e42f81ed2e5e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120212, "uuid": "50018780-b888-4e01-8d00-108a95a6ab52", "comment": "Malware payload", "value": "272fd1320a1ffa14cada2f1c7c28d803303b45b47d0983d454b28b29f2bdc2191b2599deab447e28ec6e464a933b2f8d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120212, "uuid": "3388b11d-23c4-4ba8-a5e8-1ca0f957759e", "value": "T1AA4302F4E983A431E994F736150AF8777D2ECF4163AB7F651580805A1A0CA1FAF42E35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120212, "uuid": "e6f486cb-7580-4433-ab4c-a9539d3ac0d2", "value": "1536:ENCxDkO1sDohzgCveE+GGv6aBYu2RklgZNk/9+r2FNWE7JX/8:ENC6hDoJvNGCC32kgfk/GGNWE7Jv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775120212, "uuid": "1fb34a40-d118-4d5e-909f-6cfe5381e7a3", "value": 56426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775120212, "uuid": "c6b58188-3660-42c1-ae5a-452b85d3b6f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120212, "uuid": "b5708ecc-d7d8-4cce-bca9-42fe506f1623", "value": "Dupers_Clan-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbfa481-2eba-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775151336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151336, "uuid": "c189717b-2d89-4583-9b16-06258bf5416d", "comment": "Malware payload (njrat)", "value": "1ea91f0587fd634c99ac721440c611f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151336, "uuid": "f25778c9-0d6b-4051-9300-35d0aa3f63a9", "comment": "Malware payload (njrat)", "value": "708f81337be07609f0e6ee7042bd14b56042cc42164d926ec5aa3df70b395abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151336, "uuid": "d09be0d4-2a97-4c9b-8737-6092669d6779", "comment": "Malware payload (njrat)", "value": "ab853a069d767655f008e8be0a4601e66c5e4be8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151336, "uuid": "332db91e-239e-40ca-bbb4-d43012fd104c", "comment": "Malware payload (njrat)", "value": "536668c2f84a7f499623b35f39073ab71f6fe30bbb6be8cd5f0699363b48ed0317679fdffad542aa0831eabb4521145d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151336, "uuid": "383678ab-7c1d-4fee-bd3e-b5f40b8acefc", "value": "T151A23A4E3FB88855C5BD177489A59A100370E1870523EE2A8CC560DBAF73BD92D4CBF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151336, "uuid": "60b8fd00-1ef0-4089-a4a7-a1a3b8162fcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151336, "uuid": "51729965-10bd-43b6-bb4a-fa1127b8c076", "value": "384:q8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZTj:UY+sNKqNHnSdRpcnu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775151336, "uuid": "13a1d769-87f5-45db-8834-28b02e18f7db", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775151336, "uuid": "66d72c23-8639-4a30-aaee-639f5e404125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151336, "uuid": "42c469f8-3f19-457c-b020-5b88d70b74a8", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25aa3b9-2e61-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775113283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775113283, "uuid": "acf7092d-4637-4e53-84c2-f385d855c8e4", "comment": "Malware payload (Joker)", "value": "174ef749379b7b4581ca2ddc1766bc76", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775113283, "uuid": "8569608f-f7c2-4356-9884-c144c59b0b77", "comment": "Malware payload (Joker)", "value": "7110645f873201e28271b9e28ac11d5f4e826bee1be26c59062a3ebe0dce6731", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775113283, "uuid": "bb65b25d-85df-47a2-88ba-6d5395f44d18", "comment": "Malware payload (Joker)", "value": "de130a65470d426e9ccb8bab376b0ce6a451b570", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775113283, "uuid": "ee2a8e1c-c8ee-4a23-bf91-99d0d9962849", "comment": "Malware payload (Joker)", "value": "8e59a42d4ba007b3141ae1a4e24f363df17bdbe1a2e2120ea7d806197d2182e822f074fea46a0489a991c79ebe65a8f3", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775113283, "uuid": "fff1c578-3afb-47df-ae9c-3b02680e95e0", "value": "T1B366DF8EEB99BC6AC0F1933746763239555B4C395753D3C3498CA23A24A3DF04A86EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775113283, "uuid": "b08b303e-2053-4f44-8834-94c532e10185", "value": "98304:oLY2JOspAapIQj+OXiZiEYWENhwJJQEKMnYziwaziRVo:vspAbwbXiZiuKGYMco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775113283, "uuid": "b28c0a84-398a-40fe-a957-9c2e89bd86a4", "value": 6778896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775113283, "uuid": "0ff0cb7d-6b2c-4fa2-bc23-d2aabcda208f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775113283, "uuid": "190f76b7-dd0c-4203-980c-5a5e2d449314", "value": "Professional+HD+Camera_1.1.68.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ceabcc-2e46-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775101422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101422, "uuid": "d7588306-496d-4f66-9e33-8dd4b14222b1", "comment": "Malware payload", "value": "15ba6bbf73620dab9bb12f34f8b3d296", "object_relation": "md5", "Tag": [ { "name": "5108426900", "colour": "#20ADC2", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101422, "uuid": "5d75b99a-1087-49b4-8d08-3707d98db43d", "comment": "Malware payload", "value": "711894300f071611dd6eb4507772d579bce69bea33487875f6f31f2f08c1b615", "object_relation": "sha256", "Tag": [ { "name": "5108426900", "colour": "#20ADC2", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101422, "uuid": "3844f0ac-8f1b-4e21-9acd-c12e3001849e", "comment": "Malware payload", "value": "b60119823268cee85e7fb088b2a5cf30c2fd4dd1", "object_relation": "sha1", "Tag": [ { "name": "5108426900", "colour": "#20ADC2", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101422, "uuid": "96a68a79-092c-48f5-ac0a-e1c712ad369e", "comment": "Malware payload", "value": "817e7eb03666978986ea29e8c212dd36b28dad1c4b386d3cd896268a1c5f148e5db8046aee301b9c2c000b54a84e72ed", "object_relation": "sha3-384", "Tag": [ { "name": "5108426900", "colour": "#20ADC2", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101422, "uuid": "7aa2c035-0206-4b24-a2cc-ae3ef9517e0e", "value": "T1264533F4B27B1A20BD8B634697973F2B12D77D5F47822DB16095F1AEC8A63C0E641B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101422, "uuid": "644b9bf2-a4e9-4b8e-b043-835bdfbf2e54", "value": "24576:hAM0oBw5emGMWdNyRHxF9Tcs5jKJDmifeHEMhsWc1HYmr07TuvqESE:yM0o6KNKHxFqs5EmA0Hhs9H07TuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775101422, "uuid": "02b6c77c-b275-459c-9341-4af4168e447f", "value": 1267805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775101422, "uuid": "90656e7a-0e69-49e7-8ed9-0425c65bd809", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101422, "uuid": "933a8915-d7c6-4cdb-8524-be6e092f8d88", "value": "image-1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca8a971-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095852, "uuid": "2c037e4f-c8e4-4f59-8913-c61833b861fd", "comment": "Malware payload (Mirai)", "value": "88f2472370880b04b20eb31df333d45c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095852, "uuid": "48fa27cc-b3b0-4aec-8fe3-2081b5f997ab", "comment": "Malware payload (Mirai)", "value": "746730d05e45ef4a29e690d5b7c5f1a36db788b3e168debb3989983c47eefb70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095852, "uuid": "657fd41b-2911-4bdc-8f28-e6c90fdcdc8f", "comment": "Malware payload (Mirai)", "value": "16514f4cd6fc02cd44127f094ea186f8a30fc297", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095852, "uuid": "61775d50-e3e6-41e7-b411-db92e4cb8e8f", "comment": "Malware payload (Mirai)", "value": "03b22d883861695380a448817d82d5bb96ebec00acdfad6fd9d085c8b4d3e8afbda77aa6a8fff197f3a765cfc36438cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095852, "uuid": "0d743a12-3677-465d-b906-1cacc6cc00b0", "value": "T17404B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095852, "uuid": "a754a6c1-8304-4514-9a6a-66406fb2bad9", "value": "3072:nKpzGeeNkSfcQqmav8SqaRVlnYz65sVt:nKYeeNYQqmeqavlg65s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095852, "uuid": "65d53552-0efb-46d6-85c2-5cc132486502", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095852, "uuid": "f7913cb9-5171-4b29-bc40-987640342471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095852, "uuid": "b0904b4a-76c7-4733-a4f5-9353db32c3d3", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed93f0b-2e29-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775089091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775089091, "uuid": "2a6cf444-bed4-4f4b-b828-7bf6211f6940", "comment": "Malware payload (AgentTesla)", "value": "56979f4760922bdc1cd737b65b5c235f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775089091, "uuid": "08368d60-a900-4373-84a1-2bc54e092087", "comment": "Malware payload (AgentTesla)", "value": "751aa9279400039aaf388e904302bed35a9ccf131ea38c46b652287f75ad7830", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775089091, "uuid": "88662565-066a-4943-b25e-fb00f0a84608", "comment": "Malware payload (AgentTesla)", "value": "b9d9a4adb04efc42524c556d7389197204ba5712", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775089091, "uuid": "2fb6bbab-5049-478a-a782-6ea2a811442a", "comment": "Malware payload (AgentTesla)", "value": "107b9bf4be1c437f9474a4754311b29b9109716800a1a309872162332e86655757be8351a4d311180d2ebe23219a836d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775089091, "uuid": "072de6c3-4558-44c5-94e2-49f2db707755", "value": "T1126522433B2590C7D2A45A790D58D108EAF37F3C1466870E36AA3B6E62BD3635C3E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775089091, "uuid": "54992d83-84fb-4a4d-9eac-f9346350a3ab", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775089091, "uuid": "24f593c4-fb50-44fc-bba8-e9795654eb2e", "value": "24576:jYXcwd7VfAioAZIcGys1txw/+4LvHcZSp3EI+xBcD46/narjFSEBvqaQlsbKn7:MXcYVfroMRsGb7p3EDxBavarjDBqaor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775089091, "uuid": "4ed24881-826b-4777-9fb1-139bb5b7e110", "value": 1535344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775089091, "uuid": "fda5ff4b-0fc1-4f4a-9278-f4d29b190707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775089091, "uuid": "430652c6-53ed-49ad-bfb8-9bb6f8f60a50", "value": "SecuriteInfo.com.FileRepMalware.26413493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c875637-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153592, "uuid": "f64fcc57-a318-4e8d-8826-ec9ef2bf46f5", "comment": "Malware payload", "value": "1a99cc36013ba7172f9f44bac296eaf9", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153592, "uuid": "58407553-2c71-420d-8a1d-3b7e3989fde2", "comment": "Malware payload", "value": "76a24ce8aa64b364da2da2feca560e8a0901f5e44d8d8df2a844a67274ad5b27", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153592, "uuid": "5b741d5a-b028-48a8-a29f-6bf801ace981", "comment": "Malware payload", "value": "5ccc5f7012bd1a9460196d7c21743674685fcfb5", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153592, "uuid": "2b70b664-623c-4ab9-a039-3ca23faa60ac", "comment": "Malware payload", "value": "d4f91b20748cfbd807608f1758774f840d35cec5e8f3cc5869b7f86bcb8577ea5710013604e0c9c3b20c0234435ae126", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153592, "uuid": "13064ce3-704b-40de-a06a-2dbcc7ac41dc", "value": "T1BBF6F116E26E4034DB1BB13A10EB0756FC358798C552B1CE2AF822D95CE6CD48B73F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153592, "uuid": "377f068f-eb14-48bc-a8ae-0e606db07273", "value": "393216:8MPLFIaUBatPuTuTjrByvs8cHRLyqvhnYwJalv7QL:7RIaBmyTjrgE3VThnYwA17QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153592, "uuid": "e5c79c79-f684-46ee-b5c9-49f8fa03b752", "value": 16619370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153592, "uuid": "380a3b32-1025-4d55-978d-d5382d22e822", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153592, "uuid": "2e3e1a8a-e21b-4623-bb6b-3d27e01fe827", "value": "76a24ce8aa64b364da2da2feca560e8a0901f5e44d8d8df2a844a67274ad5b27.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed89b4d-2e7a-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1775123773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123773, "uuid": "8d063aed-4804-4220-b42f-e190b0fcda79", "comment": "Malware payload (ScarfaceStealer)", "value": "56687707aad362316395f43720a0dd28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123773, "uuid": "707f435d-0936-4ae5-a067-896e70a4b71e", "comment": "Malware payload (ScarfaceStealer)", "value": "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123773, "uuid": "8f83f9ac-96dd-46ae-8269-b4687c30d348", "comment": "Malware payload (ScarfaceStealer)", "value": "d78cd053182ba95c1c4e5b2b65eb8e7085c9e4d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123773, "uuid": "45a7067d-99d4-41d0-a03c-285cc33c1bbb", "comment": "Malware payload (ScarfaceStealer)", "value": "3ca856d4e0930c732a37dc02a13908372053920e47a54196d11b82d3a92081426dc0ada9670d3ec841c5ed4fa6f11bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123773, "uuid": "4d16b867-5882-4e7a-b7cc-3c58d49084a9", "value": "T158D622F849C163E4D4D34A00328B539975D1365E80FD4D1A3ACA3D426F11EAF668EEFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123773, "uuid": "d41358e9-c15f-4637-af6a-d80401972a4a", "value": "23bac67f111dec7030ff7fd27317602b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123773, "uuid": "9b8fcebc-19ce-4bbb-ba8d-acd55525de83", "value": "196608:s2L/l5tYwudIfHgTXs4pKDu9Vd4FOexZ+oZBHvBZ67ZiVUCkeJrqJo0XxlRNX:s2L/lUd+HOXs7u9cFzPF/yIxkiq5lRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775123773, "uuid": "8aefc9b3-2f1b-47dd-97d4-6cbb18473ec3", "value": 12953528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775123773, "uuid": "498c5be5-1f07-4d2b-a981-4724a3a22f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123773, "uuid": "7b69744f-4b0b-4c74-a32f-0f6fa16779c5", "value": "GaIa\u0445is.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8ee1e4-2e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125438, "uuid": "6f08e29c-2d09-449b-8412-f2cf0d2fbcb6", "comment": "Malware payload (Mirai)", "value": "ba0e5097d41e8b8d09c9919df72c77a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125438, "uuid": "d82f4396-4da0-480e-968f-f0c342e9e952", "comment": "Malware payload (Mirai)", "value": "77b0b59d2733125c03a25e10bdd7b1b5629cbf80b8627c9aec61b07164d984d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125438, "uuid": "e49625d4-e229-4077-b3d7-98d0c74fc698", "comment": "Malware payload (Mirai)", "value": "3f62bd74892959cdc5c6189a5da6b2f99843de27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125438, "uuid": "a297f3b0-b53b-4e85-bc4a-b06d65d25d10", "comment": "Malware payload (Mirai)", "value": "40ca251264019d94c007dbdb80c2bf96216e8551617c4b7784c063c30df7a35d07a6bb79c4e544c021df42564a1dc4c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125438, "uuid": "96ab6a70-c4e5-4582-9781-7c526ead40f9", "value": "T108530984B8508A43CAE535BDFE5D118C33526B79D1E97101CE04AF3526DBE8E0B7BE46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125438, "uuid": "db63affc-da2e-489a-ac01-6358a6923530", "value": "1536:02MEAKRXM7+dSl7lpSbEuh06j3xQpjnzLs6OyafjOB8IuNqux:NMXKwCojSbEuTj3GjU/86TNqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125438, "uuid": "5b62c19f-f27d-4df7-83a0-bb986d1e838f", "value": 66564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125438, "uuid": "c1e2198d-e568-4c92-8f08-f6964f56207d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125438, "uuid": "1fa423e2-b6d5-405c-a6e6-ace6fa9499ce", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a132cc46-2e79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775123535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123535, "uuid": "c556854a-06e7-4813-9918-80456013eaba", "comment": "Malware payload", "value": "ae2034e57712b9ee548253c04f5d0496", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123535, "uuid": "0c699d92-2234-4de4-90b6-f780d0ba3865", "comment": "Malware payload", "value": "780c37d0d64d8b78b6ad63d846b83d257982ca5663288593d9953833b275a2b4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123535, "uuid": "34627406-96cf-42e2-b03c-d00e0fdf0231", "comment": "Malware payload", "value": "d2ab7282db18fc6e7205a44642db28b5011ed1be", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123535, "uuid": "87ade118-df55-41e5-ac52-169ef3e29b9a", "comment": "Malware payload", "value": "e09be7a520dfd5ef81f7572224b8b65dcd76d4de4235bfc40cf508558c300a55ce52028a290cb2381727416b3b504074", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123535, "uuid": "521c065c-3f68-4950-ae4d-ad93ac0bcf6e", "value": "T11C3633AE0C08C6E321B7344A04C5E8D3E971DD3D4A46F99C75F6EC666513BC3878D22A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123535, "uuid": "e89f0a73-c862-46ea-885f-d3b03ad9199c", "value": "98304:bjhNd9X7PcGo85hmUai9lfAlhuWV1Wfd3agbaFU7ur60HJCbEy6vGoXI1o5mRzj:xNd9XzcGDhmUr9lfAHh6agbaFVfCIpX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775123535, "uuid": "731c4c13-1223-4a5c-8953-ba4b1230eb77", "value": 5229130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775123535, "uuid": "2bd84714-9145-4084-9f56-ed031a329319", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123535, "uuid": "cd145661-bcbf-4451-8800-6bb327acec54", "value": "F's_Digitale.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6cf7f8-2eae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775146133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146133, "uuid": "da37903c-cf7f-4a1f-8eb3-458f8413bc72", "comment": "Malware payload (Mirai)", "value": "21fd37d2477d534a5380596d91bd2acb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146133, "uuid": "b21faeb1-c798-44da-be0c-1cfae9b7715f", "comment": "Malware payload (Mirai)", "value": "79f7cc37bf931761a087da2d2998f7ffca5e4a434495f86eea06cf1e34d42c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146133, "uuid": "86b8c53e-4632-467a-a1b6-94d41b8d30c8", "comment": "Malware payload (Mirai)", "value": "94a49d65ed25557061c8de97b58e8f0db8da7e53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146133, "uuid": "61acc237-439f-4729-bbc2-7065bc2ca502", "comment": "Malware payload (Mirai)", "value": "62a0dcc21eb9aadc538883c2b6a6a8287a793070c8c08a43ed3bcca40c012346527dd0b1582344ba1df3504fabb5e251", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146133, "uuid": "e7af04d9-f320-4c55-89f5-f46a88c9b214", "value": "T11C04C70AAFA10EBBDCAFDD3306E90A0239CC945722A53F757A74C524F54A50F5AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146133, "uuid": "7fff07f2-513e-4064-b7ee-c0e5d990e53e", "value": "1536:sZY3qkNLGB8ORND2Ez2vLR5BQNx73Sk6rHFc6S5hqg8q0CM0PdMbZX1GCKgYeDET:sZY3HORVnanlc1p0CdMbZlGdPQHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775146133, "uuid": "5c2e8f7a-360b-4176-9f80-c3354a278ee7", "value": 181888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775146133, "uuid": "f0b33248-69b7-43b7-9a71-953a568d48be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146133, "uuid": "9de33713-5b56-42de-b37c-ab0f3a685dc8", "value": "miniiupnpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad3f4a3-2ed6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775163494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163494, "uuid": "b896b801-079c-493a-9cea-da87de21a4dc", "comment": "Malware payload", "value": "107ff51b65791fe3ff8737e66619f1e2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163494, "uuid": "d7d50cc4-b5f4-4958-920a-0d8938e18b60", "comment": "Malware payload", "value": "79fa34a1078a6cf6f248aa23131efdcde7b6a0ba4c0e2581c1486fbcd826fdd3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163494, "uuid": "0806ce6a-2b1b-45d3-a59e-826c0e681230", "comment": "Malware payload", "value": "26164c1af86ee44d7b2a5bf32ab5af7fb84ff3f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163494, "uuid": "55ff8a8f-fbc0-4378-a221-4a2b16f27960", "comment": "Malware payload", "value": "6e4dca67fada409dbec7bd1ea6272b94a1f7d67a2bbfab5a89a79c2e7f56c57bc8fc8798e75fc585e23e1025538d6b0a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163494, "uuid": "2f0e3439-791f-4625-a8b7-9b2c992dcfd5", "value": "T1B3D5BE4AF708956BC4F753370AB91A7151078EA28F8BD7C36914B23C58BB5E40F5ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163494, "uuid": "bce2a6d5-244c-4ae1-bcbe-7846d64dd04d", "value": "49152:zzxl50Vz9yMMuC+kONG8U5vwzrxbK7g12y3K347ZJmYDIDdSC4Q04LQvrvd:3CeMVkONGdeHxb/2y3K34NUYE4CNHLeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775163494, "uuid": "0bdbe989-c2d7-4d8c-b3cb-0e12265152b2", "value": 2890927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775163494, "uuid": "59e123d2-7b6e-4bd3-8de1-03c2da36c0e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163494, "uuid": "85030587-9f99-40ff-a228-831c3c909169", "value": "79fa34a1078a6cf6f248aa23131efdcde7b6a0ba4c0e2581c1486fbcd826fdd3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b562760d-2ecc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775159217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159217, "uuid": "8644c474-d149-42a5-a983-2ee656ef4484", "comment": "Malware payload", "value": "7aeb84f3c4a3fbf58a29988008e1341a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159217, "uuid": "d0c0fbd5-e680-4ac2-8775-b681ddc19675", "comment": "Malware payload", "value": "7a20096b331a5bc550856b045406f06704d8a5ae515c6e9f977e69148ceb33e7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159217, "uuid": "20d51ff1-79c2-4349-9e87-ccd1c2d3e0e0", "comment": "Malware payload", "value": "1ab9aeb726b3ca19e20f5756c224ab373c736af8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159217, "uuid": "32b8ed6d-947d-4da8-9ba7-20bb600da627", "comment": "Malware payload", "value": "4950275298c7ab1501024f2780c0a5f2516b049cbfd16a182d833dcce08f2288094fd1a24b724408df3b598c7b65c89a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159217, "uuid": "9daa1f68-024d-42d1-9159-197365c5d305", "value": "T108823A0FB942421AD0D10074A676877BDAB99876378824EBF7D48AED0A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159217, "uuid": "92b80db8-e2d9-4d3c-a1a9-ec70de3f4e6c", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159217, "uuid": "575fccb8-155a-466c-9ecc-59357c10ee40", "value": "384:1I7MVGYGlxOwzFshSZpu9NHRg6av8U9cX:iXxshU89Xa0UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775159217, "uuid": "722631e6-62e1-4de4-a320-6e5ba273e201", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775159217, "uuid": "413b2f04-d5e0-42d4-af1a-7ab7419b424b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159217, "uuid": "a2f27f02-32d0-451d-9eef-42193f95c317", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60802561-2eb4-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775148767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148767, "uuid": "a0a083af-ab17-44cc-bf07-a43224665142", "comment": "Malware payload (Phorpiex)", "value": "27ba7f1f3af490102dc067d1d198333c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148767, "uuid": "f8eb32ec-8f3a-43ac-9078-71700787b16f", "comment": "Malware payload (Phorpiex)", "value": "7ba205886073ee06a8fd711812ba7e655657a16ef7e6363100aa89428f270cc5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148767, "uuid": "dfe05aa7-0c92-4c41-9f52-de8de42fe2ef", "comment": "Malware payload (Phorpiex)", "value": "d1589813a445ad153880097a95abb5c4df959cff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148767, "uuid": "ba75cc53-2bfa-487b-8dbd-cb3fca2e1a7c", "comment": "Malware payload (Phorpiex)", "value": "2740ec7c7954823a3db16ad2661305b948219f736e655803dec449c555042a8782bbe181ed10fc994eb75cc9f7d9d7d0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148767, "uuid": "95184aaf-3fe9-4bec-893d-47496e73571d", "value": "T14412290F7F4580B2D3D009F052B54B8D497D25A327D2A1FBB777C5990FA8244F4827AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148767, "uuid": "e225b471-cdcb-4477-abc1-dcc136cda0d7", "value": "061dcb52602df02b8a4859c27c281f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148767, "uuid": "6f749eb9-7377-4868-85ee-c7174f9a7af0", "value": "96:K/s/TgqQL/o/peBE8fBdUKDysZ+BY3nkPFJxGE9mK2FFhyC7tCE+Hb:2GTgRQ/peBZceZ+OUPFJxTEKmFhP+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775148767, "uuid": "de62de98-373f-4ce8-bf10-d828253fca41", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775148767, "uuid": "ebacce34-5cbc-4a8f-b6d7-6104f3d02980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148767, "uuid": "beb63b22-5495-488c-b101-64b23258badb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead4b8ed-2ed5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775163172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163172, "uuid": "ee093707-f6d4-47ef-a97f-ef6473f178ac", "comment": "Malware payload", "value": "5f1d50a35fc31260c37589950d914254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163172, "uuid": "2cbb83cf-de01-404c-bc4e-ae2fbb7be23c", "comment": "Malware payload", "value": "7c995c884d4e3b0d38157c510bcc37cd7a8ca35ae24eb1ea0c7e52d76b8a7dca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163172, "uuid": "b9640dad-a463-4c1a-b2b7-694cb2106d97", "comment": "Malware payload", "value": "009de30e7ccf4f30fb7f735174958d364b7c51d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775163172, "uuid": "d3b04d89-6d91-464f-afc4-8aa123bdc588", "comment": "Malware payload", "value": "4efab5320623960d5bcb1e957bf29821d852eb26d4887a4fe403ee999e13e642adb6e263128712578e9b62a14b2811e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163172, "uuid": "eeaaf5fb-dc61-433a-a57d-9ad083ff0045", "value": "T17CE4E047F7954BD9CAABE63AC612133FFA7178925700830B13A58B632F271746B2D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163172, "uuid": "f5566872-3d68-4b71-a71b-2b8ab430fed8", "value": "140f9434d48e21a4391140ae021632f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163172, "uuid": "bd1e3563-eafe-409a-ac1e-93cf4040a7c3", "value": "12288:/Eojp4xjeWP4JqTmbDT+hT1s9pbesHJCUWM2EVZ:/EomxaK4J3DT6O9HJCUWM2EVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775163172, "uuid": "0a5bb67c-9f6b-4de0-9416-440484d4bbce", "value": 671976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775163172, "uuid": "5a325689-375b-4a4a-b957-037f6c191a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775163172, "uuid": "d2be73f8-ab24-4bdf-aaff-136d8a8227d4", "value": "image2026040268.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2486a92-2e85-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775128825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128825, "uuid": "adfa401d-8ac5-4aff-b52b-6055e1132f2d", "comment": "Malware payload (QuasarRAT)", "value": "078707cfb557efaf70e3362ab60d42e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128825, "uuid": "51bc8d86-6516-4a7c-9c2e-a3147de2d7b7", "comment": "Malware payload (QuasarRAT)", "value": "7d9b565d51db33717821737a374b450beb95ccefe0905e9cc50260a8250b0d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128825, "uuid": "9216328e-4980-4465-9863-898776687075", "comment": "Malware payload (QuasarRAT)", "value": "7000361ca2e50cfc82f11819c61fd16c6d44195b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128825, "uuid": "9fd4190d-bff7-4a96-8e0b-545196c4750b", "comment": "Malware payload (QuasarRAT)", "value": "4e5c51ad0105a6a8c3321f4829f8baf1e6264bbfdda580c0c3f2d1bf989280d32d6252515802c9a04b890fef4b855ad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128825, "uuid": "79d3eedb-5591-4370-a60d-40c6d4512274", "value": "T11DE55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128825, "uuid": "233017a1-89f4-4c1b-97ca-40776891b834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128825, "uuid": "a04499c2-ebaf-4c51-8576-23d0aab0822d", "value": "49152:SvjI22SsaNYfdPBldt698dBcjHMkxNESEGk/irLoGdNTHHB72eh2NT:Svc22SsaNYfdPBldt6+dBcjHPx13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775128825, "uuid": "b9d16169-c318-4326-973f-f7b7e0d3e8eb", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775128825, "uuid": "3beee577-37a6-4808-bc57-8e877061db32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128825, "uuid": "d1164ec4-6e07-43a6-9052-d802b5b2f310", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38015d98-2eab-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775144833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144833, "uuid": "a8b0212e-f17d-4774-8fcc-9f5642eeae9d", "comment": "Malware payload (a310Logger)", "value": "02c48f6ceabfa02b9ee71c26b1111913", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144833, "uuid": "bce2a15c-ac6a-421f-a17c-35833a698956", "comment": "Malware payload (a310Logger)", "value": "7e8b87b8fe7ccb490bd1e16e65b58287a6ef7782a5a7c79fa329f0ca2e96b366", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144833, "uuid": "5b51d652-13a7-4bb1-a9e5-69902cfc45e1", "comment": "Malware payload (a310Logger)", "value": "07d2b3d9fb2ace07ca6ff5db094f1a1f1bb17dd1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144833, "uuid": "a8d5717f-8ccc-4a2c-b99b-85c0db6fd95a", "comment": "Malware payload (a310Logger)", "value": "496fa0a5815c870c89c9d0a6fdb7227cfec0a1de61aeb7483733470070a243a556053444417a0aba4b507dbf5abac647", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144833, "uuid": "204a19f1-39e9-4839-aff4-2d36e1615983", "value": "T12D5502487219EE12C9EA5FF44D70E77807B89D99A022D317CEF97EDBB9397046904283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144833, "uuid": "f35fdc8e-6ddc-4bf5-bfed-1bceff232dc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144833, "uuid": "c9740eed-6cc7-47b6-b1a3-21d27a0443ab", "value": "24576:saSJJSHwb8OOGUAKfCFfBvGsxHKsVH826Kw9wPUzRh/kO02ck1cD89vqC1URB6:saqUwbzpPoCJVGsXVc2Fw9wPU9h/kxDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775144833, "uuid": "9566e375-6d80-4f5d-bf8d-71c6e8a6eef8", "value": 1340928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775144833, "uuid": "e267751e-1c76-41fc-86c1-b7ac23a5be02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144833, "uuid": "ad7fdea3-3dcb-4aa4-9044-2016877a027a", "value": "CY1PRg7XfNGOAjJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbfd15d-2edd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775166449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166449, "uuid": "8a1acbb3-f32f-43bc-a134-23f5af83ef0e", "comment": "Malware payload", "value": "d978cfbdb5bcbe78d16e3d1bb172ded3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166449, "uuid": "006dcef9-1da0-44a1-b475-ff38ffa9a725", "comment": "Malware payload", "value": "7ec55920de034940d8a0a058a717dfab5e3587d827c2a46fed60b09ae69dfde5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166449, "uuid": "8a55a573-64e1-412c-a414-8f99e997dec7", "comment": "Malware payload", "value": "4df59fe7a7cb7ec1cb257c007eb7614af7ba99d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166449, "uuid": "b96996e1-33a7-45ce-9a49-eb1ac0ecdcfa", "comment": "Malware payload", "value": "fdac52f7f2ef3c21ca7eaf9af7223c63a46e510ab328b101c100410cf4f7f9da399847bef083cf39e82ca342369edc64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166449, "uuid": "cb24e049-59fa-4893-ab3d-2e134672a000", "value": "T18D57ADCFB3838E9FC9099A35D613BB154652EC211AB682496D5627FF9D233488F3CE44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166449, "uuid": "b060ff8c-1646-4e3d-82f8-e147a9d2969c", "value": "9edabcee6e815c3a14242998079858ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166449, "uuid": "7e3b97e2-f8c5-4dfd-8413-9dd9b1e7722c", "value": "98304:DaYfjNJPm3Y2mMhiVBpcMDd1NsOhknYo+J:lNq6DDBmY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775166449, "uuid": "cff2d7f0-fe83-4f5d-8fd3-2155882e9647", "value": 28612096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775166449, "uuid": "3c60fa41-0c37-44bd-903f-b04a4ba3297a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166449, "uuid": "ebe58741-78ed-4664-b01c-3abe79a2c074", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c195c39-2e77-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775122641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122641, "uuid": "5339f702-f41f-4493-9091-5d8ab66d4e25", "comment": "Malware payload (Vidar)", "value": "aa8a8d9511fda5a1cb83849e722911f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122641, "uuid": "b9ae283e-e764-4bac-88ae-6b1730752ffd", "comment": "Malware payload (Vidar)", "value": "802a54ffe397f1de652d720d2d99bddde6e789d17afe337d749eb4bde9837b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122641, "uuid": "05c97fee-e002-4adb-bbef-83703515d147", "comment": "Malware payload (Vidar)", "value": "b0dafa4aff1ab07fe51ce72b23fdcde52359b602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775122641, "uuid": "67140550-4a1d-4e4c-b7c3-fbd13b92d904", "comment": "Malware payload (Vidar)", "value": "0231cd65e4ae3b0caa032cb6bb915ec939a63cb73d7f5743612acac8aeba350d3f36b3b63e8f5efc718b26e5151f3237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122641, "uuid": "966f5a88-7c2d-4dfb-a94b-3640590b1481", "value": "T1D5C58D17ADD148B6D46AA3369CB64286B735F8080F3637D72E12A6792FF37D09934780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122641, "uuid": "2d1247d6-604d-4992-a1a9-10d9730bef5c", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122641, "uuid": "39a71907-8c9e-4b52-a4b8-a36071b4b50c", "value": "24576:snnnehRMGKz/sZgFdx2FOD94DnQ0gjIA1PdZ8rFCGiWq3dRHGxsje:snn0qG9+6g9iQ5MA1Pwh8tfje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775122641, "uuid": "c636e080-835c-4158-95fb-786ccebb2b88", "value": 2603064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775122641, "uuid": "20019724-aa9c-4167-9c7f-d7b81a537ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775122641, "uuid": "b0a61fb3-b7f2-4ace-abda-649b5d53fca5", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb4ed30-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125304, "uuid": "9a757d4d-49b5-4f56-a12a-3c24eb97b87e", "comment": "Malware payload (Mirai)", "value": "b004fc932e63720c8fb74d5b2974ff74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125304, "uuid": "de92fe8d-963e-40cc-9146-029ba3003510", "comment": "Malware payload (Mirai)", "value": "8108f37ecb81c14d47d741bdc98f3b4c008c69eab0352d52f9804724663886e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125304, "uuid": "4ccb7f52-3a25-4ad4-8f78-90315dfbd4ec", "comment": "Malware payload (Mirai)", "value": "81270808ca18a85fbb3cbba2e3283ee6f2d927c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125304, "uuid": "dd42d43b-326b-4b01-bddd-1fa3c818a68a", "comment": "Malware payload (Mirai)", "value": "1b494dcf3cfc107bbae5ede95c4edddeec91908f538d3dded60a37b0be675326f6ef2853e3e7e29c4262d16fd930b0e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125304, "uuid": "3101f921-a2f4-463c-90ac-f0c27f74ffe0", "value": "T1AA533AC8E947E6F5DD0B4C780057F23F4F31A265C568EDD6CF9A1E06EC93861900A7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125304, "uuid": "0716c016-8b03-41bf-a732-f505164ded92", "value": "1536:uBEdkpH8KkZmeXqQ2aPC7aKMTc+s+rUQhj931k5XH1O:C3pcKkZmeXu/aKMXxhjfcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125304, "uuid": "26c7df28-56ea-43cf-9794-73a4f7bce9fc", "value": 64260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125304, "uuid": "d85c1896-0923-4e8f-95d1-46cb9177e494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125304, "uuid": "12a7dd83-8ac1-42b1-8748-b3432bd29ad3", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df527898-2eb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775147262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147262, "uuid": "69686b45-d36b-4565-b7b4-c727628cf896", "comment": "Malware payload (Mirai)", "value": "ce601e9b18aefde1768e98c745732200", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147262, "uuid": "dd172455-dd45-41f3-8844-ab8915dcc315", "comment": "Malware payload (Mirai)", "value": "81311e5997d5614d70b47b6ff730f1242582da0bc50975348878564c280a9530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147262, "uuid": "d51fbd1d-b572-4bce-8d4b-fe2df024644a", "comment": "Malware payload (Mirai)", "value": "b55a489536caad3cb635bb7523255e876f15fc55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147262, "uuid": "38ff772a-320c-4b96-a168-3a021be27488", "comment": "Malware payload (Mirai)", "value": "eee2bf410b58b735ec49a40f7a29aeeea7163970fdca08e3275d8d77d91216eaaf2c094bd3b4f0a2b1efedc17b5ae9e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147262, "uuid": "f6f66f9b-c397-4bc7-b4b6-0c3bb4be7a48", "value": "T1FBD31945F8909F13C6C612BBFB4E428D7B2A17A8D3EA72039D156F21378B55B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147262, "uuid": "db2ac2fc-58f7-4cc8-a462-68303165bf18", "value": "1536:8IJWGvKDkvbnxfMvh7erd7jsuCIi9nd1pf4Vvt7HFB3HDGWwtk2HQUHl2nwywsAs:8DkvbtkerBjLCIi9l4rRB3HOnwW3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775147262, "uuid": "df599f8f-8413-4a3b-8728-d40802cfdb02", "value": 133932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775147262, "uuid": "1efa3201-bbf0-4012-aa5b-869d2813fc96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147262, "uuid": "31c22d6a-3ab1-45c6-9fb3-d51594817a44", "value": "avahi-deamon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9ef874-2eaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775146690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146690, "uuid": "fcd6bd0c-b091-406d-8a50-acc8477f7e8f", "comment": "Malware payload", "value": "02841ab62fd46bb65966991569c157db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146690, "uuid": "86bc0a60-f646-4e23-a15a-1baee2ce7890", "comment": "Malware payload", "value": "8194de3dd9492cc9b096a3d03de521da61f7dc935a38960e1040e6cfc32a0e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146690, "uuid": "28482bc8-4951-4ba7-9c69-fda5c35781c7", "comment": "Malware payload", "value": "18681912700b09869c6d241f7b08f397ba53e3d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146690, "uuid": "dd614d24-958b-42da-9756-f880fc67d64b", "comment": "Malware payload", "value": "e63c0912a515695fe080688f13dcbf23eb5affabf465d982a77a9100a1b0f3eab62b959b39ff3a67af632f2836d43479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146690, "uuid": "dbd019df-2379-47ca-905a-89a93ab27c69", "value": "T1AAF2E8A2A7B9573BC0E0633855B22703359A6FE114A0C34FBD550D5E6FD6390AA27BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146690, "uuid": "97fc7d75-b6e6-43e4-8dff-9b68a8fa0641", "value": "768:o2P/smyj0oEgAwJ3ySPwjCGvk2gRMRWVJH4TwMIZemnhr://sRjwgAw3ySPsRW6uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775146690, "uuid": "84e5e72d-c2e3-4bbf-a1a3-ca399b37a9e3", "value": 35908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775146690, "uuid": "7eeb00e7-ae93-477d-8d82-73d4069b8bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146690, "uuid": "d9b235ca-201a-41b6-8eb2-0d73aecf910c", "value": "attd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25884e35-2e6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775119033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775119033, "uuid": "64076435-416c-4c36-86d8-017edbb9f4ba", "comment": "Malware payload", "value": "2a9de0140d090054c6e525e37bbfb9cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775119033, "uuid": "149a73ee-ab9d-4668-88a0-064582ee83af", "comment": "Malware payload", "value": "81f2b17e9a5ff6aeaa3fdee584c3b60698c2b9960c8b06a33bb50569f05745ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775119033, "uuid": "79bb2c60-7501-4220-8e27-d603125ac374", "comment": "Malware payload", "value": "b1dedfbb225fc333ec965533c185cf5d9f522afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775119033, "uuid": "1514cc74-bcd1-443f-9b3c-9f34d5d77855", "comment": "Malware payload", "value": "78a5d8eb9aa65a9c02ec34217691f3b02aaa97eebfb0ae05cdf108a91370308c9bbdcdd2ff336e450f01e5a425054266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775119033, "uuid": "2011c1cb-5a47-46bc-9f70-3929eed38d29", "value": "T1BCD73333DB1D6C72F0EED83AA9EE55B10569B83C9ADD6027DEBC251E641044A82F05CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775119033, "uuid": "8855f43f-5884-4305-be41-7c4b80e607eb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775119033, "uuid": "c03f3db9-2b28-48fe-b68a-9c4acff7fab1", "value": "1572864:TWDVf2pdJT7ar7bWLB9aSBcbGxrdN1oGVj77:T2VfIia37nKGt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775119033, "uuid": "8c544fa6-a71f-41b4-aae1-a5534b08f01a", "value": 59973413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775119033, "uuid": "4233b70d-d4aa-49f7-a3a2-1bc86ca5b1ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775119033, "uuid": "c6414c6b-a3e1-4d38-8301-f2e0a6987744", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6b9db5-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095825, "uuid": "46a601bd-0b59-44a7-aad7-2bc2458c2193", "comment": "Malware payload (Mirai)", "value": "87282b88559b834feb58d0ab90e07a77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095825, "uuid": "3f4e6c6c-8177-4847-8d07-40e04480f32b", "comment": "Malware payload (Mirai)", "value": "821367d17c3c39749516508534078680561b68bf156b82226b3dba555bc53caa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095825, "uuid": "a5f3279d-ac69-4bb0-a4d0-58fb74a66e6b", "comment": "Malware payload (Mirai)", "value": "7c18f1a346c8a1e2784b2c26c44ffe0d8ca95077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095825, "uuid": "1743b2a5-8390-4642-9e05-b3c77ce33cb0", "comment": "Malware payload (Mirai)", "value": "bc2aec08be710af82b1d0e407d9a3ae9a4f3df565a87e740b65e261753c9e7bca85d9b474c6ae5fb906c0c76ecf95b8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095825, "uuid": "410485a1-bf24-4246-ab3c-36219c05f92a", "value": "T144E30B46F8814B12D5D111BAFE1E528E37131BB8E2DF73029D246F647B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095825, "uuid": "e555ad11-b262-4a74-aeec-4a7a12f5c77c", "value": "3072:DHea4CTDUjnwJIXMb6kzz5aTHACdYV8P4eLU:zePCTDQ6IXu7zdaM38P4eLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095825, "uuid": "1562a36a-8faf-472a-91bf-b0d24726be0a", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095825, "uuid": "d8a05c5a-64ca-422b-a2ac-cc357d61ada9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095825, "uuid": "61ba96ca-1a44-429c-9af0-4020538d6f85", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f579265-2e73-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775120713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120713, "uuid": "9fc670da-22eb-454c-9a10-be72ed73f9ea", "comment": "Malware payload (AsyncRAT)", "value": "0d8e68f174a8ce61004640062808ac22", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120713, "uuid": "cbc9596f-35fa-4775-b3c5-80f3c7c6b054", "comment": "Malware payload (AsyncRAT)", "value": "8289c8db41f3396a4353a982e715bba0a2d8b272b5d915f2462ac0578847d76a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120713, "uuid": "f4aef339-31fb-4ed6-a902-ee7d4a79ed4f", "comment": "Malware payload (AsyncRAT)", "value": "0b4601829ed985516317d183f8bc9b918f07e602", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120713, "uuid": "d6d816f0-f001-425b-a710-9a420dd554b1", "comment": "Malware payload (AsyncRAT)", "value": "7aebd38fb898ca3acc079cbe1707c3a6b3ffb2c1667db354c4df94f5f67ebb625b04c1375a9ca4a98c415fc685a00b56", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120713, "uuid": "16837769-b88a-42b2-9563-73ee6fa80360", "value": "T10363F8053BE9811AF3BE8F7068F6658546FAF5AF6902C55D1CC850CA0632BC29941FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120713, "uuid": "d6a7cf27-6541-4e07-920c-9aa57da9558e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120713, "uuid": "42a5d34f-e0ee-4d4f-b595-ca94e0d92dcd", "value": "1536:r2wukvF1ak9gcKu5UYFW1Xk8dXdNekb2xziIrOqGYFqNrmTGZx:r2dkvF1ak9Ku5UYFK7ekb2xz3GEax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775120713, "uuid": "ff174a1e-83e5-4e2a-93f6-fba9d12c5135", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775120713, "uuid": "ab3d0396-10d6-4dca-a2d7-bea6e4067d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120713, "uuid": "d32abb2f-bd96-4e59-94b7-4cd4b543bab1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2dab0ac-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125390, "uuid": "900e1691-651a-4962-a113-b654eda6ca66", "comment": "Malware payload (Mirai)", "value": "27eae7f5f1a3ba47a20495e314b07178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125390, "uuid": "ca3294a6-eda1-4500-ba6e-56544504f5ab", "comment": "Malware payload (Mirai)", "value": "867f65c80da50d56351e70941935ba9eace1550ab862d7b16817e701446b1c40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125390, "uuid": "00e6b2cb-abb1-40e2-8335-4a6f4b55340f", "comment": "Malware payload (Mirai)", "value": "84572add9e146cc2cdf3057d7d45014622accef5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125390, "uuid": "e75e4303-1f15-469a-8cca-34b796f701b2", "comment": "Malware payload (Mirai)", "value": "09d56003ee5febac9cf642ccef504f2e0010a403206081f607c40c8cd6e0ebd1e1e656cfab27d67612cc17c210fc73cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125390, "uuid": "f4d8ab86-1bab-4141-8a89-06e844fee628", "value": "T158433D96FC924569C7C117BA771A978A336263A9C2CF7313CC0C0B5176C9A4F4E6BB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125390, "uuid": "20246bc5-17c4-479b-ad91-82c7d04c3472", "value": "768:cZVgcik7nohvan+Ybl8dGsf/eMZr5Ir9JKZ6n43767oM72F30nIz3:cZVgcikav67ekgecNIr9JKZ63o0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125390, "uuid": "2b3fe985-52b0-4331-9328-1e58a44d6f2b", "value": 55344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125390, "uuid": "a172aa50-9078-4880-ba06-38102b11b2f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125390, "uuid": "ff28a065-9072-433a-8c92-509bbaa03699", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55954af7-2eca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775158197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158197, "uuid": "84b0ab7c-e549-4a22-8796-355bcc7dc706", "comment": "Malware payload", "value": "39fc335bf154663e522d05a018d81f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158197, "uuid": "75ce613e-6991-4a78-b7f7-f8d8052824cc", "comment": "Malware payload", "value": "8bbb128612a98149a1ae752210ae24b807af7d9217b544fa6a4a0563a8b03b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158197, "uuid": "b515e9a6-e957-4f0d-bb10-0d0ab3e79e59", "comment": "Malware payload", "value": "70dd483323085c292eabdcbf9943940675b08562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158197, "uuid": "529f61d5-221f-496b-ad56-dbe95a004a4e", "comment": "Malware payload", "value": "82f3bcf639e487248928a9c5c698a28a1af72036db8e7f501d6816512af95e6368a2be6bc2d0ed9918e69475f43c1fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158197, "uuid": "393093bb-e0fb-4aef-ba34-abcbffdccc9c", "value": "T11DF733A85F1A7DF7D14670F6304614B1392D6E5322BDA2FD25FDD1F2BA250207A082BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158197, "uuid": "35625eda-7ce4-4fb0-8b96-194ce7399193", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158197, "uuid": "548d914c-d653-4895-84a1-b75985db36ba", "value": "1572864:4ejOYfGx3ljNbgaPP/Gs7JMgizAWvdAERHsEJ53a1n3L7:44qV13AxA2AOHbBa13L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775158197, "uuid": "b0072c4f-0c57-4002-aa5e-3d8576a64ba2", "value": 76928063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775158197, "uuid": "29c55c04-8cf4-40f2-b1ff-d4b6bf09bef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158197, "uuid": "541dd13e-ffb2-4102-b35c-32bed010db37", "value": "MinecraftLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fbe4c7-2eb8-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775150514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150514, "uuid": "6d99210a-faad-44b6-99e9-b5918bea4910", "comment": "Malware payload (LummaStealer)", "value": "530c92eb2e7b44fdf93eb24360037dc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150514, "uuid": "8f7ff984-825a-49e2-9046-3bc026aceac3", "comment": "Malware payload (LummaStealer)", "value": "8bde0f38b2eafbdbe2c33f4f7352029b2890e345cdcda3cc171e1e1246535814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150514, "uuid": "9f7ef114-1b6d-4e86-99be-7fb8455793d6", "comment": "Malware payload (LummaStealer)", "value": "017a46f01f0f3906922e9099e4645f79beb37020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775150514, "uuid": "e5493ce4-980b-4b33-9193-b2d5d7f4740d", "comment": "Malware payload (LummaStealer)", "value": "dbfdbceb2f8d4fa02788c28d73d0ed20213e1c18e92cd1d60d51a27adf64241995320e7107e35ec8df0f4f7c263ce761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150514, "uuid": "65eba868-74e9-4081-9a62-055982d7056a", "value": "T150E528D2BA0571DFD48A0776D067DE52DD6D43B94B2088C7E819A4BEAD63CC212B7C2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150514, "uuid": "18e68fe6-3f2b-4f51-887d-fcccff4eb874", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150514, "uuid": "40c8bd6f-b827-4857-929b-939a0fbefa5a", "value": "24576:2C7tmUn1FCG+1NrfR7fA68CWur1CKTRGCS078/sZsOCbTO3TAIetTXDL2Fi78maF:I3G0NTx/FuHbujMtTXD78D/6Iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775150514, "uuid": "f47d1f36-27b9-4794-8f32-fbb207e4d48d", "value": 3118592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775150514, "uuid": "dcc87671-2816-4f8a-999e-967a7a1e957d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775150514, "uuid": "b98a234f-071d-4adb-828e-2a328ae23d64", "value": "8bde0f38b2eafbdbe2c33f4f7352029b2890e345cdcda3cc171e1e1246535814.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40efa693-2eb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775149143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149143, "uuid": "221ca850-9ff8-4657-b03e-e6915fc417a2", "comment": "Malware payload", "value": "85025fc5863d558cd0d88cb2600db465", "object_relation": "md5", "Tag": [ { "name": "CJSOVAZ", "colour": "#C234E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149143, "uuid": "f4eab037-7e31-4cc9-873a-b1cab1cbf664", "comment": "Malware payload", "value": "8cea42f129b341c9bedf132cb14bf360a4fc596d336016381c655154d0819acb", "object_relation": "sha256", "Tag": [ { "name": "CJSOVAZ", "colour": "#C234E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149143, "uuid": "928a082e-f0e6-4f9e-9440-b3ffd4696465", "comment": "Malware payload", "value": "180945008a3cb97d181acaa700863fa9f44e0fd0", "object_relation": "sha1", "Tag": [ { "name": "CJSOVAZ", "colour": "#C234E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149143, "uuid": "d89972fe-fbd7-48a1-8b9b-38886fccfd5a", "comment": "Malware payload", "value": "b1562e13ab399678a528613d706b9e4e0e4cd79ee533fde35934479b0c50b8561c380271961cc860fb0907014e40a4d6", "object_relation": "sha3-384", "Tag": [ { "name": "CJSOVAZ", "colour": "#C234E8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149143, "uuid": "37029c1f-15c9-4e69-994e-817d97da664f", "value": "T1BE463344634518F9E4B3113D8A938A48CA737DA24F91D3DF57A893390F735E1A8BAF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149143, "uuid": "be38ad89-d084-4a73-ad42-75db23411234", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149143, "uuid": "2aa13de0-965b-49eb-95af-5fb3eccd0157", "value": "98304:nvYJ1KIkJ298dpzoLLJ3TbwaVvrZE0I7yoFQK15W8ASLmbNYJERw1jrTHtz:nQyIksu9onJ5hrZEnyiU8AdZYJERurTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775149143, "uuid": "6886ae97-a880-4059-ae06-d81a11ac9abe", "value": 5382570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775149143, "uuid": "f4a43cf4-0ee1-4e8b-911e-f4119ff52e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149143, "uuid": "d8f33598-46f9-4d46-8211-2c7b2b99ed07", "value": "Exemple.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4efb039-2eb1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775147647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147647, "uuid": "2f43f2a6-9184-4005-be14-ad9f30fa2add", "comment": "Malware payload (AgentTesla)", "value": "41939b8b58a2396e1270d7b84f704061", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147647, "uuid": "735ff001-05ef-46c5-a4e9-dbc0a5cec5a7", "comment": "Malware payload (AgentTesla)", "value": "8d7252df516b2151ac14532a7baf6ffc3eb745f33b8f247b593eb0172ec8f971", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147647, "uuid": "fc3eefcb-d1ea-4036-9599-bb6f67b7daf2", "comment": "Malware payload (AgentTesla)", "value": "ca160625d9d8e257352fef9fb976d24efbe753a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147647, "uuid": "79e5a0fe-09df-46aa-b0d5-d0aae0e5f78e", "comment": "Malware payload (AgentTesla)", "value": "ec80b8ba742e258924b6b9664bd7437237930e0420b2336e0fd8ee5e419fccadd919b3b1f4a44f5d3588a81fb2a7e701", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147647, "uuid": "3e80de8e-bc45-49a1-993b-c1bee83099ba", "value": "T17907221777E846DCD0BB95788A62E686E272B8851B62D7CF02B0425C1F57BD00E7B3D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147647, "uuid": "62658150-38b2-4ba5-bb28-7d926ee5e934", "value": "52116ad7590323e0679679c8f9bba28d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147647, "uuid": "e8b1fd0c-16f2-4d10-b476-0dd39791b4ec", "value": "393216:y/v0kqosu4NIm9zyS4JCAp8tZw8ERIEUsfPjSDNWCky+21:BzySG8tFOP2DNWCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775147647, "uuid": "ce8442a8-fc53-40eb-86b7-4a52c2f2aaa8", "value": 17579008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775147647, "uuid": "7f8a0c34-2466-41a4-91bf-14d1b5f45481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147647, "uuid": "e57f88ea-e160-4b8d-a745-6aea995451cb", "value": "AAServicesTemp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e87dc7-2e58-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775109294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109294, "uuid": "dc375bf0-4fdb-47d4-a28a-52417469e116", "comment": "Malware payload", "value": "6ddb8c29672e66b9b1e47646bca560b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109294, "uuid": "b8972aa0-1049-4f96-9db6-ea73447440e4", "comment": "Malware payload", "value": "8e8bbab35467e6e1043eafde81780944ff43ceeaa9cbd2d22f845404987e77ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109294, "uuid": "0f8d0139-a3cf-48de-a81b-dbd48b39e314", "comment": "Malware payload", "value": "425962e5cee6e061f97d65f3e389dcfa1a2f51e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109294, "uuid": "ce03f073-154a-4fb4-873b-32e797d00c72", "comment": "Malware payload", "value": "d2dbadedb3370ee95bf5797098350369c63fcc8ccef58875163b630ca7222822a5fda9f58ae5446fb264a849402916c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109294, "uuid": "d2889cba-4782-4143-ad78-8b4032389f78", "value": "T11A621A4BFB600DE6D879C130C8A33D1AD5B2B7580672934F93609A0E0EB3760BB69F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109294, "uuid": "94d139eb-2719-45f6-8368-9ed1c5d79620", "value": "0392e24bff5aee33957c04db966d003a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109294, "uuid": "3a1f1d59-6040-4b0a-bf90-192503666eb1", "value": "192:nEh69sjAt7tjn/+PxSgCwlR3Oj0z6jqjCLFQ:Eb0td/+awfz6jqj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109294, "uuid": "e1150ae0-2887-4db7-bb93-ded3d35d7d20", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109294, "uuid": "3a49b3c1-e1af-4214-a604-c2f09eb099aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109294, "uuid": "49fd5a22-71de-4d00-8d3a-da1d341f9301", "value": "gmodule-2.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fddc3dc-2e84-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1775128150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128150, "uuid": "18216a23-3596-400c-b4bb-c41491f89aa4", "comment": "Malware payload (CobaltStrike)", "value": "ab2f2eca69c70410a6fc3a1edd3d02ac", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128150, "uuid": "6df438e7-99cf-4019-9803-8125894b21a6", "comment": "Malware payload (CobaltStrike)", "value": "8edeadbfe641a0d4c1f190f3fb050125f92c5c9d65b0cc588bc0f0c5795c72cd", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128150, "uuid": "62a5d96c-5972-4524-9dab-1a2f6558f1fc", "comment": "Malware payload (CobaltStrike)", "value": "9a3acd6cbee1310f0c3ecf9e3c700623b466eb9b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128150, "uuid": "762a45ae-8501-47f7-afe0-e0db6d56221d", "comment": "Malware payload (CobaltStrike)", "value": "2bec070115c21a8817c221fd7af20cddbb5bc3fcd631b90de6e61066ad2f5f342603b7c142629f1e5d655ffce98834f4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128150, "uuid": "b8854003-c2b3-438c-b0f4-58c2956bde75", "value": "T11FE4024B7B9320FCC65BC13C81D7A673B532F8640230BD3E5A50E6326E75D506B6A768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128150, "uuid": "18083599-b89a-42da-ae6d-537e9a8439f8", "value": "ed43b55c3ed5e850ecdd9d754a5be835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128150, "uuid": "d3233a88-3272-46d2-858e-a7a6aa5208db", "value": "12288:/uuwtBU8mlqEU5p/qXGdQeW7+FyjJcZhq5BJcE89Y9nc5urYsadr:5wtB7mLU5pi2dQFqFyjXvcX9Y+5urmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775128150, "uuid": "486bcc3b-398b-47ed-b3f3-50c1f4d9195e", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775128150, "uuid": "0686b801-c2b1-492a-ad8a-cc8e14fa8c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128150, "uuid": "5b89a6ea-f244-4ec6-b355-83d0e7cd8093", "value": "2_XyRFgISTZJpo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b330637f-2ec8-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775157495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775157495, "uuid": "2a28506d-73b0-4f94-b6d9-f98b967ccd02", "comment": "Malware payload (LummaStealer)", "value": "168c16e462ebe376000da7991a9b8207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775157495, "uuid": "ebf95c0d-370b-4341-9fb8-2ef50277fbf8", "comment": "Malware payload (LummaStealer)", "value": "8ef463592cbf5e37d83f9bdfa74feee4ba1722e6ef5a417c6976758b6c991747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775157495, "uuid": "6f19b62e-88d5-47af-8cbc-60d5777d7fe7", "comment": "Malware payload (LummaStealer)", "value": "d4fccfb6719596f9fcd8636ea188605f404f9032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775157495, "uuid": "b6c0c891-0d8c-4a4e-86f5-1e5b5c8088bb", "comment": "Malware payload (LummaStealer)", "value": "096ae6f7aeb5668c1d849fd97614df372e390a2bb904ee56afa8266863d7c74a993a2e08c70b148899b6da3974e05242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775157495, "uuid": "ec238c73-6ee6-4f3c-bf5c-d68a67f6662b", "value": "T1B8E55CA1B50961DFD48B26749027CE93985E93BB0B1049D3ED1DB87D7EE3CC912B6C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775157495, "uuid": "5c5d0f80-cfd6-40f2-aec4-d8f024d803c2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775157495, "uuid": "78c3cd7d-f182-40b0-beba-7db2df79d69b", "value": "49152:wl26/tkoxueY4W0CUPYVf6CaHc57xXE9u:GRkoxueRWtUibJxXE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775157495, "uuid": "a91a26d7-21da-42e4-8fc0-83fad63686d9", "value": 3141120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775157495, "uuid": "1ed2fcf6-7828-4d20-ba07-8f61855b97d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775157495, "uuid": "cdb5f81d-5d05-4ec2-b0d6-64242ea564f3", "value": "8ef463592cbf5e37d83f9bdfa74feee4ba1722e6ef5a417c6976758b6c991747.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1055be9b-2e32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775092798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775092798, "uuid": "bb587e2f-97e1-4558-adf3-6171c6f56fbf", "comment": "Malware payload", "value": "849e091d2092445f9b7f2bc83e28be5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775092798, "uuid": "c196370c-bbd4-47e7-8d6b-413ed34e0ca2", "comment": "Malware payload", "value": "8eff5e25a365f6cedc964b8629cb26362aeaaba3d72fd85b9c3de9092e60f95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775092798, "uuid": "c19fe573-1bac-448c-b6a1-d3919f8e6e73", "comment": "Malware payload", "value": "821745f6adab96eed7ce121f3858d7d0cea24d51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775092798, "uuid": "634c33ca-23d4-4a94-90e5-c1448b111140", "comment": "Malware payload", "value": "ca13c1ff8fe734d16140b6a9318bd9a1106db4a7f455e0d5ad3bdce1364d8b06f26b2383bcd5386d037650c3f48fa986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775092798, "uuid": "5aa088a3-e1d1-487e-80f2-bf52e3198880", "value": "T1443633E8C2C99017DB203375D71E6CA46368993B763DBF407FB6286EED51C68224A41F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775092798, "uuid": "692cabf7-35e6-4399-abf6-8fc70b64f719", "value": "7a581b02a80214f3bed9e9d29736642d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775092798, "uuid": "11412adc-1aa7-46d7-a670-71da307700f3", "value": "98304:Gcl1qNBIhtQ8jy5gfua/zs8+lfN+GO3+ecXcLrueIKnEh0wN8B84K26hYtS5KBwX:GcHfQ8++fuEzs/lX9QKzgg0wQEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775092798, "uuid": "b1bb1526-8a28-4a7e-be56-e8289002f64e", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775092798, "uuid": "73297835-de38-4ada-955e-b293a193adb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775092798, "uuid": "3570e825-cd8a-4463-9bac-87c5eef7ca51", "value": "amp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2c70af-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153643, "uuid": "fa1ca90d-a116-4ae8-8486-253b5c002170", "comment": "Malware payload", "value": "a59d54f01ae0c2c54b252f992ccb79e3", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153643, "uuid": "5afc6e97-4fe3-4849-b607-bdc5da2da77b", "comment": "Malware payload", "value": "8f0aacc93b282b3910be2333edea3fa93eaff90d562366fc7bfb9d76533e73eb", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153643, "uuid": "3c052c20-3960-457e-8651-b975b7d818f8", "comment": "Malware payload", "value": "dcb914b3441b56da4f47d53ed808a170b35f0e05", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153643, "uuid": "d3030410-63ad-4e58-9013-0e6afa9663bf", "comment": "Malware payload", "value": "ec3a2cde2ddbf012c34749ee043c549a8ca2bb74ffb26dbd9e9d268bfe6899081062ff5577b8023f6cdcd70f4da73b87", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153643, "uuid": "cea1ef5d-874d-46d6-b055-af591babfa90", "value": "T1CC03F1EBE8D7A114FA228D302C4D64DB1E3C54282D4F07AD35EA5339945A793B743B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153643, "uuid": "dd8d2993-ba35-4166-a43d-1265cec67403", "value": "768:IAwl4c3mNkE5SEofIJhfMnj+hV6pRKO31Z7f6CIGxlv7sRZ4Y7:IAwl4cWNkE5pfMjIV6pRKO31Z7yK7sRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153643, "uuid": "c89fd394-770e-455c-b058-31b0055b75ba", "value": 40360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153643, "uuid": "7cca7da6-ae69-44e0-8fe1-abcaed1a8ccd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153643, "uuid": "b9371bfe-4ac1-49ae-ba51-42dd1f1f7c17", "value": "8f0aacc93b282b3910be2333edea3fa93eaff90d562366fc7bfb9d76533e73eb.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205f6e83-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095831, "uuid": "c4eb5685-0783-4c56-9de2-3f612c93b7a3", "comment": "Malware payload (Mirai)", "value": "7c24e612ffe685952062459a541b36fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095831, "uuid": "93b14f88-aea5-4585-b4d5-9b4b4f340148", "comment": "Malware payload (Mirai)", "value": "9038666d4d8453c9ff139103ff6ab135183c4154396db9b3e5c60700cba168a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095831, "uuid": "811a7805-2917-4160-9f80-039d5823c873", "comment": "Malware payload (Mirai)", "value": "2a318a9f7df905e036bc3e609959cead4be22c39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095831, "uuid": "1e882465-fc81-43b9-aed5-db9e54b21961", "comment": "Malware payload (Mirai)", "value": "cad48f2b8c2e5fccbb82acdcd2feef07922eee0dc12c2ee14d32e155f3fa8e5627d35bc9c87c7619b66d50d4e17558e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095831, "uuid": "a4605d0a-68bd-4e99-b380-4d124a77a220", "value": "T120D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095831, "uuid": "7f48d326-63c1-4fd1-9bf4-4d00ba3a046d", "value": "1536:UFKdzElm18uZJNb4AdFa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTa:UFKp50yU8e947Lb71izSftBdRalKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095831, "uuid": "fdaff5de-6938-4abe-93d9-f7ecfd76ff56", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095831, "uuid": "c24c460e-c69e-4702-9000-c610207470a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095831, "uuid": "b10db61a-14d2-410d-93e2-4d682b26c07c", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14c7959-2eac-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775145574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145574, "uuid": "54f862d5-2656-4ae9-86db-f77ab8a0708c", "comment": "Malware payload (AsyncRAT)", "value": "91be8f2b8ac1bb33407471ac19ec76cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145574, "uuid": "7961a611-91be-4c01-a464-4aa97badca69", "comment": "Malware payload (AsyncRAT)", "value": "909a9da9a1f47e503c348d59216494ade8d1fed8fd97e1435be1b0f98e156835", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145574, "uuid": "387f81f8-7fdd-41ed-bce3-824f8d14e075", "comment": "Malware payload (AsyncRAT)", "value": "d187de5acac296d4fae493ae1d6dd59d60dd053e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145574, "uuid": "6c8b18b3-1189-4548-af11-78d40ec95499", "comment": "Malware payload (AsyncRAT)", "value": "16b4a3714a1a29bbcbbf2ac777379801ce81104deb56aa3b62a24ffad5678806670a62843dd09e43e9bb9ac35e571238", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145574, "uuid": "c7d26465-a562-4b33-9995-4623e3508b0f", "value": "T13154AD1174C0C472D8B6103545F9DBBA9A3D75300B649CDFA7C42BBA9E302D1AB36B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145574, "uuid": "f5da1952-268d-4162-8c53-2a07b157780d", "value": "266756be1bed0cb27666e233ae9063b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145574, "uuid": "b92cb1c8-6efa-408f-b218-12811cd805db", "value": "6144:2FxWrV9tpp1HGEwAsl+XL/axhj+D6ohMoyygN:2FxWrV9tpPHGuLiR+WcMUgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775145574, "uuid": "cf32a438-644b-48da-8756-b1099f11608d", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775145574, "uuid": "2e55362a-e254-4285-abe3-38cc223dc313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145574, "uuid": "6e816616-7f4b-47a4-afb4-59750c3f0336", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35aaf709-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095867, "uuid": "83baa07c-a901-4667-bdfe-c0fbe2ead918", "comment": "Malware payload (Mirai)", "value": "33f0b601ba62598647fe96af9aaa2086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095867, "uuid": "18fca4c9-0602-4064-8548-b297f5173c72", "comment": "Malware payload (Mirai)", "value": "919617505b2c7c72e4e3cccfe1fdcd0bcc52e441ef7fdf95a74dfcfd78838abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095867, "uuid": "12d2998f-95ff-49b6-8529-05251b0d458e", "comment": "Malware payload (Mirai)", "value": "89f865fc3ba511e22d3a7380b99b7fe7600fe288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095867, "uuid": "b5fc8eae-dad5-4e64-81d2-8fbba99da89f", "comment": "Malware payload (Mirai)", "value": "ff05962ab7ff0eea5a121a918aefd7234382093a7f7ae19e8e7dd5ea8c1e6dacf9b4fffb2c057178f687b690a9ddc790", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095867, "uuid": "c63ded39-d4cb-43a9-8731-6f38fb9955a8", "value": "T1CAD32A06730C0A47D2632EB03A3F67D197AF9AC121E4F640355FAB8A95B1E335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095867, "uuid": "57815740-980c-4828-9269-7bbdef1efb0d", "value": "1536:troGHNTUZNHlIBUiCxfytmtewMDNna/w4o7lbEJvAhh3rp+JuQfqAg87O3p:3mWUiCxttqCwZ7lLhrIS3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095867, "uuid": "c216b593-3659-42ed-8255-f4e2dbe5c2fd", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095867, "uuid": "ee8706cf-1547-4a1f-bc9c-e526925bd5d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095867, "uuid": "2f852469-38f4-4805-8a29-aea93f7fd2fd", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6279f42-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125342, "uuid": "cd9dd0c9-bd59-46dd-bc20-0c631d2d3445", "comment": "Malware payload (Mirai)", "value": "924962907481c24046f5aedd5aa08286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125342, "uuid": "5c34076c-005c-489b-80e5-17efee896241", "comment": "Malware payload (Mirai)", "value": "91ffec6d9e24ed26bb502c531f1ac24035eeb11997ba13c960d45dcac465c32a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125342, "uuid": "072ecfb6-cdda-422f-bb66-963a35e4f2fe", "comment": "Malware payload (Mirai)", "value": "0771c167890c5da73e5ef8a71299681689368907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125342, "uuid": "a3c89169-b00c-429c-9095-ce65276de2be", "comment": "Malware payload (Mirai)", "value": "9f7b18640126875d87007311a4275897e1bd579793dc6fa4a2e0c814d08c80c94f3e65d5e7f98be4f0c9908fc04d6934", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125342, "uuid": "b6df9c4e-870c-44f1-80c3-2dac4da91c57", "value": "T1D6436CB6D82C5FD8C4086DF4A9788F7C1B73F10A80932EB26B46C5A9148BD9CF544BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125342, "uuid": "7946b308-7dd3-42a3-a538-ad7906322ed5", "value": "768:sXb6IdwbDXq5AkfRxe6FJUgxtHPUuqgRq7T9:sXRibzq5AkTJxtHPDqgRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125342, "uuid": "b1f86030-37e2-4754-a69a-a9446a78e829", "value": 58808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125342, "uuid": "1beee67e-39c2-4884-99bc-4d78599628cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125342, "uuid": "66d31d7d-fa2d-4fd5-9114-8fd67cba35c6", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e596adc3-2eb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775147272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147272, "uuid": "f88c1971-5503-47d0-821c-61aea3887245", "comment": "Malware payload (Mirai)", "value": "e79cdaf65df2e3349ac418c467d36916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147272, "uuid": "0cda72bb-bb5a-45a8-a380-c246e53ec611", "comment": "Malware payload (Mirai)", "value": "9339cc4f2b1d6adf42c05512cc6f3ec26ed7c6303187b2aaa4f90e8ff7dddc40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147272, "uuid": "539a1fb5-fa46-4e3b-962f-7160bea85263", "comment": "Malware payload (Mirai)", "value": "76be988bbb31d2beaf720042e21d2b051cd77960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147272, "uuid": "9a95fdf2-5581-49ad-99b0-4b05d0fc6c54", "comment": "Malware payload (Mirai)", "value": "4ce45b0968092f3fb01f4746b466fcc77e4c1edbecf89322149010a167e7e2fac7ad6ad41fb2290158124e2e06231275", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147272, "uuid": "9c0632ab-8f35-4eb4-891c-34050e249855", "value": "T10CE319C7F900EEFAF80AE73744534909B130B7A149525A377257393AED3A0D85537E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147272, "uuid": "4e4b9b90-0141-475e-8036-b1e967499761", "value": "3072:jyEUQGp5Dt3MAsiRtPmNn8Bf0wUn8WNVajbixLEzERyDvMW:GxSARtPYnvwk8WpLEwyD0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775147272, "uuid": "543e3979-e5fc-4c56-aec5-a7587034353b", "value": 154444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775147272, "uuid": "4db090f9-a35f-44d2-ba7c-07ab54ed8fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147272, "uuid": "f2f1544d-432c-4eb8-93b7-4ad3c91f3cc3", "value": "acppid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4046fd-2ecf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775160541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160541, "uuid": "692efcd9-a759-4086-a90d-bd64c685c3b6", "comment": "Malware payload", "value": "e6c763f3ec3b1db437cdab29ad2a7ef5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160541, "uuid": "58fcbb35-2f14-4a88-972a-f1a6b19495a3", "comment": "Malware payload", "value": "93a3412e427dbe3690a625219166d9e494593cd600932dface8584b3efe2b9ad", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160541, "uuid": "3fa9bea6-53af-4196-b941-8c4048ea7354", "comment": "Malware payload", "value": "b3cd0844238793b0c8ed0b3a77a0a9a8003bdb41", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160541, "uuid": "334e452c-4e2d-4bb6-b4d9-0cd1107ac9f7", "comment": "Malware payload", "value": "a91eff376ec5ec4b1f9cbf8bb0415d3624224582d103648c0994984cc7999edf5d8e1bbe3c94278fb4573f46f15ea5f8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160541, "uuid": "7adcfc0e-9100-4ba7-9545-e8a3554fa4f8", "value": "T1F2823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0B686D1FC3314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160541, "uuid": "a9184504-026d-43cb-b815-3768ab22062a", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160541, "uuid": "6c9ec595-da88-49aa-b481-faa49e7f835f", "value": "384:vI78VGI2VxOwflsx0pu9NHRgqav8U9cl:AHdsx089na0UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775160541, "uuid": "e321e7b7-4afe-4ff6-bd85-35e6763341b8", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775160541, "uuid": "e7c7584c-2d3b-4c75-ab51-3bdcbb6accd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160541, "uuid": "a9575661-bafe-4311-8126-661f3b7ff055", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e6c7a2-2ed9-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775164593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164593, "uuid": "81c216ce-3bf6-4bb4-ac91-7db902bba236", "comment": "Malware payload (QuasarRAT)", "value": "6d9b59840baf06c4fb56c17c4d817579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164593, "uuid": "84b4bf80-8689-4993-9f65-54a41f37532c", "comment": "Malware payload (QuasarRAT)", "value": "9469c0ecb56d97235377a1ef66799767e5c437e1c933a070276468cf47d1228a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164593, "uuid": "2ade39c6-c882-4239-9853-92beab854e23", "comment": "Malware payload (QuasarRAT)", "value": "30af45e1e6ec90ea103505ad37f58787ac4188b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164593, "uuid": "231d6b6a-3f21-4f3b-8358-0c50901b5ba9", "comment": "Malware payload (QuasarRAT)", "value": "6002d4d0944e392aed49ce7007c0b364d4fbde04034e5bb6ac483f4ea280abc7caff366f088e737e18f7fd7803ea7227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164593, "uuid": "052994af-1485-4b1c-a653-2829d36def41", "value": "T1B4D4022037FD8247F1BF66B899F126016676F663B623EB4C184462FD4532341A9D33BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164593, "uuid": "db8b9c53-24fe-44d5-ac8a-483a914a237b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164593, "uuid": "c71ad669-3e18-4bc6-8406-422451ddda58", "value": "12288:MPRb9zoSjkqjVnl36ud0zR/6CtQ9PUHIG8Dl8gSD+37PWY1Y1+f7LfNxX3ho:MJ9pjkqjVnlqud+/2P+AlUDcPt1aKFxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775164593, "uuid": "60286613-a5a5-42b9-8c5f-777841741a2c", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775164593, "uuid": "d3ac5def-5257-4860-94fc-d43c0a1ec165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164593, "uuid": "b71c159d-3cef-4cbe-a17a-49ca90e4e8fb", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b73e47d-2ecb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775158690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158690, "uuid": "9348dad8-0bfa-41bf-b186-4e81e29173a5", "comment": "Malware payload", "value": "4e750573b94bf879f2c72046a1345533", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158690, "uuid": "1f9e301c-ec1d-4b51-a15e-bc7ad3667b3b", "comment": "Malware payload", "value": "94b755e6ccb233824a2797bfa93ee4a1f7eaf04d161e997f9c81a47f38a3629d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158690, "uuid": "33b02fee-e28c-4f37-b1f4-e28bb5c3aaaa", "comment": "Malware payload", "value": "188621fc05fabb98efe73763e96e6dff39c36fe6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158690, "uuid": "10c29c5d-c5a0-4fac-b485-a39b26480539", "comment": "Malware payload", "value": "ad8bbf92d3254a5caacdefe15229e27b190bf2592bba48a72281b7b83c150b616159589b623823a875f4980b1ca5c7a1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158690, "uuid": "6ce94a69-c66d-4aff-a59e-ee3bb3fd9323", "value": "T1BE823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158690, "uuid": "bc244600-c7d2-459c-bf74-85ed486a4187", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158690, "uuid": "aad993b2-f05b-417b-adc1-38e258f60d9f", "value": "384:mI78VGI2VxOwflsx0pu9NHRgqav8U9cv:PHdsx089na0UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775158690, "uuid": "3a26d536-844b-4329-974e-4faa7a085509", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775158690, "uuid": "a96ae46b-03db-4fa5-9b9c-5cff203fe87d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158690, "uuid": "5afd8117-78fb-4735-b558-be52781796bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a717cd1a-2eea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775172078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775172078, "uuid": "7e621d1f-fc44-4a64-ba39-f66bad810496", "comment": "Malware payload", "value": "53bd36304dbd5f9a579e055a78317d75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775172078, "uuid": "678113b3-8b7e-4204-bd50-9d713f545910", "comment": "Malware payload", "value": "94f02f4c2af27b6b131208ac26b9647a0df303c134eafa6d6dd7c499567f3116", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775172078, "uuid": "937786bd-45aa-4dbc-97d6-776812a3e95e", "comment": "Malware payload", "value": "f469df52cd1730134c1456f5b23716c060e39acb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775172078, "uuid": "0cbad0f0-b87a-4689-aedf-fc559e567ee3", "comment": "Malware payload", "value": "7b027e33133cc96adaf505040d8952327101c0363d76292f2f5eac6bd7cdcf8117d41cd9c2710a12a613e943194fb71e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false }, { "name": "TrojanDownloader", "colour": "#504DEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775172078, "uuid": "72b1f0fa-dc44-4e7d-890a-c8401381709f", "value": "T1C3366D817A8465E2F0DA183C06ADB279F1BDFE715D2623076210FB0E6DF12825B1AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775172078, "uuid": "a8e5b653-9c58-4433-8991-27feef3b36b6", "value": "efb56419c1ba206d8c70e3157d5c83a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775172078, "uuid": "6a60e896-583b-4ac3-a584-3071f22c6611", "value": "98304:MJTczGW8ke6KllNHsyBqGeQVrrNW2XkGMWr2FLOAkGkzdnEVomFHKnPtUdM6:eczGRGKLBZ/YGkGMWiFLOyomFHKnPgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775172078, "uuid": "1802f4a2-b83d-4da7-937b-2a0ca0b9a256", "value": 5127088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775172078, "uuid": "16932c15-ace3-4e43-b0ed-3bb33ee81b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775172078, "uuid": "318c1084-f872-4ef0-bf4a-13930c4f8950", "value": "mfc140u.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3f3583-2e5a-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775110164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110164, "uuid": "a643a251-12e0-46c1-860f-1af4eb3715a0", "comment": "Malware payload (VIPKeylogger)", "value": "d80b7603047d210ff552d785f164a5b1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110164, "uuid": "4aab7f9d-3f39-493e-876d-ac23a97c31bf", "comment": "Malware payload (VIPKeylogger)", "value": "953779109c84c5136c1e4430120482dde9983f5f35a9ab8ef3c72f0709556f25", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110164, "uuid": "edfbfeed-2802-4e74-b416-8fc470921689", "comment": "Malware payload (VIPKeylogger)", "value": "169496d79daccee8fc7361dabfdc82d189f66af9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110164, "uuid": "a3329452-8cb4-45e0-bc95-55a602e742ef", "comment": "Malware payload (VIPKeylogger)", "value": "3d558ac87813b1d61fd80ec7b8bb1c0aef4d22479cef0be87ae3f1119cd79608a6bebc5c9ddefce7d04f1da412581cbc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110164, "uuid": "3b40e719-c010-460e-b280-1d0905891972", "value": "T1B4530C91714018EB3F7619D96BCE1642762A485BC47EC302B2E50FDF83B5F907698E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110164, "uuid": "526fdade-aa32-44d4-bf8f-f91fc38da89f", "value": "384:Mku5Cyo925b4zRiVNN3s/MLZt537HCYmC+yYzqN+uorfCR/9SksV37WqOxaSsbmZ:BsbiB4RGujerkKbo3eDzNGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775110164, "uuid": "bf4b6ef8-da63-45b2-942b-2fec3248118f", "value": 62458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775110164, "uuid": "f3c030df-2063-4f3d-9df3-19f0175c0e8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110164, "uuid": "589f166e-747d-4146-950a-72a1aa17432f", "value": "Order_QOU3780_042026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0a1766-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125380, "uuid": "c831a11f-f02c-4cb1-b31c-f8c42de1273c", "comment": "Malware payload (Mirai)", "value": "964af313c2b05d19abbff4996c02866a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125380, "uuid": "e401c136-2136-4546-968d-b6725677da5b", "comment": "Malware payload (Mirai)", "value": "96287c6c40b8806dce675dc2d1773ddccbdd9e6709374bd6e48f4b9fe2ed0b27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125380, "uuid": "187478b1-bfc1-4120-b79c-ef7aa5ed2f91", "comment": "Malware payload (Mirai)", "value": "0afe616ab3d5bfae9fb87069b1ed6a44e825adeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125380, "uuid": "294e8b6d-5121-4656-880f-4a2f330b3b62", "comment": "Malware payload (Mirai)", "value": "17ccfe1ee526980d6c625a0485c5b80aded4dee6990ef661d78958a943c0d7fb6600d60aa4a6b0602639f7f68c9cb16a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125380, "uuid": "4ca32e37-733d-4401-9822-8f42bba63ac4", "value": "T1F3935D02B70C0E43D1675DF02A3F27D1D3EEA5E121F4FA88691F9A8591B2E325586FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125380, "uuid": "b6b09906-e7e1-42eb-a0a6-bccbe68697c2", "value": "1536:pcBZli/TwLrLXyUiQI0tdpDjnPqGD0M39+KBAnKE0BJWtMGXyC/T0QLlfB15:2Li/T+hPbTpAnWiMNC9d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125380, "uuid": "d009d964-e9e9-42d6-91ae-e7f2a3657cf2", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125380, "uuid": "cf8f3538-dcb5-441a-a1de-cb4a4eb62cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125380, "uuid": "a4fbfb2b-76e5-4c66-8cb1-321fcd781e47", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64bf6a1-2ecf-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775160534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160534, "uuid": "6ffa8eb6-fe7d-4261-aef2-b655afecfa7d", "comment": "Malware payload (Phorpiex)", "value": "9cbd6ae126ef4df50719eba92bfd2d61", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160534, "uuid": "38c8d292-61ba-4d7f-b201-809fe3231869", "comment": "Malware payload (Phorpiex)", "value": "981006af72be89f4b18b8b870aa77ea10a46a9373b621f655ba4a3c37cbfada1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160534, "uuid": "41fba216-42ab-4470-860c-15dd8d35cab9", "comment": "Malware payload (Phorpiex)", "value": "02511e7563efd793c99761c1df7d6913e7d498e7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160534, "uuid": "36f933d5-823a-4164-a6d8-87e8088d1ea3", "comment": "Malware payload (Phorpiex)", "value": "2cddb0a47bdb974427e81a9e5fcd8267dba9c1c708b8a9075220af76676c32f04cb1699bf1293411d37588b805937691", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160534, "uuid": "51d2da5a-70f6-46d5-8491-32092e51f25d", "value": "T150823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AAD0A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160534, "uuid": "db534a9c-c477-4c9b-830f-50ffa1f6ae48", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160534, "uuid": "6dc75bf6-faad-4ec3-9e46-9b270c3e2c2a", "value": "384:mI78VGI2VxOwflsx0pu9NHRgqav8U9ci:PHdsx089na0U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775160534, "uuid": "5625c740-bf40-4232-8633-8949821d951c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775160534, "uuid": "6f5b7e07-74d3-4f25-90f0-3aeb80b0f8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160534, "uuid": "c8317816-9e66-42e6-8425-58d89c691422", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b63095-2e92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775134139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134139, "uuid": "56ea8149-42ef-4721-a1e1-e29ec6c56a04", "comment": "Malware payload", "value": "ab7e6e76ea30a31a67f6f143b954cd78", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134139, "uuid": "76a93405-33cf-433d-9c8d-19af569b779c", "comment": "Malware payload", "value": "9a5af44af5dcf614cecb9d6a14f1412e6e59355b980dd1c28325aa3c31de24a1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134139, "uuid": "deeccde7-6f7f-41d3-beeb-cc809e62529c", "comment": "Malware payload", "value": "bab8fb303867e70d32bcd193b2ff5782c08886aa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134139, "uuid": "484940cb-453d-4794-b7cf-08c698832e0f", "comment": "Malware payload", "value": "7e72b614c5ade129954528290e8175b20b6e1e376ef2163e5e4e56613a9f6dd2f706176a226a97dc44ddcdb419d14bb7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134139, "uuid": "2ef27c2e-7dfc-4cc4-b922-5dfba15529cd", "value": "T12E23F9FB609DAA05C9A74B6C0F18C985FF64C07B81805A174647267503BE3F57A8FBCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134139, "uuid": "f4616a84-15ae-4339-b04f-b1c97a3daafd", "value": "768:4VlIVEUJStsILkmIynC19xcE82gRm2Tpvs3Hu4nTE1:4b72HmIZpV52Tpvs/nQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775134139, "uuid": "a847c084-a8ba-43e0-a6d5-9d28c59de4bc", "value": 49184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775134139, "uuid": "481b4617-5b35-4bff-9359-c453db0011ae", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134139, "uuid": "683cab05-119e-4490-b95c-8e5208e91e51", "value": "voicemessage.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be79d4d1-2e67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775115853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775115853, "uuid": "c90146ba-502a-4310-a6ba-e1c38851ddc6", "comment": "Malware payload", "value": "c2c9efaadae271b2a625373068912c16", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775115853, "uuid": "418e2e31-64e6-496e-961b-c195cdc6e4fe", "comment": "Malware payload", "value": "9a935b4b167cbf82cc4d001be3846456ed65dc3fe4f9ffec84c46190f055eb05", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775115853, "uuid": "fd23440e-42f3-417b-b10d-e9963ce1ded1", "comment": "Malware payload", "value": "e66b54ad2175b4e928bf6fe6042f7fe200823dc8", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775115853, "uuid": "1d2cedf8-cc61-48af-8d3c-8aa45e06a787", "comment": "Malware payload", "value": "4f1c25777d40b72fbcc85f76ce8ca22bc787d4296bc9dbaec74b3f60a78e96fd368dd2b4384631331d58d0a212fdcb8c", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775115853, "uuid": "5bd184e4-d530-474c-9e82-df44bd2de5ad", "value": "T1EDC34A57B3A530F8E177C23989A14A05D7B2B8754B60AFEF03A046551F236D19E3DF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775115853, "uuid": "d080b800-0855-42ee-8387-4702b359083f", "value": "6dc70fc3ef954cb7adeefd73f61b2f91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775115853, "uuid": "c3f3e2ac-3887-4ee9-8f69-ad385498e981", "value": "3072:pRXotxTcDKp7iOwkrDoOLf5juGayjlaTgHCsl+bzii17:pFId5iZOLfpMgHCslgii9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775115853, "uuid": "db3d1d4f-3838-48a6-9202-10257eaadf55", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775115853, "uuid": "ddf2436b-90d7-40ae-a9d0-a1d32f5710eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775115853, "uuid": "3857c790-e2a1-47e0-8996-8168b606d247", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ad66fd-2eda-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775165335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165335, "uuid": "0e4fe67a-c3c0-42bd-9c1c-07078b898fa7", "comment": "Malware payload (Smoke Loader)", "value": "2cf8e266b09bd2f4010b7357616241e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165335, "uuid": "31a869b0-1c60-4370-a088-ab343163a012", "comment": "Malware payload (Smoke Loader)", "value": "9b2fa50d5f4813ac0b77e8573bf66cac02f74ca3a95ae5512013d1f765893942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165335, "uuid": "f45c213b-fe87-487a-a270-01aca0566f41", "comment": "Malware payload (Smoke Loader)", "value": "a6c33fa5270472b83ae0d1befca27992d9818bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775165335, "uuid": "c0322147-1f40-46b5-9a34-fe8747454658", "comment": "Malware payload (Smoke Loader)", "value": "2ae3946b0b9917a5e4303cdd57bd94c874154da74eb3c8f0efca671ead7b1448c3b1cb9324fe29629a8de919ce87e41b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165335, "uuid": "1b9c08f1-559a-4faa-9925-37b8d7da91a4", "value": "T11985120706D52862E6B11674C1E34396D332FC560F31669B2AC07CB8FD77AC96632B9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165335, "uuid": "9c222fb6-7ff7-4d88-bc97-a2bc68e72c14", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165335, "uuid": "36d50aaa-b809-439a-9931-be484f5f484a", "value": "49152:zawM5dOa4jE3G/5vpRz9cgufOfOCNVjJRz2+J:2JIoWogKcOCNVjLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775165335, "uuid": "d255ee59-f1fc-46d4-9d84-d158d737a77f", "value": 1733632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775165335, "uuid": "4d1fd1b4-3f98-4818-a1a3-ba6e64a848c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775165335, "uuid": "95c8e168-2cb9-4dba-8996-f43a4657ad5e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523fb5c0-2e83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775127698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127698, "uuid": "f3e12e93-b942-4524-be4a-628220663520", "comment": "Malware payload", "value": "bbe50f050c7fb4a833ef8ec48b59e5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127698, "uuid": "fdf96dec-1f3c-40f3-b42e-23b97ec9bfeb", "comment": "Malware payload", "value": "9cd82a50053ee9555d2b2dd68acd0a52d998bf6299cdd46554ee1a57770cf6fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127698, "uuid": "11ff5172-9985-4bf3-b19c-cc26801c4aeb", "comment": "Malware payload", "value": "d7cf3cf327a25b2cd507106cfda1b0ee587905a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127698, "uuid": "beb91e2a-1c92-4b54-8d6f-f91ebb6bfaf1", "comment": "Malware payload", "value": "cbb790f71fee839304e6c8fdccb6bd76c0ee0c53fe312045873a6a257efddb9affc61c05160b83a614daccdb16deedf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127698, "uuid": "f42aa782-a968-4ff8-ba5b-dcc53ac42b8d", "value": "T107058E582798AA6AD4EE0779D0205C5883F5EC26AA97D74B34BCB0FE2FB33514D01367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127698, "uuid": "a964eb38-d838-43b5-9505-fe055412e6d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127698, "uuid": "2f43b5e5-ec20-45fc-b96b-c34c0490ff1d", "value": "12288:Z+Xkj/J4t5zLFv3y1Q1eAfhddeD+u+IY1FW423I73kkeAwaZl3brY:HR4jtvKj423w3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127698, "uuid": "45ba1a99-b3c6-4dcb-85c9-03da37a83f11", "value": 827104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127698, "uuid": "d4ec5c05-fd70-4c52-a771-c10a69b0edfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127698, "uuid": "c674f266-7e65-41da-b785-f61bc3ac8903", "value": "driver-hub-install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892e67f8-2eb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775149694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149694, "uuid": "2e8a6f2e-4275-4c68-a2d2-c14ce8289d53", "comment": "Malware payload", "value": "7271c58f1254f8be13d74ec0dcd8aead", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149694, "uuid": "afecaab6-07f3-4dee-994e-426e680d605a", "comment": "Malware payload", "value": "9e2e9d9ed43545a8727d7b6772dd56b286de9b5536540650d299d50c51df0097", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149694, "uuid": "9632ada9-51c9-4854-85cd-bf472069d3d8", "comment": "Malware payload", "value": "ce90157bb776c4f22e040b4d8eea1ab4df399275", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149694, "uuid": "de75b272-3e4e-446c-8cf0-343c091e34ea", "comment": "Malware payload", "value": "2c884cbd2c0f12b063fe765cd6cf5190655107bed156e4b305452544125f68b666236cd5deb1fa0205dd6fd644b43aa2", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149694, "uuid": "dcaad5ff-6649-4954-80e1-b8b6d5e91398", "value": "T1637633A0675004E1EDAE853FC852C90EE6B4FC061794DE5793B8876A0F3376A1C7BB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149694, "uuid": "1ce92c0c-206d-421a-a594-209149151c61", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149694, "uuid": "edb8388e-0284-4879-93fb-78674dc3bb0a", "value": "196608:2Ya6eNQOFJMIDJAgsAGKOSElRp1xsolnTehT:kpFqyAgskWp1RTeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775149694, "uuid": "5097924f-cfdb-462b-9740-4040f44655ae", "value": 7776907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775149694, "uuid": "72b30466-fc10-449d-9274-696b645fb9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149694, "uuid": "90605308-d8c2-415f-ade0-767c87058cc3", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19502913-2e75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775121589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775121589, "uuid": "f364984e-c6d8-43d2-a97b-db755b4d1946", "comment": "Malware payload", "value": "20063941491e5727cb2cbf824c656294", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775121589, "uuid": "f020234a-d601-47f7-9cfc-a75b504045a3", "comment": "Malware payload", "value": "a059d70e4f9095f167bd34ea4dfdab33be8f599907daefbd05f2ba3f2d6302be", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775121589, "uuid": "ba061571-d6dd-42e8-aa69-34f1ed67a97d", "comment": "Malware payload", "value": "f99cf85b16f054713aedc017011803a45e3f3114", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775121589, "uuid": "8f52b472-4f6e-4c29-8e4d-f436e81acdbf", "comment": "Malware payload", "value": "271124b97f213ad39a9ac5a9d98a8945637f252608e02dc9002e026a6d0244d7a781c4a0fc0fc498db7de0085aca247e", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775121589, "uuid": "b56c13e8-b7ce-466d-a781-df4b2edaffe6", "value": "T1A6E4BE01FFA09135E16B167248D6B2710A3FBEB54BB089C7BB91071A4B302D5B9376F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775121589, "uuid": "22460ee6-90e3-4395-95b6-8bf4e7c1e85e", "value": "12288:wdIM5CKurUbWLD596+I9sRTSnwFJqs7rR04bqDY001b7undDG0:wdIM5CK4UbWLDolYMs3R04bCI1fui0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775121589, "uuid": "866047df-ab4d-43cd-8455-bbb45274057f", "value": 670992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775121589, "uuid": "0edfb513-1912-454c-89aa-1a7c01853667", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775121589, "uuid": "f16c5614-1e86-4345-a6a7-8bb685bb7b19", "value": "\u0415\u0421-\u0430\u0430\u0441 \u0425\u04e9\u043d\u0434\u04e9\u0436 \u0431\u043e\u043b\u0437\u043e\u0448\u0433\u04af\u0438\u0306 \u0430\u0441\u0443\u0443\u0434\u0430\u043b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffda528-2e3f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775098407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775098407, "uuid": "76271c81-4da1-48d0-ad8d-455a0e4fcf18", "comment": "Malware payload (AgentTesla)", "value": "6df388e9f6987af7e9e7e636a196491e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775098407, "uuid": "f87ad05c-f354-4797-9f50-f8cd2d58061b", "comment": "Malware payload (AgentTesla)", "value": "a0f64f3bb700ae9170efc662301196fe5d635dbbc72985164537a87602d6bf16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775098407, "uuid": "dc5ee1c0-9109-4912-9402-9a5fa5b401f0", "comment": "Malware payload (AgentTesla)", "value": "190eeddd325bf2c70f1d3ba69453de0eed29eb04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775098407, "uuid": "ad70343c-bd0c-4011-8f3e-3ee5d6ca9007", "comment": "Malware payload (AgentTesla)", "value": "f265534d6415000c59ef345b19102a1eae720c3ed565955a84c7420839985df987361978eb482041e1d0084ac5279033", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775098407, "uuid": "7dd376f9-2025-4f26-b0bf-d13ee27c6a9d", "value": "T10645F11576AADD03D4A62B7148F1D33447F5AD50E422C2076FE57EEFBA3AB822944383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775098407, "uuid": "a52ac8f8-64a7-4ca7-8877-3e69aa1b2d33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775098407, "uuid": "28cd5489-a8aa-4f9d-9322-288e457f6ab8", "value": "24576:gDhTSJJSHw3HoZk1/V69NPjxf28aufpH1kdSZvJ6Grld978XG:gxqUw3IZk1891V2wpH1kdSZvJdldyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775098407, "uuid": "30afd05b-aac5-43c3-a86e-e564a7477484", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775098407, "uuid": "2a7bd6ae-d0e7-4b9d-9cd2-cb0c098bd8fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775098407, "uuid": "8505f35f-fd78-4c14-a818-37dd6753ad67", "value": "NEW_MV_APIRADEE_NAREE_ORDER093475.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342b5f8e-2eb6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775149551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149551, "uuid": "7742df15-5e4e-45b2-943d-93cfb3355c5c", "comment": "Malware payload", "value": "e34a70009e9f0e3fa3695ced5c8bc32d", "object_relation": "md5", "Tag": [ { "name": "DelShad", "colour": "#6AA67C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149551, "uuid": "96e6c027-7e48-4c5e-a318-ccb53c51eccc", "comment": "Malware payload", "value": "a4f4382f361ea243b90e22e62036afbc81324fde48b33f9c8483ccc0f783de82", "object_relation": "sha256", "Tag": [ { "name": "DelShad", "colour": "#6AA67C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149551, "uuid": "f0fa00bb-ed40-4cf0-8c1d-0eb8f5cb9b2c", "comment": "Malware payload", "value": "8a903051395b67635dfa31a27f21b648f107b924", "object_relation": "sha1", "Tag": [ { "name": "DelShad", "colour": "#6AA67C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149551, "uuid": "0441168d-73b7-440d-8263-1c5df53e303c", "comment": "Malware payload", "value": "4dba6eb8e46ecf29407389528d8a3ada6ab22e7fb5329ee60a1ec55988553913d9bdcca959e8795b76c867049bc4fc98", "object_relation": "sha3-384", "Tag": [ { "name": "DelShad", "colour": "#6AA67C", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Egairtigado", "colour": "#3EC4ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149551, "uuid": "f7cb37b6-26d3-43c1-8731-1d03d3d187c4", "value": "T132168DE07506E2EFC14D0AB0E15ADD4789BC33F14739C863E9B938B9BF52C911689E64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149551, "uuid": "83c0c743-82bd-4e46-88a4-8ff6ee9cc0af", "value": "8cf60f8b80f8f97932f2a2a76393ff6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149551, "uuid": "e5214fa9-7b46-4e61-852b-606fbb8ab50a", "value": "98304:GIXP150XbYUMT6CSIViF13KsFwHtMFK6v0:GIXd50XFF5Kmd3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775149551, "uuid": "d4bad2c7-04c4-4f14-81a1-12bb6f270d10", "value": 4416528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775149551, "uuid": "427a8339-13f1-4f8f-a585-e87d897a02f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149551, "uuid": "0f105229-8dc2-4a81-aa92-18b1a82adc1e", "value": "ka.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d368656c-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125337, "uuid": "25e65fc8-1c32-4618-8e2a-e5d96d517ec3", "comment": "Malware payload (Mirai)", "value": "7c7143981bd8c9cc0b2138cd48da50f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125337, "uuid": "238db544-7708-4598-98d1-1793345d5820", "comment": "Malware payload (Mirai)", "value": "a64b89f5c5b128af2e9511b8884cef3d416baf44448e8afb286b2fc2a07cd5e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125337, "uuid": "82fc3740-7b6e-465d-a395-b5ec1af2c7c1", "comment": "Malware payload (Mirai)", "value": "1cd9c66aec163cd46b3d6512c5c1894c6920aad9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125337, "uuid": "5390148b-ae26-4dab-8fe4-d28e67248314", "comment": "Malware payload (Mirai)", "value": "bcf25481fcd8863ed73e01d85e100c00cb0a3d4ad2a51376afd9852508a804ddd6c87808eaa320869414ac726fa92988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125337, "uuid": "dcd4094e-44b4-4afd-b047-b8fc17f0dc33", "value": "T1D9935C42B70C0B43E0575DF03A3F57E1C3AA66A120F8FA89790EDA4596B2E325547ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125337, "uuid": "c9954fc9-4c60-4f77-82f6-9abcce71fcd9", "value": "1536:6hSlTzh8nuVu2NMq1B+z6Xls0kyb6d6TXNfGwT1nmIKGMX0l1WrFlfTAOFlZ:LKq1B5TXhGyKGMKWr39Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125337, "uuid": "604f6ab3-12ad-4f90-bdc8-52a4c6d0ddd5", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125337, "uuid": "1caf0b7b-739c-460c-86e5-3930d9d04e1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125337, "uuid": "e3518b9f-f57c-4af4-9c6b-53fe6ed09581", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ceae17e-2e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775137084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137084, "uuid": "c8afcc97-f438-4a23-bc56-8395bd0332f1", "comment": "Malware payload", "value": "21ee5b2218b26134491fc11b00ab8b02", "object_relation": "md5", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137084, "uuid": "3703ed93-4e73-4b77-9ba5-8ae4e7a859d9", "comment": "Malware payload", "value": "a6a2de606b094f7c4d35cd7cb02f5a512f72981110981fab2bf737ad52bc4506", "object_relation": "sha256", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137084, "uuid": "b1d54e79-9057-49b4-8452-914a3fa60d4e", "comment": "Malware payload", "value": "8f338a8480cd0dab5cade39a4b20e38a90f495da", "object_relation": "sha1", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137084, "uuid": "e3dac3f4-56c2-4234-9350-2362cebc1216", "comment": "Malware payload", "value": "0126564959e742924181d944b1530c2270690f61e1261555951778ea4009d41f848b8110b67ea0768e4f08ddfba5b0e2", "object_relation": "sha3-384", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137084, "uuid": "a5a60af0-eee6-4672-8403-57670b5d905c", "value": "T16BB092C016D292207451636BA96441A4B5B1854A0428F8E793078AEFB240AE5928E8ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137084, "uuid": "f707813e-9766-45a5-a2d1-c59e06fc22b3", "value": "3:lP/ErUUWKMs5E8vM4XJ18P53y0g7W7K4:lP/ErUAMs5ZvM4XJ2py0hK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775137084, "uuid": "cef6003a-ec97-4ef7-a18b-c543b44855c3", "value": 117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775137084, "uuid": "c4603f02-a477-4493-9f3e-41834bd036b4", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137084, "uuid": "5f89ff1c-91f3-4db3-baee-1c24af14899c", "value": "oa.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73ee874-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153637, "uuid": "f20d73a4-8168-4053-b979-a84e66937b4c", "comment": "Malware payload", "value": "5132eae6a65681006cabf5b4621c03a3", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153637, "uuid": "dfc3ab38-659d-4a2f-80c2-c97068eeaadb", "comment": "Malware payload", "value": "a87de00ece3af7a75561f28fc3ffacdbc95dbd61a3449a90b6d5867eded5ea89", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153637, "uuid": "97dc0159-74c5-4f4f-acf2-7ab3c96e3a15", "comment": "Malware payload", "value": "899c6fa2253af24e4ac4c1f72537188a4a7ecd42", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153637, "uuid": "23990636-fc0c-4bf3-9555-87920366f511", "comment": "Malware payload", "value": "8fa1fad501516c5eb903c8d12d4d0e35589b5d785208d1a021efb44a038017ea8f5fc4ba24803a9263e0bcddf33d532d", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153637, "uuid": "1282a307-1f26-4f3c-adae-d83731413169", "value": "T15D33F12CE8D4E8B5F51B7B75A2F3099274045600E142F223143DAD86B59663F2F8FB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153637, "uuid": "5b9d7295-dfd3-4ad3-8cb2-1b9708c28f7b", "value": "1536:MYOj5721xZvefYSGzFffeGkbZCC2Esi3Gh:MYo5aLgszFHrEZCof2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153637, "uuid": "60dda61c-1f0d-41f0-9b2d-798864a8614e", "value": 54607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153637, "uuid": "a05e8876-9d9c-48b3-873b-315490e879d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153637, "uuid": "04ce0e57-0f65-4091-898c-630e2aa96be8", "value": "a87de00ece3af7a75561f28fc3ffacdbc95dbd61a3449a90b6d5867eded5ea89.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076393cc-2e82-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775127142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127142, "uuid": "739bd000-001a-47c7-ad67-84c3e19c74f2", "comment": "Malware payload (Formbook)", "value": "28e4a1a3746b224b35e6986cd29bae94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127142, "uuid": "7157cfc1-8296-4ea5-a41b-0a0d57ed2283", "comment": "Malware payload (Formbook)", "value": "a8e8d4768f4c1a93922bca30e84501538f0fc4666fc1fe7db9cdd1d591781e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127142, "uuid": "3a259398-060d-47b9-94bd-0e16921214ea", "comment": "Malware payload (Formbook)", "value": "35e1be294cc590909f694ea95c55243ba24d352d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127142, "uuid": "058f9467-405f-4741-ab99-e04e77eefc32", "comment": "Malware payload (Formbook)", "value": "c2c3d030a01196f2b95c3abedc1d1427186bd62801b9ff178da9da1fe20e6373f31f7b11b4fd9d1a8b1be18655155771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127142, "uuid": "fa20687a-57ae-406f-b132-1903aeed1a21", "value": "T17645F10526ABED02D4B61BB148F0D37447B4AD94E023C3474EE57EDFBA3AB922945393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127142, "uuid": "8b4c8ed1-55bf-4741-8e48-286f2cfd599c", "value": "24576:0FO6SJJSHw9/Y2OjOs276wHyoF4wZyUs3m86jzNiXD9Qkv:gqUw9/Y2Xl6wHy+4wZyT28wUXD9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127142, "uuid": "dc7355a2-cf8f-4bb8-b494-b2d099af5b7d", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127142, "uuid": "f6d3b22d-b685-45f4-8983-a358f2f930fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127142, "uuid": "679a50b3-55ce-4834-a1bd-93c536caf2b4", "value": "New PO 1437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8660458-2ed0-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1775160994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160994, "uuid": "c914276d-3e44-4fbd-98b6-b0db2d5c6b54", "comment": "Malware payload (SyncroRMM)", "value": "bb732bd54a72126e7b6f1e56d39f8418", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160994, "uuid": "c36a13d2-c78f-478c-a998-39e7cb5a1cf6", "comment": "Malware payload (SyncroRMM)", "value": "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160994, "uuid": "59d80616-65b8-4b9b-b5e8-1523ef11e821", "comment": "Malware payload (SyncroRMM)", "value": "15e5a4e618993602cecdc721f8e7b5c49d88d0e3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160994, "uuid": "2a52f8f3-93fe-47ad-b217-07ec66f9f905", "comment": "Malware payload (SyncroRMM)", "value": "621ae54018954de8b90ceab699421748516ebd8e69791eb5e9cd7f082e79b917f567a32cdf737013e8ba85b5b0d88230", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160994, "uuid": "6eabe262-9c8e-4e63-b6dc-5f6ad17c9207", "value": "T112461204F7A5061DF066FAF62D61711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160994, "uuid": "ddd577b7-90c4-4e43-b8af-fa072217e38e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160994, "uuid": "1456edf0-93ef-44af-9b1e-3dcbfbcddce7", "value": "98304:Uh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIp:Uh/ev5eTeW90kSIbDoUcfOhzT9cEt72S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775160994, "uuid": "ad7d1298-0baa-4ec9-a83d-0e3ac2e75be1", "value": 5858848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775160994, "uuid": "8afa66b1-4a88-4c62-ac7e-752742584f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160994, "uuid": "97568b46-d6a7-43a2-b5f5-de2e34cf2d2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012256df-2e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125414, "uuid": "096df894-3deb-463e-a22a-77fb26b48bfc", "comment": "Malware payload (Mirai)", "value": "d05cf7f37d33ee9fa267e51ac11f37c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125414, "uuid": "509749e2-cf25-4efe-9da3-1bc7a430f557", "comment": "Malware payload (Mirai)", "value": "ae164e666d4752c40f28d0a75adf03cc16e9123ce965fd60d7267745405f76a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125414, "uuid": "c4a09670-9700-4f8e-8d90-9a5ca76466c9", "comment": "Malware payload (Mirai)", "value": "8ef63d615574bbcbebfc5766b690e39b5222f652", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125414, "uuid": "f6faab43-d230-4834-9bb4-449ed5ab1e42", "comment": "Malware payload (Mirai)", "value": "de07ee2728187c48cc4adaa630fa95062bb228bcd26d78b24f5bdcf9b654208ee31a3b3fdea55f308cebbf7bdb07ffe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125414, "uuid": "a5b3d870-d795-4a24-9ca1-90637bce54e9", "value": "T13283D70A6E218FACF799833087F74E21975C33A626E1C685D25CD9042EB474E641FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125414, "uuid": "54fda364-dbf1-4bc5-9aa7-7918a16de529", "value": "1536:Hyxqx2cPKBhhTCU47V0/tdtyj/zDL/ukaHu:Hy22uKBmUDtybBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125414, "uuid": "68164b99-2b41-46fa-ac83-23fd8d7cd560", "value": 84352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125414, "uuid": "7e742a97-85c3-4101-a263-619272de69cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125414, "uuid": "fcff6353-5b92-4649-b1b2-bfcb1ea55560", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c739bc-2e97-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1775136317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136317, "uuid": "af68b78e-05b0-4b58-ba46-4be99056be5b", "comment": "Malware payload (SyncroRMM)", "value": "f64a987c2bc789add8de39d51217a36b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136317, "uuid": "f5af8f5a-c4bc-42dc-afd4-0f90cb7d2c17", "comment": "Malware payload (SyncroRMM)", "value": "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136317, "uuid": "462c65cf-0d4f-4e08-8188-b3ad2dd8f4c3", "comment": "Malware payload (SyncroRMM)", "value": "9a8ed1c49d5b5f01ce30de429bc6dfe5fd59ebac", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136317, "uuid": "493e4a69-e38d-4338-b596-f5ff310f5586", "comment": "Malware payload (SyncroRMM)", "value": "077fe38601d4c31aceea6fb480aab080ed7453ddc3bbd613aaf2b3888288c8df2c2dfc3ad2ead137072cf88758365b9c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136317, "uuid": "8c6fc948-fb57-4282-b623-2d2d1d2f1333", "value": "T1B0461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136317, "uuid": "acbb6896-17b0-438d-9b36-379f28768e77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136317, "uuid": "d1fda5ad-ab44-4a8b-b41a-a3da926b8390", "value": "98304:uh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:uh/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775136317, "uuid": "4268c3ed-8424-416f-b1f5-65ed881c589d", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775136317, "uuid": "b3391161-5396-4742-80c7-a4feb2e1795c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136317, "uuid": "d16573d0-cbf1-4808-bffc-b6292b0541e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629c0a40-2e82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775127296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127296, "uuid": "ecca04a4-9efd-424a-ad7a-5073bdd06440", "comment": "Malware payload", "value": "ea249413be3680f4e2d41dcbf527de7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keitarocheat-con", "colour": "#3CAF51", "exportable": true, "hide_tag": false }, { "name": "playbergs-info", "colour": "#937AA3", "exportable": true, "hide_tag": false }, { "name": "TorgGrabber", "colour": "#27BB7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127296, "uuid": "2a47b62e-96a5-4288-8b23-47e1ce036777", "comment": "Malware payload", "value": "b165e67a074e2b3b60e046b5ad566c4d0d22eff1c5c3713d82838fe60b0f47a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keitarocheat-con", "colour": "#3CAF51", "exportable": true, "hide_tag": false }, { "name": "playbergs-info", "colour": "#937AA3", "exportable": true, "hide_tag": false }, { "name": "TorgGrabber", "colour": "#27BB7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127296, "uuid": "fe027117-d22d-4be8-8296-fdea2a513bb4", "comment": "Malware payload", "value": "6bfd053d33c8f5acb63d1e84a88f16b4d77b9960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keitarocheat-con", "colour": "#3CAF51", "exportable": true, "hide_tag": false }, { "name": "playbergs-info", "colour": "#937AA3", "exportable": true, "hide_tag": false }, { "name": "TorgGrabber", "colour": "#27BB7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127296, "uuid": "eadb2cec-a5db-4d8b-857b-80af32258cf3", "comment": "Malware payload", "value": "7b5846ff9586c53f5eaf488a7c616476c803c15891103842090bf3ce95ffd0aac88f301151369d5970348a4142900aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keitarocheat-con", "colour": "#3CAF51", "exportable": true, "hide_tag": false }, { "name": "playbergs-info", "colour": "#937AA3", "exportable": true, "hide_tag": false }, { "name": "TorgGrabber", "colour": "#27BB7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127296, "uuid": "12300f6a-509f-46ae-8140-2d63707a79a5", "value": "T14F288C0BBCA919E6C46E977289B752923B70BC0D0B3263D71A80B6783F767E05D39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127296, "uuid": "b52da28c-53d5-487b-bc00-f30f70c18b17", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127296, "uuid": "04a11aea-258e-46ac-a42d-6a9fa72b9649", "value": "49152:jlpjPe3kSZNfqZhs7ws5zddteIsdEgdTsUpBq:jl5Wrp5dteV1dTDBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127296, "uuid": "10dab6bd-abfc-4f52-abef-693fa9a035ea", "value": 97024513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127296, "uuid": "c6165d53-e179-4de8-a062-1283efecf15b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127296, "uuid": "cf746831-16fc-4a9a-8d77-d07a8892303e", "value": "keitarocheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e728c6-2e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125419, "uuid": "0ce0153f-b3f0-4923-b76b-d16d3ae245cb", "comment": "Malware payload (Mirai)", "value": "c1a33d00a1fe9e55dedb621088133def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125419, "uuid": "57ed039e-7d05-45ef-b6fa-39404692dbad", "comment": "Malware payload (Mirai)", "value": "b32f8bbfb58c14f3a5cc8ccb48ce6382d0f056c483ebf10613bd6b6c7c339ad4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125419, "uuid": "8742eb95-98b3-4ac0-8eff-640dce0ada4f", "comment": "Malware payload (Mirai)", "value": "8ddca21fc34231517fb3e31f25d71d57e032e35c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125419, "uuid": "d9699190-f884-479e-b10d-875a34630cb0", "comment": "Malware payload (Mirai)", "value": "e804d957a4f719ee413049dac0199bce3639af2a8a8f354abb744820f879938545254ff831aa5bc0d54f7eee7c893206", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125419, "uuid": "fcb82b4c-4fbc-4aba-bb1a-ac1230ae5f82", "value": "T1F6437DC4A19BEAF5EC06173420B2F3776632F87F315CE947D39A6E63BE06640940629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125419, "uuid": "fa43cfc4-61fd-4992-9cae-5a4ec96c3ad5", "value": "768:XB+c+qkuSwcd1Gwfk4TwRyGchMfWFT7Bx9Z0Sf1ZBk1jvjQUitkyUxBWiA4P:Xh+TuS9cnXchP7v9ySdZBk1L6sBW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125419, "uuid": "94e87946-6141-4466-b1f4-ef5197f57f67", "value": 60164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125419, "uuid": "0e87e765-fbc8-4b17-9134-6f25eecf3d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125419, "uuid": "9cded856-ebb4-4563-a91a-636125921b29", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b32813-2ecc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775159325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159325, "uuid": "af4de984-e605-4351-b053-369f2ae40fe3", "comment": "Malware payload", "value": "b4020d683acf7468ba58f0025848891b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159325, "uuid": "d30e25bd-07b6-4a6d-ac22-e2a229021f45", "comment": "Malware payload", "value": "b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159325, "uuid": "598195cf-4930-4fd9-9444-f9f09748e5dc", "comment": "Malware payload", "value": "2b377ef71fd3cc6840d4f72d3e31dd9976246a42", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159325, "uuid": "4974f186-5a94-4c16-a6cf-4f8fbb915f44", "comment": "Malware payload", "value": "aafbdae8253c5fe8542d7e2647396d14f6d75085a428e4c7bfb1160efcae88e722942d7350308754e7009fdeb3dd9314", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159325, "uuid": "d57be0d6-24dd-4cfd-a67c-e7751183817c", "value": "T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159325, "uuid": "8f95e245-c287-4ddf-8e1d-8e3c54fcee58", "value": "768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775159325, "uuid": "6a879d32-4b66-42d7-a68c-442e37240526", "value": 32208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775159325, "uuid": "b64754a7-97f1-471c-8e36-636a7aadf118", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159325, "uuid": "c936d985-6354-423f-8a58-f56ec62e31ac", "value": "security.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da4a045-2e48-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775102376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775102376, "uuid": "532beb12-a25f-4b72-9128-9d56ec5124a0", "comment": "Malware payload (Mirai)", "value": "65884f3f0f27045208939d4fc3df595c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775102376, "uuid": "af7ad123-3335-439d-8c03-2c6d27bf54d6", "comment": "Malware payload (Mirai)", "value": "b68de150b2ac4d6ca6bb83eaa5cf4f65600dabc3d4745d88444e4708d60554db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775102376, "uuid": "2c700a66-38d7-4a39-9875-a62acef4e44e", "comment": "Malware payload (Mirai)", "value": "01ab7b8c76dbfb65c7b462e9c83a5b2756e951e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775102376, "uuid": "cf55d1e0-53d6-4e0e-8544-9179634ed17b", "comment": "Malware payload (Mirai)", "value": "fe52c534b526efc8b271ba1f4c2bcafbd59c5babf7b57c197a15d3e4b4ee7d2b308817b8cb27ffd23f206c7fa348acb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775102376, "uuid": "b877a576-d4f6-416c-b10d-15b8325479db", "value": "T143A533CCDF4BC8B7396158CAFA24B74665B941366C5F6B121C1D225AD8F1B2A2028F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775102376, "uuid": "9c197d9b-3750-4310-83b2-0ecd3673f349", "value": "49152:KJ2p7rV3i3afuU76EDp3qNZf76BVWaVx77qArMhK:ie3iOmaSj6BNv7lrM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775102376, "uuid": "437d3330-5aba-4a80-acf3-6fe0eb2982cb", "value": 2088700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775102376, "uuid": "f9ae9b7a-73e4-4c3d-84f3-cdfbb042421d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775102376, "uuid": "ab637f52-e4f5-47f8-b50b-de8da9ab2e2f", "value": "wlan.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7f08a1-2e82-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775127443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127443, "uuid": "8538ecc5-0a09-4923-949a-aeaaad50b1e2", "comment": "Malware payload (a310Logger)", "value": "4d13121693ee7477124b70f2966815c7", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127443, "uuid": "c69bf5b7-98cc-40d6-9f3c-888890e1d86d", "comment": "Malware payload (a310Logger)", "value": "b72b4e75c8e746ad265aa81aec5d2651af071590dfb5ffbb970d235b2182c584", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127443, "uuid": "69a8d434-e1a0-4dc3-bd5b-b3bb0b33dfe1", "comment": "Malware payload (a310Logger)", "value": "28d7aba3a4d51ee840811f65b63d7bb9462d9df5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127443, "uuid": "70a8b853-9be7-4540-a8cb-c0927ee1cdff", "comment": "Malware payload (a310Logger)", "value": "6f416d644cc5ff880cd04fbae298471d4907ac9ea23c47e0f8c6a3dc605a25951938f45947c2346662073a0008c26037", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127443, "uuid": "1556067a-f731-404c-b08d-2edebc895f2d", "value": "T16355C00273D1D062FFAB92334F5AF6115ABC79260123A61F13981DBABD705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127443, "uuid": "a4fb9e2b-3602-42a2-b049-d5b5d8971fd3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127443, "uuid": "032a88dd-3a93-41a0-b6a2-67dd98790b1d", "value": "24576:E5EmXFtKaL4/oFe5T9yyXYfP1ijXdafbb3MTbbfanlnBXbyFq4hXI:EPVt/LZeJbInQRafv44lZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127443, "uuid": "18970369-cc0c-44cb-9f4b-e6113775fc3c", "value": 1385984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127443, "uuid": "349394b5-ddee-402e-9ebe-7088cda652e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127443, "uuid": "201b3aab-4713-432d-bb65-b2261cd821d7", "value": "b72b4e75c8e746ad265aa81aec5d2651af071590dfb5ffbb970d235b2182c584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddb8d9f-2edd-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1775166318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166318, "uuid": "9dad27d2-b280-4964-8c0f-a047b8d3733b", "comment": "Malware payload (RedLineStealer)", "value": "0d1eeae9e361ffce04500b3755dc2b3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166318, "uuid": "15f590f0-54a8-485a-8c67-03ef4c007abf", "comment": "Malware payload (RedLineStealer)", "value": "b769c834523acfc208548b071df9b51d415235da4604420ee29864c0660e7d30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166318, "uuid": "5f4355fa-0a66-43f8-baac-c8e9007b37da", "comment": "Malware payload (RedLineStealer)", "value": "b0cb19e28e36a1f28c541caddad70d39ba6eacc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775166318, "uuid": "7ecea805-0d68-48cd-adcf-42823b59b0b4", "comment": "Malware payload (RedLineStealer)", "value": "75ae57c39ba01b4aa8f1bf618a9cb457934ffd1ee5f92248e716bcf81d324e0a8972f99b3e7d9d457fb4feb4e061b3be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166318, "uuid": "f1cce2f6-7c26-42cb-a527-3f8f6584fc20", "value": "T15215F1452215E902C8C32FF01D70E7B45B785E89A821D353CBFABDEBF93D61668492D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166318, "uuid": "2e6acb81-da0c-4b06-b8e3-527dcbcce466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166318, "uuid": "0b962490-40d8-43f2-bb3c-813f2b160bfa", "value": "24576:08bOASAMxuyuT5HhHJNQ82d0ctgLwI07:08bFSAMxITZhTQxmxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775166318, "uuid": "e5820f5d-7914-4136-8739-e345a2b68ab8", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775166318, "uuid": "3eec3e9b-8458-4ef6-8f65-9d115b4ff2c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775166318, "uuid": "0fd85bfc-f64b-4526-8133-3a1dfd81ac7c", "value": "0d1eeae9e361ffce04500b3755dc2b3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbd61c9-2ed9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775164845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164845, "uuid": "3fc25a2f-7c54-46c0-a42e-43feecb88f42", "comment": "Malware payload", "value": "fc35471fadb3250be9aa757b982f5ad5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164845, "uuid": "7749be69-4755-47cd-b57d-abf130d6a8bf", "comment": "Malware payload", "value": "b784ac0f60fbd5cffa089ae00089bb651fcbf4acfe44c6e318b7b64f43e90e00", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164845, "uuid": "1277d82c-3a0c-4e21-90cb-13eeb37a722c", "comment": "Malware payload", "value": "e17beb1d1ee19b663cb3877ba23476eeb9d9d102", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164845, "uuid": "4d4d5b2f-ccd9-44fc-adc0-e4db7ca1af25", "comment": "Malware payload", "value": "6a635e2abab013333a2d178f4173f42702fb299073fc1150ceeeedd1f862471b08f4f89d3b068f7a67b4a77de6c3aa7b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164845, "uuid": "7384dbb5-63b8-499a-a290-f1a3db7a07c3", "value": "T182F312A3B013C087D16BC9366DE6D53E8F6A6A67D8F5AC8631F049C57443F22B1106BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164845, "uuid": "d5abee3a-8a83-4549-8843-18ab9b5f0820", "value": "3072:0rZMT//n1638JiIw9U1V/HRHaQhiG4O4odvccx5NwiBvrwEPvwsux9:0ZisBOX/iGf4avccWEv8YRux9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775164845, "uuid": "fa2846f2-8525-49ef-975e-9f86682ae30a", "value": 158637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775164845, "uuid": "ec4196f1-bd11-4c1b-a093-2d39c72a734f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164845, "uuid": "52632ef0-2ad8-4c2f-957b-ad612b470a81", "value": "Comet-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8204b851-2e59-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775109739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109739, "uuid": "890bedde-8d9a-4e23-9c82-4aad0a528779", "comment": "Malware payload (PhantomStealer)", "value": "a8f4ea5c0ea0c7aadc4fe409552a3d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109739, "uuid": "c4601a92-dbb7-409e-83ff-a36f336a7a74", "comment": "Malware payload (PhantomStealer)", "value": "b8af4830d1c00082588109443abc5f31218e71d35b718127b65fe3817cbff0f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109739, "uuid": "9f7e0bce-da0a-4004-a132-a2e2d55c4fd1", "comment": "Malware payload (PhantomStealer)", "value": "1d84c67a0b47b8453f6485c6c3058eb4cdf31928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109739, "uuid": "52719414-2503-4bc9-b8a2-376d6130afda", "comment": "Malware payload (PhantomStealer)", "value": "97781dfb0845e3721c1d8f50630ecd7cb645762aee6d442a26f6baf085198996c14f8d377d795f2e63b9581745414e04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109739, "uuid": "d5bdb065-a704-4d4f-9853-1f287e2d8002", "value": "T16C85E0027381C066FFAB92334B96F6215ABD79260123A61F13981D7DFE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109739, "uuid": "0e62809c-b32d-4fa4-b590-8ae97001efa2", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109739, "uuid": "e9a798ef-b4fc-48b9-997d-9702c8aea710", "value": "49152:ZPVt/LZeJbInQRaOSBGfDNGfb2dIAC9Gt:ZTYbInQwCKbxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109739, "uuid": "59b9bc52-ff84-47d0-b4ae-ee99874d4378", "value": 1728000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109739, "uuid": "7a8b092f-b175-411e-85aa-4b4089a56c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109739, "uuid": "e648a813-22b0-41d3-8b18-a3d3b4e292bb", "value": "RFQ-TLQ-520 # 2600260001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68b84db-2eea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775172158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775172158, "uuid": "7c58b29c-07c7-4463-b38a-fd71118e006c", "comment": "Malware payload", "value": "013bdbdeacccf651e5ae3a795d608e6e", "object_relation": "md5", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775172158, "uuid": "a36f7541-2039-4e8e-8d23-9aace986b476", "comment": "Malware payload", "value": "b96648e8a12038a947a00027f3147193268c80a2f42b63c331dea059a7b3cd72", "object_relation": "sha256", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775172158, "uuid": "a6785e17-8236-4434-876e-9b47ff02f304", "comment": "Malware payload", "value": "ef0838d94c8f94740431fdf6f21e112e6eb61b1c", "object_relation": "sha1", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775172158, "uuid": "a1021754-1d57-449a-b776-e38bee1d9d24", "comment": "Malware payload", "value": "4184e6be6eeedd6d6e366b925f40c46b6727e6ea88503d92a5c3077d08519e5cdd4218415e7058d4b47c597c39ad903c", "object_relation": "sha3-384", "Tag": [ { "name": "Disco", "colour": "#343F62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775172158, "uuid": "2ac4a61f-e52e-4742-91f7-0d3605ba014c", "value": "T13D96337C2BE808E8E9BA913C4DE3C1ADD6607C0647A5E18703D18A872E975F13D7E725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775172158, "uuid": "18e61584-e754-4ee0-ba1d-b078180d8d86", "value": "064967a99ade726316dc79a4a929fe96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775172158, "uuid": "ca6a7c3d-f03e-44c5-8d37-1acc0fd7c9c2", "value": "196608:4SN3Pneg2v1Nk2OtvydQmRgaycBIGpEojgAL+dWR:/Pp2dNkL0dQE9NjDcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775172158, "uuid": "e25bc563-a534-4a93-b8b7-ebd8485ff5c8", "value": 9181173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775172158, "uuid": "805d72f6-ad87-4cdf-b4ed-2c77dc17c402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775172158, "uuid": "d44fec74-24f3-4918-8210-5b559d338b46", "value": "nigger123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55164566-2e97-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775136292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136292, "uuid": "0a46d29f-1c84-470e-86e8-7277aac30205", "comment": "Malware payload (LummaStealer)", "value": "04ed7d5eedc8c3bda9cd09158d6c2400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136292, "uuid": "ff3eccc8-8e5d-4fb9-8246-893ad15226d4", "comment": "Malware payload (LummaStealer)", "value": "bd52309c600df9be82a2e8afd09bfd19ba20a303ecc05a85e550afd426906283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136292, "uuid": "24326a6c-a71a-4cd9-b431-2428d07f9fe6", "comment": "Malware payload (LummaStealer)", "value": "0b13e9d216a2db439a987fe5d7b526e81e5d105f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136292, "uuid": "3706ef06-1969-404f-8850-1ec6094c8564", "comment": "Malware payload (LummaStealer)", "value": "22288c8e782a868509d1852d9750088445895972239fc7995919154581fc3b69c3eae7fd7049fa7b939cfcbbc0daea72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136292, "uuid": "2181eb56-ffec-4440-88c7-66133338e3a6", "value": "T11BE53B92B909B5CFD48A2778A527CDB6985D03F94F2048C3DD5CB4BABE63CC111B6D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136292, "uuid": "a7663d65-9ddf-41bd-9a3b-2f360a83749a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136292, "uuid": "f0602b3d-fadb-43d9-a01a-8ddfc50a9ac2", "value": "49152:OuScHxfG4/KCGCzYhQAp7AZb0Tqn5KsdpRla/vDp7Prvd:OaxfG4/KCGCzYhQApcqM5KsXqPrvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775136292, "uuid": "b85f886c-3837-4619-b9b9-701adf329675", "value": 3147776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775136292, "uuid": "babc851b-3ec4-46f4-a86b-ac896d90c99a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136292, "uuid": "957f783d-8231-4495-9315-56ee0a504bb5", "value": "bd52309c600df9be82a2e8afd09bfd19ba20a303ecc05a85e550afd426906283.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39aa837e-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095874, "uuid": "c1b9db90-a008-4e58-acbf-07543e0b77fa", "comment": "Malware payload (Mirai)", "value": "6573311121fdf5fc4eb4f4d3349960c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095874, "uuid": "5c9c9be9-7dd4-4f19-91aa-ecb68ee139c2", "comment": "Malware payload (Mirai)", "value": "bd68729f0f1c1ed5b36551f0b32f9f46a91d3370a7c4f79a5cd7c0450791c109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095874, "uuid": "46a697a3-0679-43ea-b543-1b5e2da66a16", "comment": "Malware payload (Mirai)", "value": "75b21417e37621221d0d17e73d5b358174fe3cde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095874, "uuid": "99637f75-a0d4-4d55-a57e-aa473f233560", "comment": "Malware payload (Mirai)", "value": "338eb00e732fa9260a145bdf84fb7834c610c5188aeb2f0fe836b6036bf2073ded409ddb37d47c84a0c6a7ff5ed5d22d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095874, "uuid": "d0ad90ae-8d7c-4f97-adb0-af93802525aa", "value": "T1DAD35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095874, "uuid": "283faeab-e6c6-4f9a-8c1f-e4af652dd022", "value": "3072:79eSuygEPjt6qkWqMdKmDnYMb0gBd/gQyVGsdqml6qaj:79eSuygEPjt6qkWqreH2laqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095874, "uuid": "1e68a39e-f060-491b-88e6-596923938636", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095874, "uuid": "e49d7c0f-15c0-4dcc-b4ec-4b85cb7bd35e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095874, "uuid": "439d7aa3-c202-4e4a-8001-9e2d4337819a", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4ec4d5-2e83-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775127691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127691, "uuid": "18596370-8f9a-4c1f-857f-33eec4529b4e", "comment": "Malware payload (ConnectWise)", "value": "eec12eb191f798b52f6fd630e9d32f79", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127691, "uuid": "fa29b670-62b7-4275-a47f-8232c0a19d48", "comment": "Malware payload (ConnectWise)", "value": "be6d91050814c3b6b096261ca67d73bbab4d1185843c61fa3db3a5ed2f18b6aa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127691, "uuid": "1922d523-e96b-4768-b264-904121f14781", "comment": "Malware payload (ConnectWise)", "value": "d97a3738034dbb5deee0d4f789d404029ef622c3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127691, "uuid": "bfad7698-e736-497f-a796-d8828ae54c7d", "comment": "Malware payload (ConnectWise)", "value": "605b8e45052bfe8c155f001d0eb8c6eebb00fb2d7739950f6351c35251f3f5cfe09d710342dc887518417f9fe14831b6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127691, "uuid": "a5dabb44-787e-480b-b3a7-38cda9d4460f", "value": "T150C612129EAD405BE4B64B7DED368EB8696E7E58CE1183EF42347D0D2D309408D633A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127691, "uuid": "05de5aee-bb5a-4aa6-b79d-14638f6bd28d", "value": "196608:xWh0cGwAWh0cGyWh0cGrWh0cG+Wh0cGHWh0cG:xWac6WaczWacAWacfWacIWac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127691, "uuid": "2f70e345-cb5c-45da-a58b-457137ba850c", "value": 11759616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127691, "uuid": "60016e94-3715-4c73-b4a4-8d8feaffc859", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127691, "uuid": "bcb6f27a-d580-4118-9d61-58ec9e6f6602", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7c2ff1-2e97-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775136518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136518, "uuid": "0502801c-5a82-4d74-83c6-63207cd5b019", "comment": "Malware payload (LummaStealer)", "value": "4d111b5dae26057e8acaa91af9cab251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136518, "uuid": "0d3f62d3-0ec3-47f4-bdcf-2dda4911610f", "comment": "Malware payload (LummaStealer)", "value": "beca148fe90dcb06dc2aedfffc5b7098453b1489f1cc6e69febb520e2e253ce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136518, "uuid": "59c95e59-d79e-45d7-b0d6-e6c0b9d40aa2", "comment": "Malware payload (LummaStealer)", "value": "4de05bbe09714226eb7bc9a5813132d49b21562d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775136518, "uuid": "cbfa5454-9764-4e17-a808-d92606f3363e", "comment": "Malware payload (LummaStealer)", "value": "839c680aba26161c2aa996bebb6a2a065573f093807837d68d72f6c8f762866e234c062708d1f435695969f559c3eed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136518, "uuid": "c5d5e919-78ed-4339-9ecd-7ddbda5de96b", "value": "T157E53962B50669CFD48E12799067CDAB996C03BD4B2448C3EC5CF5BABE73CC117A5C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136518, "uuid": "13bb2f1b-7131-493b-9a1c-bceb063b30af", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136518, "uuid": "de0e9369-6299-4ee3-8d18-76c0cae485ec", "value": "49152:+omajauU2If7zkalfz6n5d7Ft2UBLQRx+Z1s:+qauU2Yo0fenLbFlQx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775136518, "uuid": "7c8a3af6-81d2-4b1e-b3db-c24b377fa265", "value": 3133440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775136518, "uuid": "9a25b325-3143-4687-94db-6c382c05f990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775136518, "uuid": "fc3b91e5-f7ba-498f-a411-48144dc04cf4", "value": "beca148fe90dcb06dc2aedfffc5b7098453b1489f1cc6e69febb520e2e253ce4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db4ac79-2eb5-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1775149218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149218, "uuid": "a6bdf61a-cfa0-4699-9b72-4e29c242d249", "comment": "Malware payload (Stealc)", "value": "946a9cc6b501d993a108c90ef7d0930d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149218, "uuid": "4cf18cdd-ccf9-479d-a328-e1084fa6f350", "comment": "Malware payload (Stealc)", "value": "bf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149218, "uuid": "9d928021-44a3-41c7-8f3d-59e853189353", "comment": "Malware payload (Stealc)", "value": "c98aa812a271c9c78017c2c90b60a97ae13df9cf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775149218, "uuid": "6cf20e2a-6f04-408b-a1a8-f1a1c1290369", "comment": "Malware payload (Stealc)", "value": "5f6fa035568b86bd72c979b5ecbb4f38e542da1afc07c73ef9d804b2869f7c86c8578cdc5950f543850c2ec9dcf8de7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149218, "uuid": "d87142b4-bd6d-4beb-904a-b217d5803327", "value": "T1F9D4AE1275A090B7E17206348D74EB548BBDB8701F61ABCB73C0059AAE716C0AF37B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149218, "uuid": "d757094e-5271-49d8-a6a2-7fb3a8c18614", "value": "8e7a3254c76133d3b7d6e5e7e43e50f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149218, "uuid": "488d2d04-5a8a-4796-ac08-cbaa9727b9d2", "value": "12288:FUTcoRtexxNFGCRUWqL9NtiXv/JyxBlDetAqxSv8UA:FU7mFlRUVfsXJybUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775149218, "uuid": "92d9945b-65dc-4c2c-b33c-d624e7159837", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775149218, "uuid": "6f7c3f76-4c10-4ac9-b447-24fa6548fe17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775149218, "uuid": "39f52871-5248-4bb9-ab9a-60ff48007b15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c31496-2eb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775148960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148960, "uuid": "cb22ffe6-3fe3-4592-9eeb-360dfb59a5d7", "comment": "Malware payload", "value": "c15722d1f29b28fefac3a34c1d1a296a", "object_relation": "md5", "Tag": [ { "name": "EquationDrug", "colour": "#E0A71D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148960, "uuid": "acb275c5-b7b6-41ec-933c-3b99320795e5", "comment": "Malware payload", "value": "c1d06468a2f089b4f6efbd51f4a140be40283e2efc76d25712e63471bca9f235", "object_relation": "sha256", "Tag": [ { "name": "EquationDrug", "colour": "#E0A71D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148960, "uuid": "5486a6e6-2139-4f85-821b-656467c5e3bd", "comment": "Malware payload", "value": "cf775816f832f08a024de89c96eb9311ef2a66c5", "object_relation": "sha1", "Tag": [ { "name": "EquationDrug", "colour": "#E0A71D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148960, "uuid": "79ec465f-11c9-43bb-800a-650481b31c37", "comment": "Malware payload", "value": "d94e75addfe13c392f524a308ca5ee3dec9422137a6cd90479ce2ec0f23fc7f20f1670581cb9d16560bbae563d4774d7", "object_relation": "sha3-384", "Tag": [ { "name": "EquationDrug", "colour": "#E0A71D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148960, "uuid": "f3b2829c-3093-4ca3-8757-ea1bdc31a6ae", "value": "T1B2B6336BA5A350B0F1E5AB7C9C0BAFF9A97F9E646C70D407ADD06F055EB45C200E8381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148960, "uuid": "3c6ce520-2571-4c0b-bc3b-1486292f5da5", "value": "de1fa96ad5bc81910ffb7ed552e29d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148960, "uuid": "c197e7de-1e49-4d7f-bf6b-bd82f04e9b6b", "value": "196608:SoCIRHixqAPLu63SXYGXZJR3RSivHiW2VIfjZOlQoke6LOZBoA/wZaKWX:SnAiqAjyTl3jvCPmj8eokeQ4/EabX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775148960, "uuid": "b90ab6eb-c363-436a-a26b-cf0d8365898a", "value": 10940889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775148960, "uuid": "1c3c101f-9e4a-4bc0-bc91-5014904aa28c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148960, "uuid": "4fec8b5e-3ebd-452f-bb08-a6c785518c38", "value": "ERROR422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f7ae9f-2e5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775109955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109955, "uuid": "8b7b580b-fc79-46a0-938c-47ef8a5d9467", "comment": "Malware payload", "value": "80d403a60ed9cdc9e68a203170a97b3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109955, "uuid": "ce13f00d-7536-4609-8f7d-190d005bc19d", "comment": "Malware payload", "value": "c28c763242295975584de541e9dd18bde860b95d61b66dc3fb5114baffb6fd44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109955, "uuid": "e8ffef05-dc10-40b2-b6ac-dc0e0f1a0717", "comment": "Malware payload", "value": "0b6ebeaf20b83de11349a91b7c577117ff63d9e8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109955, "uuid": "a717f638-6767-44dd-9a6d-0837858f993b", "comment": "Malware payload", "value": "2b7e6f65137d69c8f466a33a82a57864f49113b48bb10df0b7d126f8e02f6473fc81d9f71591fa05af9cba195f7b3ff0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109955, "uuid": "39df636c-27a5-499f-b7a7-e0546d7d843c", "value": "T1A764E000E5DE085DF8F70BAC8AB94A504CB8FCB9671DD4CD04151E9E0EBAE854CA3E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109955, "uuid": "aa324d0d-472d-4a78-9f4f-4fa0558751ad", "value": "6144:U+p3gI98LEfi/XrkfKxHafmIFf48zV0rf6LizQpBG5SkKl0wmR18Pe:Uyn6Rx6hfJ6Q5g5Svmj8Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109955, "uuid": "c8dbef0e-a44f-47da-b452-11696466afc2", "value": 308850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109955, "uuid": "b54f8a94-6de1-4fce-98e3-b79b9a6d3795", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109955, "uuid": "d64aa5b9-7c88-434d-8a7f-849000755e10", "value": "SKM 382021077.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f93552-2e9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775138743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138743, "uuid": "deacfd1d-0231-4b52-9c46-834261db131d", "comment": "Malware payload (Phorpiex)", "value": "1a13e2074c53e9c474a6c79e4fabfa9c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138743, "uuid": "86a2d723-1223-4550-bb44-e15f12e60084", "comment": "Malware payload (Phorpiex)", "value": "c8691b3712398775089267718fb9b470164fd65935c832570581eb87513127d1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138743, "uuid": "5bb9991d-7855-402d-990e-78227f3d591c", "comment": "Malware payload (Phorpiex)", "value": "fbbf812ab473d982ccc5592370a97425f99a11bf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138743, "uuid": "f4d043e4-42ca-4a5b-b304-d10d1c1f0262", "comment": "Malware payload (Phorpiex)", "value": "13a4de1e345ce1fab471e53f00b9306b3ac7a63d5f852e606eb6928197bbb5c0cd6e1bdeeb1e4fc7a459bd31e17c63e9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138743, "uuid": "70b2a3e4-4e86-429e-baea-ec4029339725", "value": "T16022492A6E4A0070E3E44DF056B54A4D563C957337C6B2EBF333C58A0EE8388C4527EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138743, "uuid": "249527c3-a9c7-409c-9d67-38f3edf0c980", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138743, "uuid": "6911a57b-36bd-4229-a608-4acbcecd69dd", "value": "192:KQEoL52w0ZBat7x+eowPFJxTEZmFhSKcKlGF:KnoL904wSPFwZjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775138743, "uuid": "62d07800-a9de-4dbe-92bd-9928b39faef8", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775138743, "uuid": "41a0cba9-56e6-4e02-8599-6ad2f7f8cda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138743, "uuid": "3c2e1130-f967-426a-ad75-1910193fb8b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7804a9f-2e59-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775109909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109909, "uuid": "43fd97dd-449c-40c3-b757-218ecc8ceef4", "comment": "Malware payload (StrelaStealer)", "value": "c8f48460e23767dccd90428d2169bc96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109909, "uuid": "252e64e0-8349-4d62-966f-95588c0612cf", "comment": "Malware payload (StrelaStealer)", "value": "c90728a79d70f90ae768dada42cc29a5a03427fa18a0cad875a799b8dd67c92d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109909, "uuid": "5d9cf0f3-ae3e-4ea7-afb7-df15f3937f4c", "comment": "Malware payload (StrelaStealer)", "value": "4c258cf3f4d5406b342a6b032e8345230628554a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109909, "uuid": "2c739ac1-2470-41d9-b751-0606874d5848", "comment": "Malware payload (StrelaStealer)", "value": "0ebfbc200cb921c6a48bb5663b8ddda02605f16c89883b66fe0d7d02528262f6972730cd02240d555077dad990d14e3f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109909, "uuid": "da89fe7a-7eaa-44cf-ae04-137f2220407e", "value": "T15454E021C3EE4424F9F22E6192BE351605B7BE726A1DC4DD18484DCD06B698AC9F7B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109909, "uuid": "4949f1e6-a523-44f8-9713-fda06e99d588", "value": "3072:xnZUTpL3SZPXORX9kGAIkX0dTX7nFHxrq2S3aIC6W/g+cqUgjREYV2PEUmpVEZkA:xeTl5RNdEXEbDK3dFQgpqFRE5sfVEKnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109909, "uuid": "d61f411e-3460-4116-9836-b1107e6b030a", "value": 288246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109909, "uuid": "f0e474d3-852a-4f0e-aeec-94c567ce7662", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109909, "uuid": "3d87011a-3c50-4e81-8201-92acf39a8863", "value": "Purchase Order -April -00037799809909027366600220091100553_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a7bf3e-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153629, "uuid": "247b2b7f-ec30-4bc1-93e1-2a5546699562", "comment": "Malware payload", "value": "4a458e75cb7d4956013f85ac09b99db2", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153629, "uuid": "03436018-1793-4463-a6d9-e00af5551e78", "comment": "Malware payload", "value": "c97ad0fbb6c08c88881730836d18dfad203cbb52dc3343ca14048bf7ed15c6c1", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153629, "uuid": "b357e6ee-005f-44fb-831b-e53d4edc27bf", "comment": "Malware payload", "value": "b1c660c1945eb06773e05a913787be60a7f3d15e", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153629, "uuid": "abc698d7-ef2a-4aed-ada5-fdc562bbc2a4", "comment": "Malware payload", "value": "1971a553a5d3805e7a89a3a33b60745dc2a2b37144718d870de0c2b965130c50b9142a58b50e3182b5c06b70e01a093e", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153629, "uuid": "1c7d2296-21af-4d1d-90b2-87735263214e", "value": "T1E4F4F12BFE84CE65E32388765872C0B2F4981659DCC6D42B45D0064EDE26ECE1B63BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153629, "uuid": "6b688138-8006-4ec8-9a2e-2b2475fa8c1e", "value": "12288:0GBd+9NfBTrdp6EACjOZ13RmSwIpAoJ7af7FlR9msCIG+iH66Wnvg4Iw8q:0GybpfL6EApZVwIpVt0FlDmsB/6ivJIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153629, "uuid": "f5fed9ee-f227-4802-afe3-ea077845533e", "value": 727830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153629, "uuid": "48c38052-3ff0-44b4-aa41-3cfe14a09ebb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153629, "uuid": "f6b8fc2b-d216-449c-854e-0137286ca958", "value": "c97ad0fbb6c08c88881730836d18dfad203cbb52dc3343ca14048bf7ed15c6c1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01f28ae-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125385, "uuid": "6de73192-55e8-4967-b880-c960f10eafbc", "comment": "Malware payload (Mirai)", "value": "446af28456c7b21fa1e5716c02e73178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125385, "uuid": "48a97937-710d-457a-a3d5-a22cadb283a4", "comment": "Malware payload (Mirai)", "value": "c9b26587fce571edf1f08903ac33ff8551778002272a95d85aeab28f3cd849b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125385, "uuid": "16adea4f-4198-4435-89c2-f0c1ee44ec6c", "comment": "Malware payload (Mirai)", "value": "eac91e6517bcd4f828bac33f278f8c3dd8a019a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125385, "uuid": "66474b03-361a-4564-82ab-0eb235642f24", "comment": "Malware payload (Mirai)", "value": "c6e8198a96704a9a4fc3411c854ac7bc50ce158c347cc69074236c0bc316a0c691f124b8a2d3580553d1ef4079ebf640", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125385, "uuid": "41112169-f13b-42ae-b55b-45e092c1a685", "value": "T17D332912997C1A2BC4D0A77710A38363E2F72B954194EA4FBD750D4FEE983501ABB6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125385, "uuid": "1b66d99e-9a9b-48dc-942c-10326ec6d410", "value": "1536:4b34LHJRwGYtJLx1TBH4EmgSXUwXyqVNS:4LaQqUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125385, "uuid": "b3b32764-7933-44f0-b6b3-ffe1d61dbe01", "value": 53812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125385, "uuid": "0e10d4d6-7e47-49e9-8b84-3c37f7aeec50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125385, "uuid": "57f733e2-5d8c-4b14-8893-167f2d9268cd", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8658490c-2eef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775174171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174171, "uuid": "b3c7df40-065e-4e77-b3e8-ac9d7ab26c29", "comment": "Malware payload", "value": "f67c9602491ddd53946933790390ebf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Rodico", "colour": "#8DE150", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174171, "uuid": "cc9c00db-1182-40b9-b2fc-a224cec2a485", "comment": "Malware payload", "value": "ca12c3dbdf0464609e15bd297af41a15657c13465e907f88b8267dfda7641fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Rodico", "colour": "#8DE150", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174171, "uuid": "a7fd57d2-cac8-4f3b-8f29-c6522972e44c", "comment": "Malware payload", "value": "34818a5e4502b2657ecb16501f3e02559b3b0425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Rodico", "colour": "#8DE150", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775174171, "uuid": "62a72eea-7ae1-4132-b17b-6ffd1b061fc3", "comment": "Malware payload", "value": "b729357b020a5bc6e052b4ded524bec5b6cf75a1297f845cf04d62a5d331ccc640ca0c5df48194e173b543dd6379ed02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Rodico", "colour": "#8DE150", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174171, "uuid": "9ba2e5a4-e5af-4a07-99ec-6dd751036b0b", "value": "T1DFC633043BE009FEF9A3E53EC451CC356679BA032B92C99F035856212D776E12D3B7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174171, "uuid": "6714db24-9cbf-425d-abab-88e0635671ed", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174171, "uuid": "36f622be-8d17-4eb5-9a41-e42262a0c2e6", "value": "196608:NdGW8ourHm7ND9BKG+5fc2S/ErXKEtw+D/onifPwRMsqKXL+yrYM0nDk:n8ouCRDvV+53SM8+DoifPwSD/WY3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775174171, "uuid": "38be50c5-e4ae-4a58-a8c0-3dee3cb8d5ac", "value": 12107716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775174171, "uuid": "4c888b65-67b4-44cd-b01a-48c00f36a1b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775174171, "uuid": "f6f1938d-cf8d-4145-b06c-01b1ddcc1b06", "value": "Robloxhack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe369766-2eaa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775144736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144736, "uuid": "c60fa9f4-300d-45cd-9256-ae0d31a1e047", "comment": "Malware payload", "value": "ec8c5b94d17a4393bf3f84c25fb087d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144736, "uuid": "1346e49e-7920-42ba-bbda-f04f3af5af6d", "comment": "Malware payload", "value": "cac99b68a7c79ca1fa023def49d430f478e2b47be0fb96f40fc68b717b4a9b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144736, "uuid": "85288ee3-d78b-4beb-a31a-24f0c107fc5f", "comment": "Malware payload", "value": "e7456c1c4a13b0632626045c181c1ef3ab15e587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775144736, "uuid": "ad535a37-3380-4e61-9e66-609fb401088c", "comment": "Malware payload", "value": "ce94adfbcfd1a0223cd8cb4469029f948075c1a82ae579f05fcc8d5217012c11de6617ae42d0c6d9fe8b42db3d112303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144736, "uuid": "2ace4c40-406f-49fe-b6df-8f44e06077ae", "value": "T14585BF66F3C866D9D427D639D711A332D1B2B8224772B0CB0A9A170A1FB7FD15B3A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144736, "uuid": "e9a3cd5a-0c4b-4ccc-b05d-30d162216b78", "value": "7141908e84140c2aa8230678b987a2ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144736, "uuid": "6695de4a-80bf-4036-b28a-0495eb9671a3", "value": "49152:HoYQUs7gSMUG7dIH75pigsqPN1DhbpwFNSeXKHvPVg:hXI75pigsqPN1DhbpwFNSeXKHvPVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775144736, "uuid": "ec3660a7-13a1-460d-906c-d31b17ce64af", "value": 1739776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775144736, "uuid": "7095c254-fb57-4b5f-b762-bef210a8f782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775144736, "uuid": "7d4f0904-c2c2-49a0-be88-aaa38b8fa40c", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4f2f04-2ecf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775160549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160549, "uuid": "157902b0-0415-4c05-8f75-b826fcb1ef03", "comment": "Malware payload", "value": "f3e320cf3822a91e2c02825882a9eea1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160549, "uuid": "bc2609a4-5d97-488c-8a43-680bafc31420", "comment": "Malware payload", "value": "cb8ed8faa43d39df05659bd1396cc2d037401b386c05471b2ce9f0dfac86c711", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160549, "uuid": "285b2ccc-7e11-490d-9eb4-a400d3b702a5", "comment": "Malware payload", "value": "17d2414ed236151ed6c392de33e8431b4ac94639", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160549, "uuid": "584eea48-6106-4a10-8ae4-8664e048bd4e", "comment": "Malware payload", "value": "7286d5da8cccad478e6b5e48fe56ecf78102b9a69278b28b1fff646048fcf07c8809103e849c182b9b6d5de2ee98adc8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160549, "uuid": "b20dc90c-7b47-471e-9660-d092b125897e", "value": "T1D7824A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160549, "uuid": "19dc73b3-8ef9-44a3-87b9-fd8cd836751d", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160549, "uuid": "a2c7de26-a5c6-406c-9ef3-00f18ae9c7eb", "value": "384:GI78VGI2VxOwflsx0pu9NHRgqav8U9cJ:vHdsx089na0Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775160549, "uuid": "da3106ea-9d29-4d2f-8543-9f62578c8219", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775160549, "uuid": "52f8337f-d389-42ae-95bb-ff1029fd75fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160549, "uuid": "dba4f74c-dc5f-42d4-83d7-07c69bcc2642", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb061e57-2e81-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775127095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127095, "uuid": "2ebbcf2f-3b43-4432-8bb0-fa5d7b7857e4", "comment": "Malware payload (AgentTesla)", "value": "3a692d4e81bc91db6fc5f1209cf61bf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127095, "uuid": "9a11d69b-ec35-4a65-8539-825a5d5afd30", "comment": "Malware payload (AgentTesla)", "value": "cc97f068f53b20a3072d5c63553609d02916716fcc9f4f333a173a5a3c0aa830", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127095, "uuid": "0ff37201-d3d5-4cc3-ab1c-7a6e05d5a7e2", "comment": "Malware payload (AgentTesla)", "value": "ffb70b0afc28baa3004a34370c7705e41fd0862e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127095, "uuid": "a099bd8e-e52a-41e5-96e9-89409b394c80", "comment": "Malware payload (AgentTesla)", "value": "87f5700e595df74c7962dd726c6951f824cf1ac3bd9dd45eeab8c34940f0621c2fe03f148a856d29a16e52e476327bfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127095, "uuid": "d2db03a2-3737-4104-ac8b-d521a69c5a0a", "value": "T10654E115E2E6405CF5F35F65ADFD18505A78FE221A0D88EE02052E8C8B29C49DEEBD37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127095, "uuid": "1ab234e1-50f3-4ec4-8cb3-269a91abd396", "value": "6144:HjtgNXpQn4kcD+hHiV1/Am1O8t057qzxAPInGMb:HjtgLGtkCUACO2I7qegnhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127095, "uuid": "8f73e4f0-8d14-4ea8-9376-08c36b239b18", "value": 301718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127095, "uuid": "fff16bc0-153c-41f4-be53-8d3301e24282", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127095, "uuid": "fc1b1c6c-0a17-4e06-8aa4-2a32ee17ef16", "value": "DfhbYWbKg864dS3c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9247b94a-2e8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775130811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775130811, "uuid": "6bb757c6-7334-457b-83f3-ba8f99ee891e", "comment": "Malware payload", "value": "caef6519346d4ce011002f5dba9b80a9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775130811, "uuid": "5c76eec3-d29c-4daa-8516-896042690fb1", "comment": "Malware payload", "value": "cd23460d5c3991ca0138bae65707de8280e32e071169d3f5560d341a0edc54ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775130811, "uuid": "6a4f3753-99ea-4e5c-a214-c074b8dae79b", "comment": "Malware payload", "value": "c558933aaca3571a69f3ff4ff57acd90145c9236", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775130811, "uuid": "a9a7bd19-3de9-4b4f-8c9a-ec22ade7e0b5", "comment": "Malware payload", "value": "4ca778fa29ab5f8ad06e693aa4256cb081e8448f4a1742943ee9e5e40f09ec3693765ea98f3150fdc87506fea75e63cc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775130811, "uuid": "8843477a-b3e4-4ee6-9bf2-da02f604e392", "value": "T176F08BE8E4B30C632F9C083B924518CC316138AB60A5298D78CEAA740E3DC08BF451F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775130811, "uuid": "fa3a0900-0ba5-4561-82e0-90a6f6212bb5", "value": "12:dzUjeKKUocyJA70cMB0bVsfFFJVSQVstNAAo9wA+:dzUVXope0B0bVOFLVSQVaMP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775130811, "uuid": "6c7fd10e-54bf-42a8-b1b8-b9b65a477268", "value": 559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775130811, "uuid": "987a2f19-b745-49b6-88fc-0e6081237525", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775130811, "uuid": "bb2e36a9-6ee0-4bf8-9824-2833e44b820c", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d63cd27-2e83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775127716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127716, "uuid": "950d8b5f-3f46-4334-9d79-0a30433e544f", "comment": "Malware payload", "value": "a817693644ab0f351cc89762ff45fc55", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127716, "uuid": "9908fd72-4869-4cdb-b05c-52858a9f8d85", "comment": "Malware payload", "value": "ce8cb74b3db1bac186ae57524e82d34d247104b43d0623c09712706938dc0642", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127716, "uuid": "f079488c-d1ca-4bc1-baf6-118f566c00e1", "comment": "Malware payload", "value": "c7dc8539d97e3d16957ca0c203722502192ccfcd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127716, "uuid": "706afbbd-16cf-4f0d-ae0a-bc5839a5523c", "comment": "Malware payload", "value": "c2b4162c9e2d592d126d8843f2c277e4c8b0c6c18d7ab0135ef3c0a442912f4e1147ec808c1280c7eb0f23554978855c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127716, "uuid": "d6a4044f-3769-4d99-a0e3-3937d91720fe", "value": "T17326F1CBF798992FC87B10B2896E527116574D128E839F436D44361C6C7B2E82F9DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127716, "uuid": "1b53b3a8-ea31-4704-bd32-25858c9156a7", "value": "98304:T9papsDdLeawgRz6ZEFfB7O3x1Jz9/d4WFpZ/dOGsoTYr62Z:T9pa+xe7KmGJBi1ywppnaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127716, "uuid": "6570819b-5e2e-4b24-afac-5398120ef128", "value": 4705571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127716, "uuid": "e5d34658-d2e1-4830-866d-8321c24e5f85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127716, "uuid": "77d71d5c-e64e-4bc0-9179-a2fdd0d0bd58", "value": "trust.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70425ade-2ed8-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775164255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164255, "uuid": "563b4ab3-50cc-4824-af25-044d5bc62bcf", "comment": "Malware payload (DCRat)", "value": "592aa67f17a4f75d18b1432edc582316", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164255, "uuid": "4198a6de-d1d9-4faa-9876-52df9da829c5", "comment": "Malware payload (DCRat)", "value": "cf6bc4cf461ee794f21f5e4786048a3afdac85e74efa4a461f232f1137b6589e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164255, "uuid": "2247b7a2-5fdf-437b-aa33-76f5e3dc9ca2", "comment": "Malware payload (DCRat)", "value": "cb08fa0042be7b24808654e26421ddb86f036af2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775164255, "uuid": "4fb96fe1-b5d9-4422-a6e1-5958601a326b", "comment": "Malware payload (DCRat)", "value": "ad4185e96e001a96b1e9b0f29436f6677553e5872d400b2b8acd60457b6b12571ddc32900d821225949c2a13ccac263b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164255, "uuid": "3cc72936-e042-4bed-b854-6f58d45ffc29", "value": "T140354A017E84CE12F0191633C2EF854447F4AC91AAA6E72B7EB9376E55123937C1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164255, "uuid": "1a3c7131-05c2-4ea2-893b-3b374cd1b1fe", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164255, "uuid": "9d369be5-a02d-4360-805c-334562f99ab9", "value": "24576:U2G/nvxW3Ww0tGydhxTXK5rdQGLx7QdXl+da:UbA30GydSZZQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775164255, "uuid": "0b59e8e1-0e6e-4efa-a466-32482f24d93c", "value": 1163884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775164255, "uuid": "44da1cca-1020-4106-89d7-ef978d57ee08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775164255, "uuid": "ccbb06d9-5e35-48d5-ba1a-70c29d538d37", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0d1c27-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153620, "uuid": "c4ce9ca8-a0de-453e-97c0-b82b182423df", "comment": "Malware payload", "value": "48eb060a3ce46094cd518274ea824944", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153620, "uuid": "c43d7021-7af3-41c2-9252-7681505cf581", "comment": "Malware payload", "value": "d02d82f2057f4794a71bf376a9ee24f012f996c7a5904f219dbe15aff95f4a0e", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153620, "uuid": "39b105e4-7d2d-4375-a2f0-7f6820dd87c0", "comment": "Malware payload", "value": "7e071043f50eb8985db690b10c686dcf8032d6cd", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153620, "uuid": "965c2439-190e-43c8-a1c7-f9baf96ce498", "comment": "Malware payload", "value": "cbebc4aa5de640b95f43f3a20eb45d4251fa84079097d44d1af374ab8c352faff2c35bcd984500486e8d1e68447b2b15", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153620, "uuid": "2a6003a9-ea2a-40ee-9d7b-015e9713f075", "value": "T1BA6302906BCBF57BFDEBAAFA569D70E7F109072B48C9D8B1779A042C0551881CE0513B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153620, "uuid": "e14ca94a-0b91-4b24-abb4-61614cbaeebe", "value": "1536:dKb1eiF2lneQ07lKW1Jq4ATCEkHc8omjn1uzSoiVB0:dKb0iF8elKWLqzlkHc8rn1WaB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153620, "uuid": "a9338e2a-74bb-43ca-a4a3-4bc8e47b65c7", "value": 68435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153620, "uuid": "d1cecf01-22f0-417c-abd4-ff2a07d7f2cb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153620, "uuid": "b2ef96c4-4c9f-4b52-9860-081b5dfc899c", "value": "d02d82f2057f4794a71bf376a9ee24f012f996c7a5904f219dbe15aff95f4a0e.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc47be3-2e80-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775126670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775126670, "uuid": "35587eb9-1298-49e0-8d74-e2640bc33415", "comment": "Malware payload", "value": "8de88b92a92b113feacf29920e1e3cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775126670, "uuid": "b2bfb8e9-465e-4425-b9d1-87ad3f9168d5", "comment": "Malware payload", "value": "d091e01ba92b9257cf7dc69f8bd46b918907de74226d0760a732eab6249a7059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775126670, "uuid": "030b9374-4404-42bb-a192-17fbf7007b89", "comment": "Malware payload", "value": "de66317ab91e511cfed1a3fdced74e848217e48f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775126670, "uuid": "7d1712c7-d654-400f-87c1-e9f9f08b3b83", "comment": "Malware payload", "value": "af56282690e3385e396070fb1c7737e183a4dc33474411096c3af68e2186bb40b6ae454f6ad3e33d623ff9312ec3054b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775126670, "uuid": "47bc990c-327d-4f89-aec4-a2700e7faa23", "value": "T11955CF027391C066FFAB92334B5AF6115BBC79260123E61F13981DB9BE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775126670, "uuid": "53518a61-1ea3-4c31-96cc-2691b0902a09", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775126670, "uuid": "4ef52a8e-f5ef-47e0-98ce-921e50c0c141", "value": "24576:R5EmXFtKaL4/oFe5T9yyXYfP1ijXdapHYZ+BQSkYczFGUi9:RPVt/LZeJbInQRapHYYk7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775126670, "uuid": "7fd7fc85-45f9-4f1d-bac3-f58a19dbd92d", "value": 1293312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775126670, "uuid": "9b0f3a29-0950-4865-8b52-de3c5ad879fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775126670, "uuid": "6b690eed-15a2-4ee0-a3d2-83b0f05bf44a", "value": "d091e01ba92b9257cf7dc69f8bd46b918907de74226d0760a732eab6249a7059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c4764b-2e5a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775109980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109980, "uuid": "af1a5fb1-90d7-4b88-9857-357178ab1fb5", "comment": "Malware payload (RemcosRAT)", "value": "5149965bb1c111ba42b3d5af3a25840a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109980, "uuid": "7f05255d-eca8-4a44-9269-16b582dcbdd1", "comment": "Malware payload (RemcosRAT)", "value": "d0bb2127686e97c5f0823315a63bf31c0e5fdc2a49bf148684491ad11299fe3d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109980, "uuid": "0447c661-bfe3-4e92-95e6-3b80003301c8", "comment": "Malware payload (RemcosRAT)", "value": "77a81bd61259ef92bf97a28ad93331b17f499598", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109980, "uuid": "de98af7e-7611-4ed3-8c02-3eb07684a43f", "comment": "Malware payload (RemcosRAT)", "value": "8ca179b9027fc7cd5f45306326ab3f42bd12535ca55fbc1935ab67b879c437c3639bdb939d7fb8b51018a3c2acb0578f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109980, "uuid": "a1d32f41-bc0f-460d-adfd-30e0f57f3c80", "value": "T1B2B5DCD1D902D5A1EFE7B2748B0C9788DD070E2B8E1AC1AE48D433F5F459F0585A9BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109980, "uuid": "ccae32df-2c83-4493-8032-9fd757a32063", "value": "96:9BsRYJNaHeifACY2yDifzNA1Jz3p4iLqL0wnX27b1Dz3z53Z59duazJIelfLSVp4:UbP3gSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109980, "uuid": "ed48af8e-298c-413d-8727-adac6e752940", "value": 2366425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109980, "uuid": "2c50d510-726e-4f91-bd30-a9c2df2279c2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109980, "uuid": "02a67a83-3657-4aae-b15c-f8bb5db70e3b", "value": "RFQ_INTELALTERA parts(Octopart).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517d66ce-2e8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775131132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131132, "uuid": "8f125610-2f3f-421c-bd28-6dd2a524c050", "comment": "Malware payload", "value": "f05ff851c16a9aafe2e0b48b5a0e3fd9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131132, "uuid": "439dad3d-c40c-420b-8d91-90eb52a4e7d5", "comment": "Malware payload", "value": "d17c10cf0975ffbc60f7d6a0b6446524e1608be0aa1fbd2ea0cc39d8388fc9bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131132, "uuid": "ab6a098c-bc5b-4a9c-ab79-3d64f0bff225", "comment": "Malware payload", "value": "93bfdb18f722c3a7fd4bb99de3f5eb8323ce8f76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131132, "uuid": "19f2c802-7b60-47c0-9a0b-97def0dc3c13", "comment": "Malware payload", "value": "8e3452b281addce1e40b74ec3b62f26086da1e1ea790e97d6838473f6f72594d1c4afc44c6df56d997a53d94410936e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131132, "uuid": "0a5d86c0-2090-45f2-ae22-ea5cf439b167", "value": "T1EDD0A78EA953216710658C1EF2B39415A708925E9C5566143F4D403B5BB0A0471D9984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131132, "uuid": "2a7516de-cf19-4a9f-8d2d-4d4b67db40a5", "value": "3:TKH4vLYzVDNqd47LHE0uT9ZVmtnvbMFsMLONFoEudF/F0TDNcM9pBEvNTOSNmO9/:hT4Vz7Lk75l6NXordM+MhkT7mOCyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775131132, "uuid": "8c401439-2b1c-4ad7-b645-60ad7e8ba96c", "value": 244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775131132, "uuid": "77b5e297-25c8-492c-80c8-7b0da0e4719d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131132, "uuid": "b4032390-8a1d-422f-9a19-0593e8919a95", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce17d63-2e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125434, "uuid": "f8948426-8dc4-44bc-935f-79799123df2b", "comment": "Malware payload (Mirai)", "value": "cc1012fd06ab583b285d442fab242cf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125434, "uuid": "0de4a5ff-dc12-4871-901e-56360e2ad0dd", "comment": "Malware payload (Mirai)", "value": "d33beeecfba29be529d7793b6bfd897d95a8c24b7d42acb49653a338b69fc05c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125434, "uuid": "97f2ea41-888b-4b95-b05c-fe8d9c8791bd", "comment": "Malware payload (Mirai)", "value": "0488213cdadf857eeda96d528ca2903f7b733045", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125434, "uuid": "315f2ca9-930d-45be-aa10-86489edf9f4a", "comment": "Malware payload (Mirai)", "value": "8d80b76727e8b689d20e0a922719defcc3772cc08438b68585f67e3b4366fabfbe81beeee8548c21c3c8906ece526ca1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125434, "uuid": "29d75924-f2b2-4e81-a6a1-7a13a45057c9", "value": "T1A0533A0336280E53C8A61AB46A3F57E1D3FFAD5510E4F288270FBAD68575D31128AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125434, "uuid": "a4104f95-8c6b-4f49-af5c-8e4ad9d29921", "value": "768:/A9A/Jp62pzxA1hTLUXpnCeWZBifCjCHIz0e1Yqz42w1yUKi6PKTmiRDlKqzJSLu:ugpzxAH3UX0eWZBgCOyYii6ERDlKqcpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125434, "uuid": "e534e075-3dc9-4d5a-bf06-aee593c1d5ef", "value": 63568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125434, "uuid": "aa6a1da7-cfcb-466a-a0d3-29f7deb26880", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125434, "uuid": "e8768d7d-8f4f-493f-a5f7-0e34c92885dc", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b0405b-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775125400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125400, "uuid": "24f9fe63-d7c1-416d-b14b-0bc382c5da3a", "comment": "Malware payload", "value": "07366fb8583444911b80898c46a45703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125400, "uuid": "74034eab-b56d-4232-a06e-5bcd8b6bfeb7", "comment": "Malware payload", "value": "d4508bda632b5eb652735bdeddd6e444d69659baf3051e8121bceed0a1765835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125400, "uuid": "7cd2f1ef-41a7-492c-9d96-689998f2b5bf", "comment": "Malware payload", "value": "b45775c0efb9e9a4fa17b886d69369bb6a906ec8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125400, "uuid": "cec55f27-e52b-4a66-9a27-8da0c684c955", "comment": "Malware payload", "value": "667f4fd4cf6c8cb0d793a9f772086c2a0cdd35a7681a0a7b5d657f6e5690256e6f4ffcd49ed942d7e05bbc7ddb79b5dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125400, "uuid": "27a8a578-52db-4bda-ab46-8e444fab7704", "value": "T180936C85FB83E1F4D94609B011ABF7798A31DD322024DD6BEB98FE72BC31612911A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125400, "uuid": "557c2510-3b8c-4c44-96b9-39e0bebaaa95", "value": "1536:hqj89KwF8ROXbDzcj02/1Hj82aRqoqRpUQ31QUHLKVyMyFnr:64F8ROL/cj02/1HYdUuiE5yZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125400, "uuid": "7633a80d-b717-4f09-94b4-34dc81d8f2a1", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125400, "uuid": "b40b72b6-1561-4fb6-b79c-0cdec0eca136", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125400, "uuid": "08ea2b02-4c32-4342-a2f5-0ef98e2157fb", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b19ae9-2ebb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775151861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151861, "uuid": "6a116cd9-9145-4f99-afe9-1e8866ce15c2", "comment": "Malware payload", "value": "09c41131498b9634f046b01ff6514fea", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151861, "uuid": "aed6078f-c996-4c32-8ba0-786c371d8fab", "comment": "Malware payload", "value": "d5171d3dfcfdb37e920e0c9a305ea9a28c419483321ec244a6f2fdfceacb5249", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151861, "uuid": "e74645f5-1db1-4a19-8706-359288339392", "comment": "Malware payload", "value": "ce6cdaece48c8022b55f60e36549ee2d21d966af", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775151861, "uuid": "003f23d0-4d4e-4561-bbb5-291cb4342f9d", "comment": "Malware payload", "value": "f7de42dd562344ccb7631a0294d695b7e6b99eb9a9df71c8a7898bbe35b204e540b66945311129f2f92e1253b501884f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151861, "uuid": "e1586b9f-5f2f-4de3-a595-5d810106dafd", "value": "T1A5823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151861, "uuid": "07cff400-10e0-4ecf-b847-7231be993de1", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151861, "uuid": "cd37e2f4-240b-437e-b8bd-4ebf11371577", "value": "384:AI78VGI2VxOwflsx0pu9NHRgqav8U9cl:9Hdsx089na0UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775151861, "uuid": "5f87dfc2-6029-458b-bcad-ed4884009676", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775151861, "uuid": "98440b03-43bb-4b5c-b72a-f6743bac386d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775151861, "uuid": "b60207bd-6f4a-4f38-ad5f-25e6fe09afa8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23caf7f5-2e5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775112158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112158, "uuid": "1185dc48-8ec8-44fe-9ded-3de0204e5189", "comment": "Malware payload (Mirai)", "value": "3218973b9a6fd2376a2998da650be1bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112158, "uuid": "0f0f3f20-191f-4fb6-8797-201878a6b27d", "comment": "Malware payload (Mirai)", "value": "d767060b7b8f808367f3f0eb2f5fdf59143c057a09f0fb8e5d9ca8414d061158", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112158, "uuid": "891a0e2d-d44a-48ac-989f-975d170e533b", "comment": "Malware payload (Mirai)", "value": "4fc40c28de3657ee750951f0c70a405d6274115a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775112158, "uuid": "0b36cba3-a67e-4395-9be3-d5369f59a7e3", "comment": "Malware payload (Mirai)", "value": "c99cd3543d04fe768b0c0b0101db0db49dc67c87ee4c7a6f3cc0961cc1fc509b3a2f576f319a0ac5a8bd9cacd3e699c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112158, "uuid": "fd3f9f46-4828-4f19-b8dd-c9b0a1f4076f", "value": "T10EF30945BC918F26C6D622BBFB5E028D372617A8D3EE3103DD255F25378A95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112158, "uuid": "cee139b9-c691-4d16-8c57-41d4e0560373", "value": "3072:zrMr/q3J46RU6RqdVjqtMWrMLQT4+Ppb+a0mLk3Wa77:zIrkTEHgzH4za0d3Wa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775112158, "uuid": "5bbf38c5-cff9-44fc-b8a6-6b72d63a42a6", "value": 162560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775112158, "uuid": "0ff9b5be-37fa-43d5-9fe1-25e6c7a18bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775112158, "uuid": "e2fec9bc-9e34-4711-b0bb-a45348491d97", "value": "rebirth.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ae023f-2e85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775128720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128720, "uuid": "eb690e62-6c08-47d8-81b2-f47f034c23c9", "comment": "Malware payload", "value": "f92934c2e43ed9a5800df00a239cec20", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128720, "uuid": "e9a11986-4db5-4d48-8822-cc2d79c3574c", "comment": "Malware payload", "value": "d7c45659ac5f9756b918654b96d16a2bd46e628f3a0768ec9bb69f205daac3f2", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128720, "uuid": "05e9cfed-ed28-4269-96ea-e5ffaa79402e", "comment": "Malware payload", "value": "1610b6bc50074fdd71c231faa9f75f8055ce8857", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128720, "uuid": "de2c1af5-48f4-4f42-9155-c0ae68a22eda", "comment": "Malware payload", "value": "08a37e5ec4b944e75ffcbaf01b6918b653891acb44407cbe8c5156a7084ada47e29a3f8caf90b70727d3691a0ce59195", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128720, "uuid": "7b660ad7-898e-47b5-a4a5-6ebf4742a0a6", "value": "T17A71F9B4D2D38A5FE91B23D1BD0681673B31A4B9511A217CC64E315F0D18369707CF57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128720, "uuid": "f2e4a2c4-4475-478b-9a63-783edf7a3be8", "value": "48:2AXvBP8F/sLvZtHNXkrT1Bfm9ewU38RHaUhp1Ci03NQbHAZBlWJeR+mKW8CDgFz6:2IK6t0lBOeCtfkYiBvxmCDuu+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775128720, "uuid": "3ef1f178-adc9-4ae9-ad4d-09c134b16a78", "value": 3607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775128720, "uuid": "938663e6-b27b-446e-86ee-2e646cdd776f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128720, "uuid": "762a38b2-28d0-466c-b348-0fc31cb48ffa", "value": "Porcate.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4255cf-2e57-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775109036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109036, "uuid": "add8200e-9812-4d9b-b2e6-9b8ff5aafc9e", "comment": "Malware payload (LummaStealer)", "value": "d11892785d99be567c69bff8bf9aae69", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109036, "uuid": "544c19ba-b26e-439b-8c97-de8e7fdb637f", "comment": "Malware payload (LummaStealer)", "value": "d91f2a957889f74f01498d1c4fcf55b2d2fa66f689af9090362a568be8582b0a", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109036, "uuid": "d78c2c93-3d43-4c20-b687-68cecfe94016", "comment": "Malware payload (LummaStealer)", "value": "2a0deca5cf7f67bd68b7562d843d5f0f67be3dec", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775109036, "uuid": "fc71c53e-feed-4e8f-8957-67b2136d04b2", "comment": "Malware payload (LummaStealer)", "value": "a479a960e02796ed93ab8881821639acbdcf8762dae26c29e3cfb4495bf5266a2d49807d08ef5bbd05db29c0a845fc26", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109036, "uuid": "21ff6083-b102-480a-b41f-8b25c51ba401", "value": "T136854C50FDC689B6E416163254A762BF633CAC090F36AA83EB457E39B6B76D01C33345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109036, "uuid": "d9d189c4-6bd5-478a-8dd9-641c0d8ae75d", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109036, "uuid": "c768c00f-acc0-4fee-ba27-cedf7b1bd959", "value": "24576:sdmUYHzDDGQvLrWVzxk0D3VZUEGaD4cn2+DZsPhkQZllV65iuGusF7YFSunxw42g:sLUYV208XDBrUFS02kTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775109036, "uuid": "7b93bb18-9e12-4992-9be8-4008a0075892", "value": 1784832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775109036, "uuid": "1d97f7ed-042b-4702-b695-0d68578b6873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775109036, "uuid": "52e7809c-153a-4e26-a70b-e5c51558bc90", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2a09ff-2ebe-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775153217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153217, "uuid": "99dfd7d2-c576-4d48-bb2b-21bc36cf584f", "comment": "Malware payload (CoinMiner)", "value": "b8692e7b2ea0a0ae10436df53a19f7d5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153217, "uuid": "f7a0576f-dc17-4f1b-8702-e1bc741e4dec", "comment": "Malware payload (CoinMiner)", "value": "d92c99455afba2324b3fbd7ba540e76657fabe022b118896509d71eb6599827a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153217, "uuid": "668230df-1c62-4a3b-b7af-5dff37e159cf", "comment": "Malware payload (CoinMiner)", "value": "f5cc2b33df519f81b8c405640d49e20aed46893d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153217, "uuid": "f2e4c99c-c66f-4518-a5e8-fe966372b09d", "comment": "Malware payload (CoinMiner)", "value": "191736de89c75ce04ac8b4cc3a1a22cd5967f83258f0db39c65932a0c2f20ebfb27e2e8844adcd53bb42d93d3ec53194", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153217, "uuid": "60408455-d390-4c00-a4a0-0ef642fee948", "value": "T13C224A2A6F4A0130E3E14DB056B54A59867C95333786B3EBF733C6990EE4344D442BEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153217, "uuid": "111e4833-0733-49a3-8f3e-b0fd2c21d3f6", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153217, "uuid": "2b13de49-cf66-4ec8-8395-03f8fb10f756", "value": "192:4Skom2wLx2gBat7x+eo3XPFJxTEZmFhSKcZGF:4po6Lx4wJPFwZgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153217, "uuid": "d7a3b268-8499-4771-b783-487d426a8e38", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153217, "uuid": "b63b9f65-384b-4eb3-b905-61c89c9c0970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153217, "uuid": "f1e1b5d6-e7b3-4128-b168-4db4fc1370e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e03af39-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095881, "uuid": "f2107028-7737-445e-90ab-c27b2d18d60f", "comment": "Malware payload (Mirai)", "value": "bf867f5b7dae264bfcbc4a519ba05aa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095881, "uuid": "51e21ee2-515d-4fe4-8b47-8e7c62d352b3", "comment": "Malware payload (Mirai)", "value": "d9b7c50da76ee74e92bcbb5498308e1144b02c0502348caf0b9ba1ba47491006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095881, "uuid": "3e6c8a5a-274b-4b0a-a1e0-77ab3223ce3d", "comment": "Malware payload (Mirai)", "value": "6040373b76ca72bd80ea91642b6e27b4775c857b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095881, "uuid": "3dae8752-66c8-48a7-a44d-ae3ea52be571", "comment": "Malware payload (Mirai)", "value": "66cbf1e8cbf6e7be4353bf8963cf2b0fa526aa831a68ec6d3813f8c362f31bd4d5a8e8b46ecb867e66235cfd7250a20a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095881, "uuid": "0d1d2bb3-ff09-4d45-a885-b6f6a520f6a7", "value": "T10F04881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095881, "uuid": "70923e44-8b06-4126-84f2-8f3307e12828", "value": "3072:jg57Rj7LHZwbq1YSBan1yvbysxr1uGSmI:jglRj7LHZ0Bqyy1BSmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095881, "uuid": "adffe34f-82ff-44c3-b21c-2031017755f3", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095881, "uuid": "7c01d427-0129-4457-8714-783d5e3afbb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095881, "uuid": "66e6c01c-b22b-46b8-9e77-027ce220dae4", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3165c43b-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095860, "uuid": "09dbe668-5244-4f0d-8a30-81d6b7e35be0", "comment": "Malware payload (Mirai)", "value": "036336213ebd61e6612dcccd74b4835e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095860, "uuid": "e560d973-5acc-434d-8635-b3a6190fd976", "comment": "Malware payload (Mirai)", "value": "dae399b45c54e875bc81ab3d05f994ffa14f79d9de1ebc4747a255a73545fd9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095860, "uuid": "02a9d34f-922c-41d1-a353-f9e3f22af26f", "comment": "Malware payload (Mirai)", "value": "706489aabe77556edc95b2e63b5f77ab72d3cda1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095860, "uuid": "9dd12a72-2782-49a1-a3d6-5657018ce252", "comment": "Malware payload (Mirai)", "value": "f96a406f143e6cc198f972420c57e8935a381cc7abfbe3e3ba72565455a49cb81d313f30fb5233f8db560ff8f9dfab3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095860, "uuid": "35d41e06-9296-49d2-a7ef-eab0fdb1e4fe", "value": "T11DB35BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095860, "uuid": "b5d05816-7b7a-4046-85fd-14b30b81004b", "value": "1536:OTW/VCxsHZusN2Li62C87mKjR5fvPVWARouW8j3W+gJH7n:OytCxsNx62NVjzVWxuWM3byL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095860, "uuid": "19f27279-2644-445e-ae74-bcd4b6d44ef1", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095860, "uuid": "5847c303-7047-40d2-8e8d-116ac29122b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095860, "uuid": "1db00431-0b46-47dd-9a43-647eb15a856c", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469f9742-2eae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775146146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146146, "uuid": "b784dc91-a9e4-443d-8566-ffe39ea5c9a1", "comment": "Malware payload (Mirai)", "value": "ef70d872108e9c710c2deef189cf7fea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146146, "uuid": "5c9d149d-c193-4c31-8a24-d3051b7f92d6", "comment": "Malware payload (Mirai)", "value": "db5cd5ec74a616f4b4e653dd63d6564a99cb9d073c1dc2d8db192af5c1beb52c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146146, "uuid": "b124c570-c0ab-4d44-bee4-eed6f93075b6", "comment": "Malware payload (Mirai)", "value": "3a0307abd146238cc642cfa1396b142eb8c426ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146146, "uuid": "3b578850-88d4-4c1f-b8b1-5ce676dd54d2", "comment": "Malware payload (Mirai)", "value": "950169a60df4650f6831bc2f38afe6e2dffea2c9d23d6be35a2ee87f5a59effce96f8bdf4bc70b144179294e29f26169", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146146, "uuid": "66720f31-4176-4008-b794-bf02adeb8a2d", "value": "T167C349B3D875AF98C614D1B8B0B08F7A6B539A6441871FFE15ABC2B58043D8DF5063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146146, "uuid": "b2dbbc24-ee31-484d-9b35-1f21198c5faf", "value": "1536:OYrNKIRQs+Yj3wo2YClKlTbGBPOYG5tsWdfTGwVe0hdmzb85:tNDQs+fLYplSOrfsWRTG4xdmzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775146146, "uuid": "c0cf951c-930f-4a3a-8056-ba574710510b", "value": 119024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775146146, "uuid": "72f3d923-49cf-48f0-8799-2476efa7e7c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146146, "uuid": "944be103-9e19-4fff-ab53-332c8a1457c8", "value": "udevdpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb34279-2e81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775126806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775126806, "uuid": "135f145e-59bf-4a03-a9bc-7f82a07426fe", "comment": "Malware payload", "value": "6339ea6e9e4dfbefbe70e82bb6bf9955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775126806, "uuid": "e97209f3-10e8-4795-b629-0d18d9b461e0", "comment": "Malware payload", "value": "dc1d06957dd9b29e4c55ed5a779fdf4b45a34dacb86f31611f5f129bb4942191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775126806, "uuid": "55a8fd4a-0df3-4f8a-ba13-ab84e345e9f8", "comment": "Malware payload", "value": "7799c10948f04f3f749ccdbfb3b15a467b5e8daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775126806, "uuid": "37eaab76-3cbe-48b0-a556-4b90c7b8314f", "comment": "Malware payload", "value": "fa6681561c43dc5840dc851b222b29e8322c42d37bbda80537e4fb91fa29e173e1a3f536cc0145263cb6e555b9e00df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775126806, "uuid": "6830d0c9-bc99-423e-9de0-cf8fd95b74e2", "value": "T1E484F12A37EC14A7D9B307B888B31A156776F8901722C7EF1690542D1E2BFC85E34F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775126806, "uuid": "178b1e6e-83f2-48d5-ac46-d8e20d25ac3d", "value": "053f233e499dd415931815dccef4f401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775126806, "uuid": "067306eb-f8e2-4651-a6b9-c7e59020522f", "value": "12288:mIx7N4aqyDY8vKOzUxPkl+I9Yb623En7t3CR:XN4bEKOWkII9YbR3E7t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775126806, "uuid": "77f47120-30fe-485e-8c3e-b9fab383817f", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775126806, "uuid": "0e89f228-3c89-4810-9383-8ee482917c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775126806, "uuid": "e18c2d91-140b-41f7-81ab-df0239ab6a30", "value": "winmm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c339779-2e82-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775127177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127177, "uuid": "e445d45c-989d-498a-9646-e519fa4a2260", "comment": "Malware payload (AgentTesla)", "value": "0da6c59d9955c3d1a4c8d516789abcab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127177, "uuid": "d03323f6-f22b-4539-9cea-a5064a4e8f61", "comment": "Malware payload (AgentTesla)", "value": "dc451dc92ca8c94781031a73a04ff4da5081de8b8e8a5aeb19ac0712d37435d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127177, "uuid": "db462a55-84cc-41ec-96f6-99fd43848819", "comment": "Malware payload (AgentTesla)", "value": "1a8501835ac854e15b91944f171711566052020b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775127177, "uuid": "68c32c32-8f9f-4036-876f-46296362ec1a", "comment": "Malware payload (AgentTesla)", "value": "530bd0f8e48feba09e81df9da9e0282027b0d244258aeeffc6993dc3d685c68ac01a4327ff9d8582879622acbc9efbc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127177, "uuid": "28261b6c-0a12-4e76-9814-35528a88ae0c", "value": "T1FF35AE027381D062FFAB95334F5AF6115BBC79260123A61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127177, "uuid": "45fba99d-839a-4292-a50e-77e5579db6c3", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127177, "uuid": "68e8419e-899b-4df8-a3ca-db49434462f3", "value": "24576:i5EmXFtKaL4/oFe5T9yyXYfP1ijXdaKIlFTzj136:iPVt/LZeJbInQRaKIv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775127177, "uuid": "63d98420-c751-496b-8c62-d87738da4c79", "value": 1138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775127177, "uuid": "bf40e81c-3fc5-478e-bb9d-fa53db261801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775127177, "uuid": "0035afe5-38de-4f30-ada7-875657008cad", "value": "PO E2329-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da33a4e7-2e4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775103444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103444, "uuid": "0fee9184-54a6-43eb-af03-31302eadd766", "comment": "Malware payload (Mirai)", "value": "3c75495aa5137ec86bc15320958687b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103444, "uuid": "842a2827-ea65-4b44-8cfb-cc3f38f9427e", "comment": "Malware payload (Mirai)", "value": "dcc0f652104d6d7f9a078126a3439dabb9d97f2848df64b0bc62f195aa422284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103444, "uuid": "044499b5-6132-460b-882d-13dbee142fd9", "comment": "Malware payload (Mirai)", "value": "998e51ade50a9f925645d41fe3a9732d6268eb3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775103444, "uuid": "76b48a47-e6f4-4efa-93f4-7cc9618e30ec", "comment": "Malware payload (Mirai)", "value": "994d2d63af1261224e3fae69eb15fa8bcae8a8877680c5ca855720c82455a4fa0bad0a0baca9146f08c47f8828eae10f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103444, "uuid": "3e63a025-0085-4846-80fb-10fd4182ade6", "value": "T14AA53338E82FE99FD9D6130B13E35D157EE896FD731DEA49900E44008D7A749A81EBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103444, "uuid": "551e2130-fd1e-432e-a018-b60cefe4d855", "value": "49152:fFOsXsBZyzdfzobYKW8CVQ2DbAvxEl9DBQC1:hXIZEfKSVZcv611", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775103444, "uuid": "04e3c113-df43-456c-93f9-0b2e343e396b", "value": 2074016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775103444, "uuid": "262e4e60-c080-415e-aa36-f4a94a691c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775103444, "uuid": "0fd22a01-8747-455a-bde8-995d9e8b7bc1", "value": "wlan.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2882c1c-2ecd-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775159722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159722, "uuid": "6a45850f-e71e-4480-93df-d99ac8e49f1e", "comment": "Malware payload (AsyncRAT)", "value": "4ee795bbd0116cfea13df445a98f2aeb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159722, "uuid": "14d472f9-1655-4d37-b7cd-8f6f35466263", "comment": "Malware payload (AsyncRAT)", "value": "dce7346008cc7d3088246fe8bb2924315673e66ee6f939941d4ce73c2de16b08", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159722, "uuid": "3b5839d2-07c3-4002-9882-0618db590e26", "comment": "Malware payload (AsyncRAT)", "value": "7a5231bf79a2243dd485015c014b759619bad4e6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775159722, "uuid": "a28ff835-531a-4001-aa38-a3fc276e00db", "comment": "Malware payload (AsyncRAT)", "value": "592024a28424efa31bf094efcb9daf766865acd2731fb1782aeb3750b08843d01943cd6f3831537b858d8e5ba7d1692c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159722, "uuid": "5198d7e2-3596-4f43-957c-cdcf29d97f5e", "value": "T1DF234D0037E8813AF2FE4FB999F11145867BF2672A03D64D2CC442D75623BC7DA52AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159722, "uuid": "a3f45819-b095-4eaf-8d26-c280c26a98e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159722, "uuid": "03aad256-ddda-4110-84f9-e2c43dd4e859", "value": "768:zx1qBycAKs75z8s6RaPYm1vOUcPIncjVOw0bJKml0WKKv0XnIERhPSad1BDZGSmP:zzc5sS6jcMbJK80Wh0XbRhd18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775159722, "uuid": "d0b555f2-6c85-49a8-9134-cff999ee9e57", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775159722, "uuid": "4da8ed00-8ca9-4360-93dc-109e959915b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775159722, "uuid": "b658aa9f-c006-4658-b0c2-87e9980b5dd2", "value": "dce7346008cc7d3088246fe8bb2924315673e66ee6f93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e134d9f-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153568, "uuid": "7a64924d-7b39-40ca-bfcd-aa5d0c23ab23", "comment": "Malware payload", "value": "287783f9a7a9a264ff9f23cc526ed84b", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153568, "uuid": "1137a3a2-95f0-4346-a08c-6a42f927b7e3", "comment": "Malware payload", "value": "e0090765e0ede7abc1c864f565024bf14c07d7feec22803538f6e5a9881b0807", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153568, "uuid": "0dd15632-b6c8-4190-8515-2fbc01d70d35", "comment": "Malware payload", "value": "1f3922fa248c92a6861bad166943504621009fb8", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153568, "uuid": "ddd75377-7128-49e6-bf1b-90dcc7f1d3a5", "comment": "Malware payload", "value": "e7fcbe90ec16519deef4a19ab50eb178b6ca2ede05e7448cfd2e60eb2b42895b9c8e552792b5c6187799d7ce9f978011", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153568, "uuid": "a9f78629-eb7a-4fc6-8b23-62f4f74ae157", "value": "T1DF05338146DE0F88DF3BCEFFCDC0C51ADFD00A97DC68AC9402E5B5A54974D1A9A16AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153568, "uuid": "1742cb26-6f1d-424a-9e71-ca0fc31942c3", "value": "24576:9xGQU0EveUzmh5VQnpJ/H1kP93mlAq3BD:9xGaIzes7M8qkBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153568, "uuid": "9fde5c63-f0f1-47ff-b6c1-9455070bb243", "value": 796555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153568, "uuid": "d8b4280b-c5d6-4337-b4af-ab7e1025e642", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153568, "uuid": "17759327-e6a5-4e31-ae76-84cbcd55c00f", "value": "e0090765e0ede7abc1c864f565024bf14c07d7feec22803538f6e5a9881b0807.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1beab0-2e45-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775101005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101005, "uuid": "b311dc29-c567-4658-b19c-ee064a5fc7f7", "comment": "Malware payload (RustyStealer)", "value": "11c47dffa0039f0ee38b5fbd57d194a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101005, "uuid": "a22892b5-9f17-4c41-8358-45a9038e750a", "comment": "Malware payload (RustyStealer)", "value": "e052bbaba494f4af95ccdd394bfe009ed34d445ad6dc1e249b34eb3a0013f27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101005, "uuid": "5b73b7a7-755c-4ae1-859e-b4ff25c4193e", "comment": "Malware payload (RustyStealer)", "value": "e8fb2e867eb36ba83992ec869cf1e283c7b5ad70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775101005, "uuid": "eb7ea617-9f2c-4333-8865-8e91b2bc3443", "comment": "Malware payload (RustyStealer)", "value": "23169458b775f58238cda99560fc732b516cc0443d8ca73dce635dd7b17a43dc69ef32e5b353045a1f965d01a084c40e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101005, "uuid": "1b4a2d8e-fb15-408e-89b4-88e3cd20f928", "value": "T1FEB57C03E6A581E9D09DC078C35A9633EA72BC8D4930B6BB1BD467112FB5FA06F1D706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101005, "uuid": "f994f1ec-e500-4919-848d-98b269f3bdcf", "value": "03e99e92cdfb731a77586e07b85abd59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101005, "uuid": "cda96e47-020b-4a7f-8db6-f61528c80143", "value": "49152:TfMrWHoOSBfCmnatPvkaUMm8kbvYIU6i:TfMrW50I3kKUn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775101005, "uuid": "e3a5fd6c-92b4-4fbb-831f-b3a448aa26ff", "value": 2494464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775101005, "uuid": "b3129d00-c4e7-4717-a6f8-dab762e12858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775101005, "uuid": "fddf1541-6474-4eab-9c30-3f0b6e5dff9f", "value": "4kepy0t5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf2b448-2e69-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775116738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775116738, "uuid": "e46f5ff8-f949-45c3-a300-96e15adcd7f5", "comment": "Malware payload (Joker)", "value": "4a42ffaad2dc719ce864f39adc8ab2be", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775116738, "uuid": "a994e404-b891-4f3c-bfde-21d20f4092ff", "comment": "Malware payload (Joker)", "value": "e0a99e3ce69173a84146020c48bb3360680a1ffbc85d05ed4548a045176c2584", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775116738, "uuid": "106f8902-8063-40f4-ab4e-8476a2901f30", "comment": "Malware payload (Joker)", "value": "18e9b64ff61a7ee3141d3f16b4d7e4c46d6bd3b6", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775116738, "uuid": "879a9c31-7918-4893-b60b-46dca95be595", "comment": "Malware payload (Joker)", "value": "6a5ca7e4c83a5b01b30c0bd15478437459bb7c27c9d7be990302c4013a92dc456600797ce47183c2c72ab63ad6f0b843", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775116738, "uuid": "6e4fe88c-0297-4231-b5f3-e036dbac02c2", "value": "T1DFF612CEFF0CF77FD57E1073CFA9A166B25320820242977BA914920E6617A854F59BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775116738, "uuid": "14417a86-29f3-43d4-b27f-0b8442db3f38", "value": "393216:1mhqa3QgE3oghIy/mNhD8VhEHzY8nQ7rG2:s00n8bEHz/d2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775116738, "uuid": "0fde9787-c045-4403-9568-59c07832dd63", "value": 15566868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775116738, "uuid": "7645b615-1f04-40d4-ad65-b41102be51bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775116738, "uuid": "6453c0ca-e413-45d0-a8af-ce91b3975491", "value": "Go+Clean+Pro_1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4a9517-2e5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775110560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110560, "uuid": "b127c286-cdb4-4e2b-a84b-fd3dca5e8cb9", "comment": "Malware payload", "value": "69bdc61a1fb3bda7aed9dec60898d5db", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110560, "uuid": "762f8ef2-e0a6-4ec9-be1b-a965c0b9b7e5", "comment": "Malware payload", "value": "e0bc750d98934bbe4012098b1c6888cf87556d7fe329c1119fd4f3917224d9fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110560, "uuid": "73f9df3a-165d-4909-b114-fdb3cff29550", "comment": "Malware payload", "value": "50142a938c59dfc1e81655202363075b5074ed35", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110560, "uuid": "a3121407-877e-4f5f-86fd-d9850714c162", "comment": "Malware payload", "value": "7400bd9eda5286b9361f4e2d45b31f5f238b82b35aebc848c74ca9c5f9b0824a77f739fd5c51e0e258c6add02d915819", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110560, "uuid": "d9db158f-10f2-4460-9f35-cdded3154251", "value": "T1C506021189C42FB9CFEC561C90FE161EA3F04E8A506A798EEB33BD47AFE76005117199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110560, "uuid": "a71a7d95-b45f-4557-b050-890c936dc6e4", "value": "49152:y6ALk8cu1EDTZ1SroeHRcGBpqGasD+2rBDOG5kONUZOhBg/QL:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775110560, "uuid": "d88cc5bd-fec5-4ccd-82dc-5f5d461e257f", "value": 3813210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775110560, "uuid": "17480540-1fd3-44ab-8a77-5ce0cfdbfa30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110560, "uuid": "aae8f03a-b5d1-4e1c-844b-7b8eaf5e7f6b", "value": "RFQ Import 05834 - QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1899a1a-2e78-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1775123133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123133, "uuid": "0192b51a-e59e-4203-ad79-154180fa047f", "comment": "Malware payload (ScarfaceStealer)", "value": "a0da80edaecc0d36882b2b3d7d4738b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123133, "uuid": "bb66bd68-c5f0-4d7c-98bf-ecb532c147ca", "comment": "Malware payload (ScarfaceStealer)", "value": "e138cd5302d28a0a83734a3f0b4796e92b38346c4db858b9adb2f2a78c055358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123133, "uuid": "86a18eae-f214-4b82-9eef-6515f672752a", "comment": "Malware payload (ScarfaceStealer)", "value": "6b5eaa9394a41e2b0a43b66ddb82d7800b220d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123133, "uuid": "c462c3f0-4c24-491e-8c54-3b28895bc4ce", "comment": "Malware payload (ScarfaceStealer)", "value": "a8f575b7e7a9773550fd1921eabbc877cdcf1e84084fd2bb5394edca4d543461a32e3f14822de438cb6f86baf300cc1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123133, "uuid": "7470e3e8-239f-465d-a89d-273ae57bb75c", "value": "T1BEE622E981D513E4D5E30B80764E53CB7190B15E06FEAC293ADA1C42AF32DAF464AD73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123133, "uuid": "d10e7bcc-f254-4200-9946-b8e09393d40e", "value": "0a7acfc4ba674990cad95086520760a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123133, "uuid": "555b3933-7425-499f-b375-983072ec216b", "value": "393216:/EIg5QeKyUSyFN2zpWzUTn8W6nQjd/yTEt:sIg5QYANVYr6nWKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775123133, "uuid": "d03691c0-4eb5-4ea7-aceb-72cb3c99ec42", "value": 13951936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775123133, "uuid": "46bb1ad8-5699-41b5-bda5-06f300f2e0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123133, "uuid": "b0eb5511-d0a5-4a0f-9a97-f28c6e9b443f", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a24a097-2e5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775110209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110209, "uuid": "36757a32-33b8-42e1-9a24-ea8183fd2504", "comment": "Malware payload", "value": "8875f1d80a3768d9412f5ad6f7274baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110209, "uuid": "db528cfe-4ae8-4587-adcc-11eb77ddb37b", "comment": "Malware payload", "value": "e3517161e4c12d2af77b34a6289954416f3aca76ccc176247ac5599d27743e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110209, "uuid": "1f7f1896-cbe8-4ded-ad61-0f485d19ee89", "comment": "Malware payload", "value": "8165f179821b825286ae65678abd2e7b4db41898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775110209, "uuid": "b8ec36f9-6ffe-4413-a691-b7190a209e62", "comment": "Malware payload", "value": "e8eeea1a36e0dbc65e316f6f8c2eca430a0ed5fc0c51b6f57470d5fa13f47e9001f21a8cd25e6d001e6944d50ffca24c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110209, "uuid": "fe56c24c-2e7c-49e0-923c-fbbce00b5447", "value": "T10A85BFA6F3C866D9D51BDA39C711A332D1B2781247B2B0CB0A9A17491FB7FD05B3A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110209, "uuid": "7616d040-1977-4c89-a8f8-959d51774f34", "value": "77e4126fe49c03de7cc365c60f460a12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110209, "uuid": "77c02b45-31ca-4631-a352-94d951ded318", "value": "49152:/5itD1G63QnE0ojj54WE9JfMaff8BJaZdKDN9:VFiJ4WE9JfMaff8BJaZdKDN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775110209, "uuid": "6bed3c3f-2d78-4dc5-89eb-7f5048ddcaa0", "value": 1713664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775110209, "uuid": "a7b33c3b-8337-4e05-8699-6510702c7407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775110209, "uuid": "98ce55e2-a69f-43f7-b302-a73e0bb57e79", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e87edae-2e66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775115209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775115209, "uuid": "4827a9f7-6178-46b2-a1a3-8af68464ab3c", "comment": "Malware payload", "value": "86646358fc93fa956e9183aad6d3255e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775115209, "uuid": "988c823c-cb1d-4ebb-b6ce-c89670d71b20", "comment": "Malware payload", "value": "e358721387a20f276f3c84c48838b653fadae24e2b939df590cb3ea56a0bc203", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775115209, "uuid": "e59a48b1-2ed6-4918-855b-3a4c7b143841", "comment": "Malware payload", "value": "b73e9b78821b75a5f96c4dabaf6f21a79c6ad784", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775115209, "uuid": "a188a77f-db3f-46b9-810f-98874cf199e7", "comment": "Malware payload", "value": "0d0d2f22fcc3f27002b0e477acf7277dce2ca16405af8c432e8e81674b5e038eef7045293f07361a441696c945a6b935", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775115209, "uuid": "55a9fe5b-64f8-41f7-8833-dcbb0237662c", "value": "T1B754D004EBF6005CF4729FA59ABD15049D3ABE322E0DE8DD41184DCD0AB6D498E7AB37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775115209, "uuid": "5b98dc9e-9e35-44a1-bb00-e2f144e61e14", "value": "6144:Eki8rAAyrjHiLWO9CbdfEgDgoQ2jWS1iRXDD/8C4fgsHiheqODhl:Dp8AlLWOI5f5QEWS2X3T44spqODv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775115209, "uuid": "cd8e7b7c-1068-4ef9-8c69-83a55d3634c5", "value": 290494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775115209, "uuid": "1861af0c-1d70-419b-8777-8f95c87e99a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775115209, "uuid": "c6c97190-a6cd-49b6-ab19-8b76f339cf9b", "value": "Bank Swift Payment Copy -TT4001770818033383452903509007362_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9ceac6-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125356, "uuid": "bf1ec514-8bb0-4f98-a803-38cc54d6f5e8", "comment": "Malware payload (Mirai)", "value": "b8cfecd7a5fa2ec03113038c55820cad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125356, "uuid": "e3410e69-438b-4af4-9ba9-de4da7875b61", "comment": "Malware payload (Mirai)", "value": "e3637f0db2bd19be2eecbe94ff4ff34e35bce8a4d2f3325c0eabac2811fd47bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125356, "uuid": "0cf57ef3-fff4-480c-94fe-b978a081785d", "comment": "Malware payload (Mirai)", "value": "e369bc0a8b968db3665475136c267e91a0c8ef78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125356, "uuid": "8345dad6-1d15-41fe-a09d-b30428e2acf1", "comment": "Malware payload (Mirai)", "value": "03a8a6a5734a57db5559eac59777d53eb12ac2f4d67abc704bb3f38b36bae0b9e91e2d7ed37dc1990b72b56bc46de100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125356, "uuid": "5ec2c49f-1994-4c0f-8785-fe295af08d3a", "value": "T19383C716BF650FF7EC1EDD3B45A8170625CCA50A22AA6B363538DC1CF54B24B46E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125356, "uuid": "e0aa9b09-b377-46d7-ade5-5469621e3a48", "value": "1536:pk7eNroj9ckBc9ia4JZPLq/WlCLmL3Rcz6/5s6L3/EKgZBTGG:plNroj9cIcka4JdLq+9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125356, "uuid": "018507b6-3f3a-403d-a7cd-c68a541a3880", "value": 86208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125356, "uuid": "61f16636-f702-4302-beb9-71c1f563ba0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125356, "uuid": "4b45eb8a-45cd-4d77-9cf1-5faa0b2e9ac4", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb4721c-2ecb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775158671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158671, "uuid": "ca186303-bfe4-46d7-9376-cf298728824b", "comment": "Malware payload", "value": "a8191ccb3195ebe01dc0590395f8e2b4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158671, "uuid": "6d8758d5-fc8e-4083-9648-f1c181a97683", "comment": "Malware payload", "value": "e5301437e8a76f87a45f98fae2d0f0888701c18833a3368e81632a651c71beff", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158671, "uuid": "48c7e0af-0195-4633-9781-321e51679a30", "comment": "Malware payload", "value": "801034b48cf67df9e2b4ebdd75e0369d8c39a259", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158671, "uuid": "995cb75e-6678-4468-8d18-1552e950375c", "comment": "Malware payload", "value": "6880e351564b428c31b738ce156c0fada0819773d6238b9c29128f9c41f7ce698aff18922e6f481a12700224e19ca731", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158671, "uuid": "7009c91f-3436-4ca6-866e-bb256253285c", "value": "T193824A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158671, "uuid": "d5585591-8a37-405d-9ab2-c37bf7c5f425", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158671, "uuid": "0dcc8355-0b16-4d95-bef9-014f616200aa", "value": "384:/I78VGI2VxOwflsx0pu9NHRgqav8U9cc:wHdsx089na0Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775158671, "uuid": "7482555b-b1ea-445c-bf0e-a861e7172a96", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775158671, "uuid": "79f0a486-87b7-4be4-886a-c252ad15f25c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158671, "uuid": "faa6ec34-dd01-45a3-8b26-65a7871785ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ce602c-2eb2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775147751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147751, "uuid": "75a4347f-1b81-4815-a876-20e7042b59ef", "comment": "Malware payload", "value": "194e21c08b0f6f5f8d756205b14dd9c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147751, "uuid": "dda97ca3-fa17-462e-b0ad-c49aa23a3ea1", "comment": "Malware payload", "value": "e5eff5e950264f13829017e37e9dcef8a747e6da6486955476a463ec87f88631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147751, "uuid": "cd20e5f1-6bae-493e-b6dd-0ac990c5a758", "comment": "Malware payload", "value": "cf7c76a830c71232ed78c0b3dbf510b98285b906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775147751, "uuid": "59b64e6a-c0df-4551-8b16-d7e16707d934", "comment": "Malware payload", "value": "be7a898185cb08cdb28b29bd42433bae62f7b66e048934adb56366e7336397272d1e8415483021fa00800ed680316053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147751, "uuid": "654a5992-adc5-498b-abef-a063a19fa23c", "value": "T1D66623A35B2E4E63E4B77D30A7902D4AE2544D304A16EBF3F8A3088B27397E49D1C55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147751, "uuid": "bb143b45-e92e-4efc-b4fe-25f9c41d29c5", "value": "b2858eaf97b6c1bdb33cfa7afce02884", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147751, "uuid": "fa731256-c122-43b8-967a-2a5ec1ede933", "value": "98304:GKronjsgGqqIbMPvXjk+RmGWcbiUeG/MHi6nP7tOnZeObL15hCZsGRLZspZIdKjb:GMoj/tN5+Rmv3iCP7mjLHhCypN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775147751, "uuid": "bf0766e7-9988-455d-997c-d6537571d37d", "value": 7087632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775147751, "uuid": "bca1c124-2e91-43f2-8809-25122458c972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775147751, "uuid": "ad5a8d31-52c5-4899-a887-7c2fb129eeb4", "value": "AZAZELLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c5903d-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125395, "uuid": "e6d15b9d-569d-4dee-bbd9-d924e156a87b", "comment": "Malware payload (Mirai)", "value": "a15d6e6a5469cda7f9d5cba92a09207e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125395, "uuid": "b4a089f6-2669-4dcb-a430-d5390fade43c", "comment": "Malware payload (Mirai)", "value": "e79bce3e2cae2cea2a701e3eb11e8adcbe268173251dc4717ea2ff1e3affe737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125395, "uuid": "f3d4ea00-50ac-4074-8a2a-5dcc5c04318e", "comment": "Malware payload (Mirai)", "value": "f4b90225368bec6d45dd60ec95a5096628c66db7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125395, "uuid": "d15ca4f3-aef7-47cb-9a88-7b22e7e15f61", "comment": "Malware payload (Mirai)", "value": "87afdc0c8e981a42a55a7897c290ad86fedb8bea25d67bb0807b5fa9e73a39ac5d310dfa45cb2dbe979f83ae06824c95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125395, "uuid": "9a623f47-6008-460c-9b72-6f1b2f52fad0", "value": "T146C3C74E6F218F7DF368863047B38B21A75933D626E1D685E2ACD6005F7034E245FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125395, "uuid": "36dea90f-56c2-450a-8609-f5cc5eaf4f8e", "value": "1536:o8cT1Lkgwe4eSZjkap6Ijj/Cr0ubgpa5KT4qLHR8hXVPe67c529tplSM:o31LPwvJkCPeS4qLHkXVh95F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125395, "uuid": "9d7ec04f-5427-4334-9e5b-24556654259d", "value": 118400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125395, "uuid": "59abb37b-baf7-48b1-aa5f-0279720e040b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125395, "uuid": "e77e456c-e5d5-4836-86cc-1832b0b5da1d", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a98b0b-2e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775095845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095845, "uuid": "e958a10e-985a-457c-990f-4e58bc888712", "comment": "Malware payload (Mirai)", "value": "8f81a5751ca63ca929474b82e49c0231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095845, "uuid": "4de3a846-8b40-449a-ad1e-c8f1f37344e7", "comment": "Malware payload (Mirai)", "value": "e7c9694251858e8272691b8ff1293b16af2b38cb1cd3e12e324d2d115e60b1f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095845, "uuid": "9798db1c-904c-4393-8b38-cf8782554ff5", "comment": "Malware payload (Mirai)", "value": "b2d293de9cd61297d2d9a397d965676a59f7b5f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775095845, "uuid": "db0e1a2c-4c98-46ae-841d-0db82fd2aa60", "comment": "Malware payload (Mirai)", "value": "253ea171e68408c53e525b7580a6ef16cc8acb3747dbe3ff191603aca45de79fcf69785ba1392bdac02b87ea1817d2e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095845, "uuid": "cbc46611-eae1-4109-86a9-afac7af70f36", "value": "T166937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095845, "uuid": "d0760839-12e7-4288-9879-6e0137ea0fcc", "value": "1536:W/QCZaxGdvts3i5JPhoRsxPu++4HRsUIKqI4FrS4LSJ:WYCZa8dvm3oJPhssxP5lR+KfUmDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775095845, "uuid": "c3f96c18-b7be-4a18-b8cb-b4510ede8c69", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775095845, "uuid": "e372390b-dfdc-4911-bebf-c7fe4245a0ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775095845, "uuid": "bf5e156a-bce8-4a3c-a0f7-5f260d196dba", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b1e13f-2e8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775131168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131168, "uuid": "b26cf9e0-3458-4ef8-8dab-99718497f07e", "comment": "Malware payload", "value": "f88a2e1126f608473a478c5ed455a098", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131168, "uuid": "114fc2d8-ee5a-45ed-acc6-38e979e1227d", "comment": "Malware payload", "value": "e8ef50a1799265d3aa15294e41b66a143205f010e74efdb7915dec21f4bae063", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131168, "uuid": "aacca0fb-4706-4314-b59f-4c86f847622d", "comment": "Malware payload", "value": "c50916cca6b8957028e416e5bf6ef34f7b353a04", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775131168, "uuid": "535d6154-e390-4bba-95dd-6c8018657844", "comment": "Malware payload", "value": "8ec4cde6c014513b5bb6be42d8e9591d8fe6055f4f323146ce243122bf2aa157a2e064b4d33770bb8a37bff1bca4a33c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131168, "uuid": "042cf1ad-1f2c-4081-b75f-d4e1faba7f2b", "value": "T1A5E068D4105A18E5408C5C6F32B7A00859CA9B8ECE065FB8BCAD70B7A728F04F0C6080", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131168, "uuid": "9d81bc54-6e2d-4eab-91db-a6e2eec9e8ff", "value": "6:hMfURpv+iFnT7vZsdqaIuOA9yDB2/vXUgoDu/oz+Q7ZYLdyr:uQvDvZ6Iuz9yd2nXeDuin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775131168, "uuid": "71b23943-9dad-421b-9893-64b304192eae", "value": 416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775131168, "uuid": "89c1a77b-e9e6-4e4a-b9b1-fe3f71581e0e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775131168, "uuid": "33039acc-b44c-45f3-aaf3-aefeab0e65cb", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426bc5d6-2eae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775146139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146139, "uuid": "8314d35c-8319-45b6-9a1c-a18ad72beace", "comment": "Malware payload (Mirai)", "value": "10ca536e82aa923cd29eea3d79d2b017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146139, "uuid": "07ed8bc8-ddcd-47e9-8d4f-9b961ba90154", "comment": "Malware payload (Mirai)", "value": "ea30784fdd6b41e70695c26f603a19f4535ea8548bb0b0189728e4b7e531ce4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146139, "uuid": "ef532841-221a-4bc8-b1de-a8a5240caf9b", "comment": "Malware payload (Mirai)", "value": "47b00e2fcb9efe48427884620d6839476ee8ac41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775146139, "uuid": "0390d9f4-cda5-499d-8efe-b7c4027e295a", "comment": "Malware payload (Mirai)", "value": "4759d5528d03ca4d9fad20a1ea8a77a6e27ebb3f13d5a00c66b6979c9270090add300c12735c811c46732b0bffdaf0fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146139, "uuid": "d2fc84d8-186d-484c-8013-7b271f04a3b4", "value": "T1F6142946EB404B13C0D72BB9FA9F43153323DB5897E773069928ABB03B8779A4F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146139, "uuid": "3643c28d-c093-48bf-be3a-80dd4d3b3bf9", "value": "6144:CiDbm+KNe8W8ayGeVOKN387Aq+CHRPV/G7l:CQmXe8W8ayGeVOKpYtt/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775146139, "uuid": "b9ea7c8d-9850-45e7-be3d-76b4b78228b2", "value": 203746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775146139, "uuid": "31c7d931-dd19-4cd6-9d71-b9965a31037a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775146139, "uuid": "bc12cc55-8fd7-42a3-be81-010109233691", "value": "net-workd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ef16b1-2e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775137074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137074, "uuid": "d5d82671-e260-4442-8d02-406d83bedbc9", "comment": "Malware payload", "value": "8f3a7333507cdb65756661088a50cae0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137074, "uuid": "efdf618e-cca5-46fa-9d4f-ca286518250f", "comment": "Malware payload", "value": "ea4043b07992e4aefb3e15b2ef3ddd71de315109c01b4230585cc213ab6ec3dd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137074, "uuid": "31b601c7-adb0-4c0a-80cd-02da67ac888e", "comment": "Malware payload", "value": "36cdb1e0c3b68d4470f85c8e3573a67c1000a06e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775137074, "uuid": "0cb3b28c-956f-43da-997e-acf7fa40a417", "comment": "Malware payload", "value": "ebba78f5dd32bc6bc4c3005b8bd3194d67c2732d2dfac39cfc76c9941caaf65854a4c6484308b819770260661a673478", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137074, "uuid": "077ba4d6-c5ab-44a6-b46d-6135586ed214", "value": "T14BF1F05E7A0491683BC94C296E3E56503523518F02117FAE243FE1BF5B707E5ADEF086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137074, "uuid": "eb6d5911-afd5-4ce3-b510-1bec9b6289e2", "value": "96:CkydYEnmtlfipmM0NVXzPz7gFTx61zW3i4cxr3EUg:P2+VMFwBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775137074, "uuid": "19bedc98-0846-43a1-8c32-9f8b8a45fc88", "value": 7512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775137074, "uuid": "a7508782-0e1f-4651-bd27-50c657823556", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775137074, "uuid": "68712fb9-0106-43ed-9e54-ffcd8d4ff18c", "value": "final.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16eeb0d-2e92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775134300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134300, "uuid": "dd750ddf-4bd5-449a-8e5d-67150f083806", "comment": "Malware payload", "value": "a3c8c24a8ba0b47500b306b41a2bf17b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134300, "uuid": "274ac308-4198-4336-a8a7-df4d19e513fa", "comment": "Malware payload", "value": "eaf789000af11f99a7ce38d5532de054e0812b828cf079859550be8abd710af8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134300, "uuid": "21e25130-f672-4d02-8e82-af98b69342ad", "comment": "Malware payload", "value": "63d631b63807cf4bbea97406d7b9817b80129d0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775134300, "uuid": "e6de1361-02f8-450c-8194-66cc15e35e22", "comment": "Malware payload", "value": "ec167f38a79080471d9f269768eca95cb5f590e60d4079d366f2402d1c443f82d1a476f6492402c334dcccb6e0bd0797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134300, "uuid": "c967a317-9ad6-4f98-8d13-c626e92bd5d1", "value": "T15587F1167788D0C0DA3E55F0D899DBF729DD9D2EDA60B00F925A3E6C3D7238A10A64C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134300, "uuid": "d144415d-f091-4883-9d90-7b07b5c8de76", "value": "e8b99f461e778d33b7b0a1a17aea7f34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134300, "uuid": "5d29ac30-563f-44ca-af68-56d0e08e3873", "value": "786432:abMAcHikZ91xOH/4ErxzdRYsLG1KJX6O+GsyB7OvE5CdSL2Jc/DP3:abwHi0Uf4ErxXJLXpXkvE5lSO/DP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775134300, "uuid": "06cdcbd3-981e-4459-a59f-c5e957c94dcf", "value": 37458544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775134300, "uuid": "424fb516-c9d5-42ef-930c-0df4e6711990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775134300, "uuid": "3e058d6c-0621-4a03-bb02-fd173acb286d", "value": "CLIPStudioPaint.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071abb43-2e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125424, "uuid": "c7c10754-7025-4cd1-a910-5c999dfddb23", "comment": "Malware payload (Mirai)", "value": "4927ef7a8f28c2c89ffdad3f79396031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125424, "uuid": "9c843cc1-8078-4b6a-ae3c-d4a63d46642e", "comment": "Malware payload (Mirai)", "value": "eb594c3643e6a3f402cbe04539b8526374acfe261e7a150a48ed3d5d7f4ec655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125424, "uuid": "8b52c734-ee0d-4a4b-bacc-6f61996b0456", "comment": "Malware payload (Mirai)", "value": "0d70a52eb89f0cc9fa9f26b8b5d3ce9cdbd1f394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125424, "uuid": "73356068-28f3-4523-ac0c-24c18b0fd5d6", "comment": "Malware payload (Mirai)", "value": "453baa5190738eac668ff27eedeb464fe671e8a23952baef494a1251a67cf695de65fe6f05d445ed0b69e21e75c4d466", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125424, "uuid": "a747acba-bb8d-4d49-b9cd-3c5856c4fd8b", "value": "T1DB630803E98981BDC499C1758B5FB13EE53B743D0239B2973785FB226D62E20CE1E985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125424, "uuid": "4d84cbc1-01cc-4336-bdb0-a329dc8e5a57", "value": "1536:dp+wgroX2O8VLwI9QSoJ3IcIcUunjktdXtXJMxSQ3DQr5K4QwPbxYE:dp+wQA2tVLwKQSMYcNUunQdX6SQc/3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125424, "uuid": "66ac5590-7468-452e-9925-69e7d280fa6c", "value": 67192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125424, "uuid": "c9dcb7fc-380d-4177-b0bf-ca7179da39be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125424, "uuid": "91e98100-b250-46f3-84b9-33ca29776471", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1751d3e1-2ec4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775155516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775155516, "uuid": "df11262c-7248-4e5b-9e95-bfaab9d4c8db", "comment": "Malware payload", "value": "a484f7c51eac28a7d465b2b44135b5de", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775155516, "uuid": "ac1b1a28-db59-4c0f-b718-eab13fbf4a8a", "comment": "Malware payload", "value": "ebf93fa97159a29f88d1b04df6d55b7f485c86c7193d685a25e731c2f9f9aeeb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775155516, "uuid": "bc509a00-5011-4024-8f7d-cff4e26c3678", "comment": "Malware payload", "value": "73476cfebf73f986c9338f9320f85aedae391cac", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775155516, "uuid": "ade84b33-b836-4299-bc88-5dcccb7672dd", "comment": "Malware payload", "value": "fd61477352177e396c3ebabc1b6cd413bf320c57ccb446fead76b7b2e6182b0ea6cdce235fa8f4151c8d3195113d7f3a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775155516, "uuid": "7134d695-3534-4566-8737-d35def6541e7", "value": "T18D168D00E79406E4D077D634CA2E8332EAB07C556B35D64F2659E7172F33A948EAFB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775155516, "uuid": "2b7f3207-ad9b-4ef0-9844-50c72ef80d22", "value": "b1ebc8ec8a5b7eeed45f482c1fb251d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775155516, "uuid": "b8f6eb7d-69e9-496b-ab17-73ad7c841f53", "value": "49152:8TZWX+BErotm8xamXT/dxOjMXP3TXSuRZTHIZZriqHXSQKhXEk/2wxZq3jWXHjxY:iirHiT/dkoFRMf2saXjxO6yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775155516, "uuid": "f060c793-f53c-45a9-8824-120d53c419b4", "value": 4408832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775155516, "uuid": "5e87bf24-e5d9-4cf5-94a8-3c462329c150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775155516, "uuid": "b9b4054d-ad11-4fd4-a71d-60876b0884e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5328c3-2ebe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153108, "uuid": "2d69bc70-4e97-46c2-bca7-3436da6b9fc9", "comment": "Malware payload", "value": "b0449f002413531fcec8ee70a83837f8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153108, "uuid": "37ed9ecf-478c-42c1-8209-a3b0aedf3502", "comment": "Malware payload", "value": "ee04c3c25cbee4fd131f65239b60c2c94db0428e86607c0685e7c610376b34c6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153108, "uuid": "7dd5bd4d-41d1-4aaf-b5db-32beafc06df2", "comment": "Malware payload", "value": "6131ac02e5d8a14f22046e7743cbeebd3142f32f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153108, "uuid": "bde1c899-caa8-4c9b-9c04-b2327e708d84", "comment": "Malware payload", "value": "104bdb8c69099a9c2a6d700a8e30cdea6282812a8a68b834409ba1d268352585952c2163916e962808fc976f80143408", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153108, "uuid": "cba348a8-17f4-446f-9d96-ec553f3ac30e", "value": "T108A20806AA56534AF4B1187553B72E356439BE32270D94CFEF900A391274EE0FE3739A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153108, "uuid": "e1688ee0-2714-4bb1-a504-f8636ed76c9a", "value": "d0f945da54f20d8bcaf079f2d6ea9f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153108, "uuid": "dde8d572-2975-4877-8d5b-f03d993b8e46", "value": "384:Hu1OuPf4/S1fUrQFYhJ4JVB0WsNUnwnR:HNuPf4/IUrqY+xsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153108, "uuid": "d384becf-5f03-4e57-9eec-179f1e29325d", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153108, "uuid": "0f46a07d-0fd3-4714-b7bb-1a7dc54173cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153108, "uuid": "079baaf3-8668-460c-9003-8c7876469b84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ed5a91-2e86-11f1-a769-42010a9c0008", "comment": "Malware payload (Vi)", "timestamp": 1775128984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128984, "uuid": "9f61a4a9-eea6-475a-a285-54089eef8246", "comment": "Malware payload (Vi)", "value": "fdc2652f2a4f941dca7cc387e9a10f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128984, "uuid": "91f69deb-9641-4bef-b172-296fb09710bb", "comment": "Malware payload (Vi)", "value": "ee0b9fbdcfcf4fed1f2e960539b06e76cdc600240596b186f24561028691c34e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128984, "uuid": "7b54d2da-3fef-41f5-9285-f3777474e3d7", "comment": "Malware payload (Vi)", "value": "c919e57a1b57140e8bd5437f088d0378318400d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775128984, "uuid": "5cfcfc65-022e-497a-a21a-a98a417e5226", "comment": "Malware payload (Vi)", "value": "30b39048664e1812712a5a9827ab8f839a6718495176c70c9029fac87d2025f02f4d14166c10137ee550fa30687a2c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128984, "uuid": "e44ac0cd-d9b1-45e4-b040-c58d31284f93", "value": "T14F959C03BCD061B5E5A9D23289B141A27770F85A0B3177C32E55A7B82FBB7D41E3A394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128984, "uuid": "a4f8be13-8424-42c9-938f-7dcf42c1d9fb", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128984, "uuid": "07d2b420-1607-4aef-b0a4-088da6593d55", "value": "49152:G+4x8YQMw45ONS3sK2gtOqUTMYgtWKK1:6l5r22OqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775128984, "uuid": "6d6e3c57-6f85-4bee-a9bc-9cb6da0746e4", "value": 2010112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775128984, "uuid": "5c0245c8-fe7b-44a7-957e-e29f504f5b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775128984, "uuid": "4e05ba03-0c75-4aa7-b0a0-80ed5c3ead2a", "value": "masterin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647759f7-2eb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775148344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148344, "uuid": "ac7c2e8e-861b-40a0-b563-d0b21aae9c2c", "comment": "Malware payload (Mirai)", "value": "709a1136631fdbd706b76bb981d8fcca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148344, "uuid": "0823c542-d6e3-4c23-9725-3b003e35718b", "comment": "Malware payload (Mirai)", "value": "eeaca1b194058fb37aeaeef21ab455c2f54b798a1f7128f767bae38e1d7a638f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148344, "uuid": "30d2eb22-99e6-49d5-ada6-1fb25df04861", "comment": "Malware payload (Mirai)", "value": "bad67b1471fc5cb5cf3c63f6bfbc2d590f7d3284", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775148344, "uuid": "ea926779-a02e-42c1-a835-37830317ebc6", "comment": "Malware payload (Mirai)", "value": "66a5e4e4ff40f91a2333791f22abab078d63e545506201a2b743e6ec06cb28716b93fd0e66230e4b6a213caa22369bec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148344, "uuid": "df7dac9a-4092-4d5b-ac6b-1747de587fce", "value": "T195F0F484B3E73283CDB7B918BD018440625ED787997A6B2C7CD07BADE4D9709A001F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148344, "uuid": "bc5b20a5-ae68-4e15-9bac-df5d256dde3c", "value": "12:bLqLuhLqL53LqLRNNIhDLqLoKLKaLqLwtLqLcE/D7LqLcHLqL2IhLqLV3LqL4hLh:HqqlqV7qfNI5qvKMqgqHbnqgqyYqB7qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775148344, "uuid": "9a392c3b-92a2-41bd-ba31-9095fcdc0767", "value": 636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775148344, "uuid": "94277e4e-fd51-4a9f-8b47-f3ad429829a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775148344, "uuid": "4d18e405-49e3-4d21-ba8f-d11aed2d3997", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65d83a7-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125315, "uuid": "1580d723-e724-4f80-8737-147878b25607", "comment": "Malware payload (Mirai)", "value": "9837f5cc883b09014a5094f079cd497f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125315, "uuid": "08e281de-55ae-42b9-8687-32a026e54da5", "comment": "Malware payload (Mirai)", "value": "ef6a8cef23056da7bc68c5337a291d6427a66edaf3a4561e6d0ae798bf458c64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125315, "uuid": "57c9bf94-6f7f-4db3-b931-a6ee39bc8c19", "comment": "Malware payload (Mirai)", "value": "2f9775e859e1eb3b08e26120127807071a3c716b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125315, "uuid": "a6561a6b-4a2b-46e3-963f-03d379856c03", "comment": "Malware payload (Mirai)", "value": "072075b73c2c8ef647d4a987e662bc75ed46d308549d0750526ed8d7bacc5192cc7656919a33dff010597c0a68a97256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125315, "uuid": "c7e05eed-2e6e-4c61-9182-62faefecdf45", "value": "T1EB933952FD818662C6C126B7FB5E028D376613A9E2EE3203EC256F2133C795B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125315, "uuid": "c612d830-6cbf-468b-80e5-cb1adb0fa6cc", "value": "1536:Gd46YWRpzEaVstYJlWtjlItx2Bq79bwFJc7Bf9h+eJCQsiEzjJ:Gd46Y6pzEaZeS2BY94c7kCCQlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125315, "uuid": "a566657f-d28b-4614-be57-7179a3e74937", "value": 89852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125315, "uuid": "eb3a24c3-189a-4524-b745-83c6e5bbbaee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125315, "uuid": "1c1c57a2-31ca-41d2-9aeb-b36b686cf210", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13d9965-2eac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775145547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145547, "uuid": "718e0daf-7d99-4279-a88d-94a0c1e01207", "comment": "Malware payload (Mirai)", "value": "c4126a5ab0aad0d38294ccb2b7a0b363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145547, "uuid": "02c2b6f0-4964-47a6-97b0-6abd5237c0f4", "comment": "Malware payload (Mirai)", "value": "f004e582d80431ba890cb4be7fa18d512de32c386b4356005b467874a5904f0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145547, "uuid": "a8a052d1-ed03-4085-a4e5-15a642b98924", "comment": "Malware payload (Mirai)", "value": "8414786d7a6ecf3e13b14933e7f5e0b4cc290536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775145547, "uuid": "4f6db1b2-7c9c-4a14-b3f7-9fa645546446", "comment": "Malware payload (Mirai)", "value": "75aac716e53d9467daa41b2d71bc501574e3bfbadce0ea37e00eea41f3048f3c15ca59adf28f70e61b9a5d749081aeec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145547, "uuid": "9b34a4f4-df48-4c5c-80bc-47fa41cafeb9", "value": "T1A1935CC8E783E4FAF85205B221765B32DBB3D53D6029EE46C3AD9835D872401D71A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145547, "uuid": "8e243513-3014-4339-b77e-c918ed4e6bb3", "value": "1536:8t8aq1/rKthtKsjfh/a6T30eAQpMzSWgevmLS5X0q:8t8aQ/reh1j5S6T3EQi+xGSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775145547, "uuid": "c8555818-1a6a-4a19-b565-1d0141dc3929", "value": 95212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775145547, "uuid": "3295bb19-a58b-4eb4-b28f-6fa9bfd3dc60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775145547, "uuid": "a99bb45c-ea86-42a3-983f-0cbea39d268c", "value": "telentd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86008594-2e9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775138951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138951, "uuid": "b518607d-3409-4c77-9854-97eb5854461d", "comment": "Malware payload", "value": "c18ae7dd1be0f10a24dd27df5c64faa2", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138951, "uuid": "dd9e0a7b-947a-48f1-97be-c593e102b4d3", "comment": "Malware payload", "value": "f0a0ede5c82707f50968e5778d1f5c690f5d2b11281339d8f38300a60dbfa982", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138951, "uuid": "3e67b9cf-d2ed-483b-9c3a-598a801c539c", "comment": "Malware payload", "value": "138aad182fa5d9bb6ce4b2053037efb8bf132719", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775138951, "uuid": "9be8b028-72fe-4716-94ed-1cf79e669b64", "comment": "Malware payload", "value": "5e71eabb0417e4a8b84ae8a8feb724fb25a4d843b77664b56cf26701abbb4aab8b23c49f97e46fb74db58859e8e01c44", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138951, "uuid": "14a17450-15d9-423b-be3a-002306ddcad6", "value": "T10BD3BC2E25DF02D085D2A8D04AF66446FF731A2B452CCF64772EF6B55F111EEE0AB1A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138951, "uuid": "05ff72af-855e-4f4e-8a3d-07da95ee1615", "value": "768:bBAlY79VY/XMpcGNerggenAAUv4nTNWeReyeGeRevmeeeZkT27KR8DoTirVe4JrW:cYo/8hvZkT27KC/+hSSTS/898+v/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775138951, "uuid": "99346f44-ccff-4aca-b483-bbfcd6afca8d", "value": 140906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775138951, "uuid": "2ec7a4de-b856-4934-9bc0-49b8db96e4e8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775138951, "uuid": "1037de14-5fd7-4e9c-a1dd-e1657e76666f", "value": "School_Report_Clean_52.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd06ef9-2e8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775132686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132686, "uuid": "621ddc63-0cda-42bf-b363-367baafb4d45", "comment": "Malware payload", "value": "3ad3813b6d76db98a0d89786a299b798", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132686, "uuid": "589af8b3-53b7-48ab-86eb-44632a34180f", "comment": "Malware payload", "value": "f36542b449e0b164bf0927d48bd934aa0e66bd2fab483f532cf2010f3fc9d02b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132686, "uuid": "5bbdd878-d75d-401e-a7e1-d290c0ba3869", "comment": "Malware payload", "value": "587ea7ed279423b0bf58e3883adb360ff064d148", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132686, "uuid": "7508c0de-ccfa-40ee-89a5-7ccafb25c537", "comment": "Malware payload", "value": "d02e62b415c16f7f3a2ce07a55a230edb64528922239798baad28061d173bb1d260f23c45b8838fd99fc30bf473eb29c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132686, "uuid": "6e07ca71-385d-4505-a61f-5618de97e881", "value": "T12554F5AC820947BDA9536786F902F04E363F46543CB9E0BCB35B9DD8D3AE9749712423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132686, "uuid": "120b4222-757f-4990-a5a2-672187435bb1", "value": "768:3sgKfytBoMdqAxyyirtjSst2pyrvNHaqnl/Hoqzdnl/1OLoiYaMw1JEY8cbKvwva:3sstf3rbEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775132686, "uuid": "be20daeb-bece-453c-8447-a8df12e99076", "value": 285688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775132686, "uuid": "b7ef4daf-ddab-4677-9a64-bcc0700b2abd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132686, "uuid": "db051788-9302-4443-ad64-c1e4ed0b1f52", "value": "Agenda.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ce6648-2e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775123038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123038, "uuid": "e1d9e889-9114-48fc-857e-fb09763d0fc2", "comment": "Malware payload (Vidar)", "value": "db02c8573a42de32ab96e5c661c717ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123038, "uuid": "2c571c06-e785-4fc3-afb8-1d44c8937902", "comment": "Malware payload (Vidar)", "value": "f36d7b6412cf3015a34d2595e90e3bcf15ad23655de4d07864b164abe95b0240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123038, "uuid": "7d9d3c1f-5ca2-4a5f-9895-01a9b70b1a5f", "comment": "Malware payload (Vidar)", "value": "d97f3f20e5611397500d84b1cecf8df710634922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775123038, "uuid": "6e055594-4ce6-41e6-8d73-5bdc8106ac66", "comment": "Malware payload (Vidar)", "value": "684f71390f7a64bdac86b9fe3f6187bc6a52f6504d537f12936159d83cba628b55dcc906882c7b14326e043c8fc19686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123038, "uuid": "0c19de40-61ca-4b82-8a98-9b2e4caa6752", "value": "T176C58D17ADD108B6D06AA3368CB642967735F8480B3637D72E1366792FF37D49A38780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123038, "uuid": "2c13b96f-6487-4478-a63f-96f74db1f163", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123038, "uuid": "59e9005b-fc4a-4a93-82bc-2c8f8adbcf52", "value": "24576:WqsQgVAnge6838R2l5SmB7/syMnoNuYMwFZ/6L04n865mOpxwCGiWq3gZX4sk:WqHgage6XC5SMIywoNuY1CL04V08Hsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775123038, "uuid": "8c22e5e0-12de-4481-9dee-001e1f939079", "value": 2598776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775123038, "uuid": "9264b502-1b4e-4ce8-824a-fda89899edb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775123038, "uuid": "d5335730-fe11-4244-adba-237d4a57fbde", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d819e1-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125362, "uuid": "f3168021-d4d4-48be-95a8-e55c111238bf", "comment": "Malware payload (Mirai)", "value": "9072e5be7fdd82aad6770a8db2efc312", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125362, "uuid": "da83188b-451a-4403-81b7-48619ee2e08d", "comment": "Malware payload (Mirai)", "value": "f4d2cb8b8ff03d8a29cbfd94cf862b69a84cc9f62d0ea9fb57f925b86685c2ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125362, "uuid": "01f133e3-b518-4b81-bb8a-c9b4a59ea279", "comment": "Malware payload (Mirai)", "value": "b644181f6207f378a94feb93c1dbebdd55a98f45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125362, "uuid": "2c04b744-e8f0-4f72-96b9-cbde6be25a94", "comment": "Malware payload (Mirai)", "value": "fc456c1e9d852fd402f94876be733950286c54fd9bd58cfc9d3a95d0b268062e18c701e0a2e6b52397866976b0771874", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125362, "uuid": "36b3f29f-efca-4ee8-ac22-d63d0ba344e6", "value": "T1A9C3E909AB614FFBE86FCD3746E90B0529CC551722B83B7A3574D828F64B54B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125362, "uuid": "7f149ab7-5474-4e06-89dd-6e9c1bfa4b74", "value": "1536:htJ6cGVoxBFf+g6z3jLH514RX6bP+Y0+YdW0OKhR6wppsWZ5uRrKnre2F1Volykt:TJ6cGVoJ6Tne/6wQWCZ72bWliUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125362, "uuid": "98236fa7-8776-4ad8-a8d5-bb852df798ad", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125362, "uuid": "945088bc-ae85-477c-a022-1f210df6755b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125362, "uuid": "1b9931ff-7395-466d-8588-1be15c34efe8", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac64daf-2ebf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775153616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153616, "uuid": "4d52aa7c-8337-4bfa-93d7-7559d12b40a3", "comment": "Malware payload", "value": "e85f2a79d53d6da8e03b895addfe581a", "object_relation": "md5", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153616, "uuid": "0f2254ff-4230-4950-bcd8-361ae9517456", "comment": "Malware payload", "value": "f529edcd2da8c7199f553d98664be691ae5e3810af703665840c06aa10f6e920", "object_relation": "sha256", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153616, "uuid": "969a1d85-895a-49d1-abf2-52853384e2de", "comment": "Malware payload", "value": "54d08a8182d4c838224e07109ac2d683a309454d", "object_relation": "sha1", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775153616, "uuid": "45968cb4-f446-4732-9fb8-1b07418499d4", "comment": "Malware payload", "value": "77229464b35785ddd7d6dc3d01b83d7dcc06d45757cb76e4b1e1a76a48459d02f3b5878ffdd2fab820a7fc637a237f22", "object_relation": "sha3-384", "Tag": [ { "name": "79-137-206-33", "colour": "#A002C0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153616, "uuid": "a69e2a10-f9e9-45d7-bd41-749bfbfcfa39", "value": "T1BE75F11ABFE4CD69F523A17771A281A3FC2A4794C147F46704E49ECB5868C460B07BEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153616, "uuid": "fc6ed3c8-d974-4246-86a2-0c47dba3a2f4", "value": "49152:eqXiO0WthJBDKY5zegFEwCgONT2rybMuBqlBJTJdE:eajtYYVegFRCgOp86qlBVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775153616, "uuid": "84fb0c91-177a-43ab-9f23-1378e3f1b89a", "value": 1631252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775153616, "uuid": "6ccfc5ce-87bc-4a25-a8d7-7be3995a9c13", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775153616, "uuid": "199fedde-6307-4429-9c4f-48e3f33133b7", "value": "f529edcd2da8c7199f553d98664be691ae5e3810af703665840c06aa10f6e920.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f44e23-2e7d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775125347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125347, "uuid": "7dbed6b8-46e8-4c92-ae10-d49eafd54123", "comment": "Malware payload (Mirai)", "value": "86ffab0e015e29077f162787b7d3f408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125347, "uuid": "7d919766-2eda-4ae4-a13e-d8695d36bc45", "comment": "Malware payload (Mirai)", "value": "f590872fa139fcb92eafbe13fadbcb5362d5e59420586f35d0d3cf6609f5efff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125347, "uuid": "e0798692-efa4-47c5-8705-c83e58590579", "comment": "Malware payload (Mirai)", "value": "25da723890d71b8c7aafbd1bf795cbc21079ffac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775125347, "uuid": "61f9c9e1-956a-4340-9951-01478534bf15", "comment": "Malware payload (Mirai)", "value": "55b71186cf1b5681fa5d3de2f13571df0c3ae25c6d3b667dee29fc61877b7b2016ce3107e2b087fc7d115f84d22d8acb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125347, "uuid": "3236450e-1350-44a1-a34a-a1bb081e032b", "value": "T1548328C2BA4BC0F5D90748304067F33FCB32D6394061D66EEFAA9E65DE73642522629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125347, "uuid": "9b848436-d51a-4b58-9950-3109b132eb9d", "value": "1536:8l8IhK59kLMSbHh7znWAcanWC8f4TxdgoXF6hKql9:8/hU9ktbpnWnfgTxddXcl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775125347, "uuid": "93c63cd0-3682-4d65-9d2b-ae5d26bc8789", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775125347, "uuid": "82997f66-1466-437b-917b-3d72eb69d421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775125347, "uuid": "00417a40-f22d-4acc-8902-d6d6ed9fe0b3", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56238ced-2e75-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775121691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775121691, "uuid": "ec69437d-4e4a-4dc7-8cac-e6dcbd283d1f", "comment": "Malware payload (RemcosRAT)", "value": "1493767dbabc2f386ab2a7d1d9d1de0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775121691, "uuid": "5ecd40ef-1fac-4048-aa86-6a255a56bec0", "comment": "Malware payload (RemcosRAT)", "value": "f89b857ef81e292e31e9d41adb60a6e70d3f1469f983de15d24bb081e20597e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775121691, "uuid": "ef84aaa7-3ce0-4493-ab90-1fe2fca2b21a", "comment": "Malware payload (RemcosRAT)", "value": "a973a5ca5de4ae4a415f2faa0e191b5b40b4a3f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775121691, "uuid": "c2c26481-b80a-4d3f-a3c9-cf64dc2520aa", "comment": "Malware payload (RemcosRAT)", "value": "8b38e51fd897477a02df84fffd932abc748176b09928e4d44ce776f1e40001628daf77634e60f474e9206c05c19e38f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775121691, "uuid": "a3c9aac5-e456-4c82-a476-e70dd41fa347", "value": "T1786512482259EE01C99B4FF44DB0D3740BB96DD9A021D3578EEABEEBBD393052944393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775121691, "uuid": "93f8e71b-4503-436c-b0ef-88c4d89c75db", "value": "24576:Ng1bKsPB1uWrzT9YVRcPDUvYq43Q98y4n58XUbPBpkqV2ZvNm3SJJSHw:Ng1ZdHTicPDUvrKn/58KkSooqUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775121691, "uuid": "5417903b-6e1e-4306-9ba1-2ddc2a28614f", "value": 1466880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775121691, "uuid": "8a79eae6-e8f2-40e3-a0e6-8c173fc83098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775121691, "uuid": "b4d41bfb-3adb-4890-9953-561b920595f0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.32859669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c4d7f7-2e71-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775120001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120001, "uuid": "25d229e3-b24d-4f6c-95c3-91d161a9f3e7", "comment": "Malware payload (AsyncRAT)", "value": "feb1af2e50b59bd1becdd48e0eb2f860", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120001, "uuid": "21f3c751-7c33-49b8-9240-a631a3e4aa58", "comment": "Malware payload (AsyncRAT)", "value": "fb6d4ce94013385b31b30ec1ab8f1a6b2c34252a13062f880eae47b2b5cfc4e7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120001, "uuid": "f5c041f2-8c7a-4edb-b983-07feb08ace83", "comment": "Malware payload (AsyncRAT)", "value": "ed218270a49c59a97d7eba7b32c77145a5473b08", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120001, "uuid": "b9f7099f-fa16-4f49-8e87-1b778c92bb5f", "comment": "Malware payload (AsyncRAT)", "value": "755a5fbf8b30996e761e89ef7c74fb7af51292a9fc7d059cccb73ff92e18e28e0ca2d6f681de0ab17f910efb1fb491b7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120001, "uuid": "89e3f51e-265d-424e-81e5-0f83058c5920", "value": "T14405E1483359DE01C9A65FF45DB0D3B407B85D98A422E3178EFA7EEBBA3871169043D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120001, "uuid": "6e79dd46-c038-4913-b49d-160b1a612e2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120001, "uuid": "fb81265f-cac6-4030-9999-517a33fddba2", "value": "24576:5xM5ZSDWRSC1p46rn4YUFs4Yej/qSJJSHw:5C5gCT1p/hJ4Yej/qqUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775120001, "uuid": "42ee8d8d-2d01-48c6-9f8b-b08b5e8cd7a3", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775120001, "uuid": "3c224d2b-e3bb-48b3-99ef-e09e1b91b9a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120001, "uuid": "587ccc2a-e82d-4318-bdcc-19201cc34388", "value": "ISF CT-262-0326 CFS - DRAFT D866 HBL................................................................................................................................................................................scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e7eff2-2e3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775097953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775097953, "uuid": "f6d76b85-2b27-486b-b036-df17efcb3e70", "comment": "Malware payload", "value": "9a1e456465bcea43bd50a1522d3c2f94", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775097953, "uuid": "78b0e36f-b95e-4478-8a57-d79858ea9882", "comment": "Malware payload", "value": "fc712cf58e061f02875bec6e886fecd10fa22dd5b81a73d5a59cc06169aaccaf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775097953, "uuid": "41435b98-6342-4bd1-a34d-c450e6a8fafc", "comment": "Malware payload", "value": "46e5ffd7ba7402a5373398bea89538e3a2006078", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775097953, "uuid": "f76dd3d5-a3a7-4c3f-ad1f-cb3d93f36867", "comment": "Malware payload", "value": "53cad02343323a7c9136a1ea46aad6015ff19dd4e6b5c11cf3db72b53d8501d174e190c98aada0519d2d23d468d0b3b6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775097953, "uuid": "1dc0099b-9626-46ab-8f17-467585832280", "value": "T1915733DDDEA5128EE93E4830086D7686E66EBD2A6C424D6732FAF213107779030F5C67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775097953, "uuid": "f32330f6-a436-4da9-880e-54d22233f8fe", "value": "786432:E2+TbcVLjFmL4kijZRvUqa7DlWPAsrmC+juklA7CHGc:E2+TOQUjzvWlcZYGmHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775097953, "uuid": "2042fa1e-e948-46ef-9e7c-a43a9c228bf1", "value": 29671424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775097953, "uuid": "b944a3d8-fd75-401c-ae10-2c43dbbed96c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775097953, "uuid": "b1b5ae9c-55ea-4c9d-94b4-a6d465b15d0a", "value": "My Dear S Love.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be69c3d5-2e8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775132174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132174, "uuid": "866e730a-b33d-441c-a9f7-dc0ad06bf24d", "comment": "Malware payload", "value": "b29aeac7d4ecec44635fc7de79e0b77d", "object_relation": "md5", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132174, "uuid": "39ec98d9-14ed-4034-9e1b-4312a7a1b3ae", "comment": "Malware payload", "value": "fce33b1a8006abe1863eaeb2799a1ef81fcfca9fedbdae45d27f92eae68d0464", "object_relation": "sha256", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132174, "uuid": "a7f5b27c-0d47-474b-a35c-e76ea1fff741", "comment": "Malware payload", "value": "4366d516efc70dccfc954def33a25100e507479f", "object_relation": "sha1", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775132174, "uuid": "57f908cb-13e5-4796-9560-b65b3f9f66e9", "comment": "Malware payload", "value": "3f09ab4dc1bf90c2bf786f202ff343b43cef616a5668029a6cf2ba936e0bc66ec551b82ad82a8f45c78c5a79d25d227a", "object_relation": "sha3-384", "Tag": [ { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132174, "uuid": "b6b51f11-bb23-4ec9-8148-cb40c2f01a07", "value": "T1B5C633D4B97096F43B926B612BC359FCBAA046363DC8550BCD627300C13B6DAEBE7409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132174, "uuid": "50067dd0-2722-4eda-99fe-b1ca1994e93d", "value": "196608:OaBDaA1k4/Up5yokLJpuaXqQ2xwjPGJeHIfPdCTo8NOntVwZlxAzzqNTGGXOPjJy:+58ACZCyoIOntVGgz+NTERajz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775132174, "uuid": "5d8b0dc7-0db4-46e0-b759-2e9bef4f7bb0", "value": 12571385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775132174, "uuid": "beffdf79-7c3a-4e1d-8cde-4c9fdbcbf6a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775132174, "uuid": "f7493faf-1c9f-450a-8670-1a294322c70c", "value": "Komandovanie_v_strelkovyy_batalon.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19632653-2e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775091954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775091954, "uuid": "6931c8eb-f47e-406f-b509-8fcca362c887", "comment": "Malware payload (Vidar)", "value": "c035443e6bf7ba33f205dc7147d9d9d2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775091954, "uuid": "a012e869-f9f8-451a-b660-9918e9259b82", "comment": "Malware payload (Vidar)", "value": "fcee7a5d8a023d329be815b882ea2410ad397e4d37025a16e17321ebc7d15cc8", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775091954, "uuid": "33e8f084-7434-480f-be9c-9e91c8401655", "comment": "Malware payload (Vidar)", "value": "02d23141b368468f9b4c275d33ba3a136f8ddfc5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775091954, "uuid": "0a81038b-cc6f-46ab-b9ea-79aa352503b2", "comment": "Malware payload (Vidar)", "value": "50111444d057113cd44cbc21767bc2259efd67bba28a2b55c736eaa309c8b3a40b222a6d38f7f306f4e62430be49cd31", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775091954, "uuid": "a371f459-d27b-4905-8a5d-ab10bcad229e", "value": "T1EA42123DDAB5BDC4036F72D05A6A3F46205C4B23F7B16B6CF9C508A61824698DF3A19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775091954, "uuid": "3dc50915-db7e-4679-b8f4-ddc0b1c52c7d", "value": "192:nAcgOfhvPUEQIOQZGQaKllQvQW8xydJzUQtvuScsTcgfTIpLHcbQaV1HupiYpkrw:AchpvfhOQZGQail6QxxydJzUAWxqcgfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775091954, "uuid": "0e707e6d-a5f0-4e78-b6d3-78ee335bd213", "value": 12120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775091954, "uuid": "be3a8b6c-d6be-4523-a5f0-6644e15edae6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775091954, "uuid": "fcbf7cad-a3b5-4f10-b495-3d9cc15616a6", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a8726d-2e71-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775120160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120160, "uuid": "327776d3-2c37-403b-a0e0-4dda6ac28788", "comment": "Malware payload (PhantomStealer)", "value": "cdbe50fec9d9815b95abb2d78ac3522c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120160, "uuid": "2de94837-9d20-4804-ae7b-5530286707a3", "comment": "Malware payload (PhantomStealer)", "value": "fd8144fa9fadab3ce862d6e42da69e1f81e98906fe097ec884cc1ae9a73a5fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120160, "uuid": "ee3042f4-ecf6-4265-9a53-4832d534f2d5", "comment": "Malware payload (PhantomStealer)", "value": "afb99d8f45ffcbd03dc81505d5eb3cea1e9ee0a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775120160, "uuid": "8d286caf-089a-4778-a7af-02f8c98f0178", "comment": "Malware payload (PhantomStealer)", "value": "45edc37c4c25a5ae515b53ed0a1ccf900abe7a2593aef262fb7ce72d69fbd1a55e07d474d9f7e2b09b89fe898c8e038b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120160, "uuid": "e2330549-fd21-42df-9b89-d63cd65ab868", "value": "T16485CF5C46EFAEC1DA5A09B40720F23182D05E99E1CFD11B89D0F99FB63E3E56E052C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120160, "uuid": "d5522629-26f5-4e6d-8d18-2867c12ad024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120160, "uuid": "e6aad269-8e5a-4e01-8040-52e90ccca19a", "value": "24576:GPSJJSHwVhoGcvfpkJ5pu0rngybVQ4/n6TCEHZ1bdLt4TJoBLkOh02gAEOp:GPqUwVWGqS9RngyJl67HLbdZWJo5kDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775120160, "uuid": "e769650d-6a5b-412e-bac2-6ef20c31e6b2", "value": 1781248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775120160, "uuid": "60145716-fb27-4d88-a793-886a1022d5d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775120160, "uuid": "441cdd2b-27b1-4b35-8f1f-ab692646b537", "value": "Projects details and Products list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1832ef8e-2eca-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775158094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158094, "uuid": "7fc86705-80ed-4a2c-958a-400d5a8534ec", "comment": "Malware payload (LummaStealer)", "value": "2dde8587106b8fc9082c7dccf28c44b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158094, "uuid": "e3734a19-e350-472d-8f6c-3776cefd03eb", "comment": "Malware payload (LummaStealer)", "value": "fe0184cd17b02eb0fb6b1fd83e9ff5bbd7ce34c455abe93c4f5b78e6df1553c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158094, "uuid": "a3bad395-9b91-4b31-b422-1995d8e90d3f", "comment": "Malware payload (LummaStealer)", "value": "30fced0dbc13a739b994f8642911fae3609dca21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775158094, "uuid": "5e707bf1-74ac-44e6-967c-82908e8e688d", "comment": "Malware payload (LummaStealer)", "value": "1078e4ec9e3c57f94c6e19d03074576225fa495ec4ba63507bf20ee8072b4f39ddd3010db17b846233bfe22642676694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158094, "uuid": "a5f8a431-9acd-4b88-b22a-0e59f4229e2f", "value": "T173E52993B50A62DFD48E17789527CE56991D83FB0B1088C3E96CE47E7E63CC112B6D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158094, "uuid": "1efee84a-4771-490d-83ae-91e2ee1a8afe", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158094, "uuid": "820b3f47-7f27-43c5-afa6-40c10fa971ba", "value": "24576:qNYx0f598fKNTRVwB+wkNl4FzjJgNbwQlIXkfg1M0KhpFt7IblV89ACa42JI14NJ:3xOg2RyIwsl4hjwbeu2r4aa6ZSb5yB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775158094, "uuid": "33d6af14-1f79-43d1-803c-ba66574285ef", "value": 3176960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775158094, "uuid": "1f76474c-3219-4c27-87e0-021508b5e1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775158094, "uuid": "e7093aed-be45-4a90-bcef-678d21de9918", "value": "fe0184cd17b02eb0fb6b1fd83e9ff5bbd7ce34c455abe93c4f5b78e6df1553c8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2c9de9-2ecf-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775160301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160301, "uuid": "ac181fea-3456-425a-a462-62e5d1bc9c07", "comment": "Malware payload (CoinMiner)", "value": "18187157ee35d3d31dc870effec68f15", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160301, "uuid": "f548144a-ed4e-4768-9b5d-45e70cb5537c", "comment": "Malware payload (CoinMiner)", "value": "ffb7c4765dad2e804e6249b05334d8475fffb66dfc1b5984b285ebeceb5d17aa", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160301, "uuid": "b929038f-f7a4-4584-aa1c-aabb95f29512", "comment": "Malware payload (CoinMiner)", "value": "e01fab8e76bd2eefd7b4cd0894730393f12a0fa5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775160301, "uuid": "b7d20b24-36aa-4791-9626-d19145209828", "comment": "Malware payload (CoinMiner)", "value": "ece81c76528df33deff72f4f0b3425b951725f346c4a9e7ea1026e447fa7f5ceea7a995eef643103773ed76e34bef39f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160301, "uuid": "d93f8bb4-ead5-482e-8e61-41acea2e41cc", "value": "T10F22913A6E442121FE70C9FB057F6646DCFC11BB7F86B3DBA27291590AB42448243F99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160301, "uuid": "2c8ec80e-0726-4ff0-a2c5-94dc25694749", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160301, "uuid": "5252fe7e-0c05-4761-871f-b6c0d9ee8d9c", "value": "192:0nsoG2wdIaGB4SUxyNicMVAiPFJxTEZmFhNorcY2:AsoaadUMcWiPFwZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775160301, "uuid": "b6460ed8-d8d4-4030-90c9-12acde3346d2", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775160301, "uuid": "a561e2e1-a66b-43ef-8f96-f18213475489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775160301, "uuid": "0f3b31c0-c8fb-4f70-b668-73aecb6c4c9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }